Sigma detection rules, expert-reviewed

Suspicious Registry SYSTEM Hive Dump via Reg Save (via process_creation)

This rule detects reg.exe saving the HKLM SYSTEM hive to a local file, a credential access technique used in the MS-SQL intrusion to extract secrets for offline processing. Saving the SYSTEM hive to a user writable path is rarely part of legitimate administration.

Suspicious NetSupport client32 Execution from ProgramData (via process_creation)

This rule detects execution of the NetSupport Manager remote control client client32.exe from a CommunicationLayer directory under ProgramData. The JS#SMUGGLER campaign installed NetSupport RAT to this path.

Suspicious JSP Webshell Written to SAP irj work Directory (via file_event)

This rule detects JSP files being written under the SAP servlet_jsp irj work directory, the deployment location where CVE-2025-31324 exploitation dropped webshells such as forwardsap.jsp and helper.jsp. New JSP files appearing in this runtime path indicate server software component abuse. This is a reliable webshell persistence signal.

Suspicious VBA Runtime Loaded by Process from OneNote Exported Directory

This rule detects a process running from the OneNote exported attachment or temp directory loading the VBE7.dll VBA runtime, indicating macro or script execution from a weaponised OneNote embedded file. Legitimate applications rarely execute from the OneNote Exported path, so loading the VBA engine from there signals malicious code launched via a OneNote phishing lure.

Suspicious Boot Recovery Disabled via bcdedit Before Encryption (via process_creation)

This rule detects bcdedit disabling Windows boot recovery, an inhibit-recovery step performed by Mallox ransomware before file encryption. Adversaries turn off automatic recovery so victims cannot restore systems after encryption, making this a common pre-encryption impact indicator that warrants investigation alongside surrounding activity.

Malicious Turla PNG Dropper Service Masquerading as Windows Error Reporting via Service Creation

This rule detects installation of a Windows service using names that masquerade as legitimate Windows Error Reporting components which the Turla PNG Dropper uses for persistence. Observed in NCC Group research on the returning Turla PNG Dropper which registers services such as WerFaultSvc and RegRunnerSvc to load steganographic payloads. Detecting these masquerading service installations helps catch stealthy persistence by this espionage actor.

Suspicious Long Alphanumeric DNS Subdomain Indicative of DNS Tunneling

This rule detects DNS queries whose leftmost label is an unusually long fixed-width alphanumeric string, matching the 28 to 31 character encoded subdomains used by the Saitama DNS implant to smuggle command-and-control data. Such high-entropy labels are a hallmark of DNS tunneling and warrant review of the querying host for a covert C2 channel.

Malicious BITS Job Notify Command Pointing To ProgramData Payload via BITSLOTH

This rule detects creation of a BITS transfer job named Microsoft Windows configured with a SetNotifyCmdLine that executes a binary staged under C:\ProgramData which is the persistence mechanism used by the BITSLOTH backdoor. Adversaries abuse the Background Intelligent Transfer Service to survive reboots and blend malicious execution into a trusted Windows service.

Suspicious php.exe Backdoor Execution from AppData Roaming

This rule detects the PHP interpreter running from a user AppData Roaming directory while loading extensions and a config file, which matches the Interlock PHP backdoor. The group deployed php.exe with an extension directory and config.cfg to run a resident backdoor from Roaming rather than a normal install path. A scripting interpreter running from a per-user profile path is a strong indicator of malicious code execution and persistence.

Malicious svcagent DLL Load From AssetMon ProgramData Directory via PHANTOMPULSE

This rule detects loading of svcagent.dll from a ProgramData AssetMon directory as used by the PHANTOMPULSE blockchain C2 RAT in Elastic research. A service agent named DLL staged under a fabricated AssetMon folder in ProgramData indicates the implant module being mapped for execution and persistence.

Suspicious UAC Bypass via ComputerDefaults Auto-Elevation (via process_creation)

This rule detects the auto-elevating ComputerDefaults.exe spawning a command interpreter or scripting host, the signature of a registry-hijack UAC bypass. PrivateLoader abuses ComputerDefaults to run elevated code without prompting the user, gaining higher privileges for installation. A trusted auto-elevated binary launching cmd or PowerShell is a well-known UAC-bypass pattern.

Suspicious C2 Connection to AWS Lambda Function URL

This rule detects outbound connections to AWS Lambda function URLs in the ap-southeast-1 region. The backdoor targeting Southeast Asian governments tunnels novel covert C2 through Lambda function URLs to blend with legitimate cloud traffic. Endpoint processes contacting these on.aws endpoints warrant review for web-service C2 abuse.

Possible Process Injection into Notepad via PythonRatLoader (via process_creation)

This rule detects notepad.exe being spawned by a Python interpreter, which corresponds to the PythonRatLoader chain that creates suspended notepad processes as hosts for Early Bird APC shellcode injection delivering DCRat, VenomRAT and XWorm. A Python process launching Notepad is highly abnormal on endpoints.

Suspicious Virtual Machine Detection via Get-MpComputerStatus and Win32_VideoController (via ps_script)

This rule detects PowerShell anti-analysis checks used by MintsLoader that read the IsVirtualMachine property from Get-MpComputerStatus or query the Win32_VideoController AdapterDACType to fingerprint virtual display adapters. The loader aborts when it believes it runs inside a sandbox. Scripted inspection of these virtualization indicators is characteristic of evasive malware rather than administration.

DSRM Password Changed - Reg via Command (via security)

This rule detects reset or synchronize with another domain account the DSRM (Directory Services Restore Mode) password in order to escalate privileges.