Sigma detection rules, expert-reviewed

Suspicious Node.js Script Execution from AppData Roaming

This rule detects the Node.js runtime executing from a hidden node_x86 directory under user AppData Roaming. This matches the persistence footprint of a malicious Windsurf IDE extension that stages its loader outside standard install paths and communicates over the Solana blockchain.

CastleLoader ClickFix PowerShell Hex Decode and Re-Execution

This rule detects a ClickFix style command that decodes a hex encoded string in PowerShell and pipes the result into a second PowerShell instance for execution. This pattern delivers CastleLoader and related payloads directly in memory.

Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32

This rule detects extrac32.exe extracting a cabinet archive that uses a deceptive vstm extension. This delivery step was observed in CastleLoader and LummaStealer fake installer campaigns to unpack staged components.

Antivirus Software Discovery via tasklist and findstr

This rule detects reconnaissance that pipes tasklist output through findstr to enumerate running security product processes. CastleLoader performs this check to identify installed defenses before deploying its payload.

Agent Tesla Persistence via Realtek Named Scheduled Task Batch

This rule detects execution of a batch file named RealtekCodec that masquerades as an audio helper and is launched minimized from a scheduled task. This persistence method runs the Agent Tesla loader at user logon.

Suspicious DLL Execution via Regsvr32 DllInstall of dat File

This rule detects regsvr32.exe invoking the DllInstall export against a file that uses a dat extension. This signed binary proxy execution technique runs a C2 agent DLL delivered inside fake game trainers and pirated Battlefield 6 installers.

Chisel Reverse Tunnel Tool Execution from Temporary Directory

This rule detects execution of the Chisel tunneling utility from a temporary or ProgramData directory. RedCurl deploys Chisel under an obfuscated garble and UPX packed name to pivot and tunnel through compromised networks.

Windows Defender Tampering via Set-MpPreference and Exclusions

This rule detects PowerShell commands that weaken Microsoft Defender by disabling cloud reporting and sample submission or by adding broad ProgramData exclusion paths. RedCurl performs these steps before deploying its QWCrypt ransomware.

FTP Data Exfiltration via curl with Embedded Credentials

This rule detects curl uploading a file to an FTP server using inline username and password credentials. Unfading Sea Haze uses this method to move staged archives of stolen data to attacker controlled infrastructure.

Antivirus Check and Remote Loader Retrieval in LNK Command Chain

This rule detects a command chain that checks for the ESET kernel service with tasklist and findstr then downloads a remote payload and hands it to MSBuild for execution. This LNK based initial access is used by Unfading Sea Haze.

MSBuild Executing Non-Project File or Remote Payload

This rule detects MSBuild running a file that is not a normal project such as a log file or a payload staged in a public folder. Unfading Sea Haze abuses MSBuild to compile and execute .NET loaders in memory from these staged files.

Suspicious Windows Defender Real-Time Protection Disabled via Policy Registry by Cephalus Ransomware

This rule detects registry changes under the Windows Defender Real-Time Protection policy key that disable on-access and real-time scanning, a defense evasion step used by Cephalus ransomware. Turning off these protections lets the encryptor run without interference.

Suspicious Remote Desktop Enabled via fDenyTSConnections Registry by Sandworm

This rule detects the fDenyTSConnections registry value being set to zero, which enables inbound Remote Desktop connections on the host. Sandworm enables RDP to maintain interactive remote access during intrusions.

Suspicious AutoAdminLogon Enabled via Winlogon Registry by RansomHub Ransomware

This rule detects the Winlogon AutoAdminLogon value being enabled, configuring automatic logon of an account without credentials. RansomHub sets this value to maintain access and ensure its payload runs after reboot.

Suspicious PowerShell Hidden Web Download via Invoke-WebRequest by CatB Ransomware

This rule detects a hidden PowerShell or cmd invocation combining Invoke-WebRequest with DownloadData to retrieve a payload, matching the ingress tool transfer behavior emulated for CatB ransomware. Running the download in a hidden window is a common defense evasion tactic for staging follow-on malware.