Sigma detection rules, expert-reviewed

Malicious Registry Run Key Persistence via AHealthDB by Stately Taurus

This rule detects creation of a Run key value named AHealthDB that launches SmadavProtect32.exe, matching the persistence mechanism used by Stately Taurus in cyberespionage against the Philippines government reported by Unit 42. The actor masquerades a Run entry to auto-start a sideloading host at logon which maintains footholds for espionage.

Suspicious PowerShell Shellcode Loader via Function Pointer Delegate

This rule detects PowerShell that fetches remote content and invokes GetDelegateForFunctionPointer to execute shellcode. The AdaptixC2 framework uses Invoke-RestMethod to retrieve a beacon and this delegate call to run it in memory. Combining a network fetch with function pointer delegation is a hallmark of in-memory shellcode loaders.

Suspicious PowerShell In-Memory Execution with AES Decryption

This rule detects PowerShell script blocks that combine Invoke-Expression with AES and base64 decryption routines. The DarkCloud stealer chain decrypts an obfuscated payload in memory and executes it via Invoke-Expression. Pairing in-memory execution with cryptographic decryption is characteristic of staged fileless loaders.

Malicious AI CLI Anti-Attribution and Permission Bypass Flags

This rule detects invocation of an AI coding CLI with flags that suppress attribution headers or bypass the human approval gate such as the skip-permissions switch or the yolo approval mode. The Chinese-speaking actor sets these options to let an AI model run offensive actions autonomously and anonymously. Detecting these flags reveals adversarial abuse of agentic tooling to remove human oversight.

Suspicious Python HTTP Server Staging for Payload Delivery

This rule detects launch of the built-in Python HTTP server module used to host files for delivery over the network. In the Chinese-speaking autonomous AI attack campaign the actor runs python3 http.server on port 8888 from a worker home directory to stage tooling onto victims. Detecting this ad-hoc server exposes an ingress transfer channel operated from a compromised host.

Suspicious GitHub CLI Auth Token Extraction via Command Line

This rule detects invocation of the GitHub CLI to print the stored authentication token, a step malicious npm packages use to exfiltrate a developer GitHub session after a build. In the tracked npm supply chain attacks this token theft follows a bun-triggered install hook. Detecting the token dump surfaces credential access that enables repository compromise and further supply chain abuse.

Suspicious Advanced IP Scanner Execution for Network Discovery

This rule detects execution of Advanced IP Scanner, a dual-use network mapping tool frequently staged by ransomware crews to enumerate reachable hosts before lateral movement. The Gentlemen ransomware operators run it during the discovery phase of their intrusions. Detecting it in unexpected contexts can reveal pre-encryption reconnaissance.

Malicious Scheduled Task Named Gentlemen via Schtasks

This rule detects creation of a scheduled task named gentlemen, the persistence marker used by The Gentlemen ransomware operators. The task re-launches ransomware tooling across reboots during the intrusion. Detecting this named task provides a high-confidence indicator tied directly to the campaign.

Suspicious MicrosoftEdgeUpdate Launched with Dat Config File

This rule detects MicrosoftEdgeUpdate.exe being started with a --config argument pointing at a .dat file, a pattern the legitimate Edge updater never uses. The Vidar campaign abuses the trusted Edge updater name to sideload a payload configured from a data file such as mgwthmc2.dat. Detecting this unusual argument reveals a masqueraded loader riding a signed updater filename.

Malicious Scheduled Task Masquerading as Defender NisSrv via Schtasks

This rule detects creation of a scheduled task named SystemAgentService that launches a NisSrv.exe payload at user logon. The Vidar stealer and XMRig miner campaign registers this task to masquerade its persistence as the Microsoft Defender network inspection service. Detecting the fake service task exposes a logon-triggered foothold impersonating a security component.

Suspicious Choice Command Self-Destruct Delete Loop via Command Line

This rule detects use of the built-in choice.exe utility as a timing gate chained with a delete command, a self-destruct pattern that waits before removing the dropper to erase traces. CL-STA-1062 uses choice.exe delays to self-delete its staging binaries after execution. Detecting this timed cleanup reveals anti-forensic behavior that removes evidence of the intrusion.

Suspicious Base64 Decoded Shell Dropper via Command Line

This rule detects a base64 encoded blob being decoded on the command line and piped straight into a shell interpreter. The OpenClaw AI supply chain campaign hides its curl-based droppers inside base64 to evade string based inspection before executing macOS stealer code. Catching this decode-and-run chain reveals obfuscated execution that static content filters miss.

Malicious PowerShell Masquerading as Windows Terminal in ProgramData (via process_creation)

This rule detects an executable named wt.exe running from a ProgramData path, a masquerade used in the Axios supply chain attack where PowerShell was copied to %PROGRAMDATA%\wt.exe to impersonate Windows Terminal. The legitimate Windows Terminal never runs from ProgramData, so this location indicates a relocated payload used to evade detection.

Suspicious GoogleUpdate Binary Executing From Non-Standard Path (via process_creation)

This rule detects the GoogleUpdate.exe binary running from a path outside the standard Google installation directories, a masquerade used by threat clusters targeting a Southeast Asian government organization to sideload malicious DLLs under a trusted process name. A trusted updater executing from an unexpected location indicates the binary was relocated to abuse DLL search-order hijacking.

Suspicious LampoRAT Command Dispatcher via Cmd Delayed Expansion Flags (via process_creation)

This rule detects the distinctive cmd.exe flag combination /e:ON /v:OFF /d /c used by the LampoRAT command dispatcher attributed to Boggy Serpens. This precise switch pattern is atypical of interactive or scripted administration and reflects the implant executing operator commands on the host.