Sigma detection rules, expert-reviewed

DLL Side-Loading of WebUI.dll via Iscrpaint Host Binary

This rule detects the iscrpaint.exe binary loading WebUI.dll, the DLL side-loading pair used to run LummaStealer under a signed host process. Loading this companion DLL from the malware staging directory indicates search-order hijacking rather than legitimate application behavior.

Suspicious AdInsight Execution from ProgramData via Scheduled Task by WikiLoader

This rule detects a renamed AdInsight executable running from the ProgramData directory, the persistence payload a scheduled task launches in the spoofed GlobalProtect WikiLoader campaign. A signed utility executed from a non-standard writable path indicates masquerading and sideloading rather than legitimate use. Detecting this exposes the persistence and execution stage of the loader.

Suspicious File Download via Certutil URLCache [Huntress] #2

This rule detects certutil.exe downloading a remote file using the urlcache option, a LOLBIN download technique Huntress observed after Wing FTP CVE-2025-47812 exploitation. Attackers use certutil to retrieve payloads over HTTP while blending in with a trusted signed binary. Certutil retrieving content from a URL is a common ingress tool transfer indicator that warrants review of the fetched resource.

Suspicious Command Processor AutoRun Persistence via Registry Set

This rule detects writes to the Command Processor AutoRun registry value, which forces a command to run whenever cmd.exe starts and was used for persistence in the Uncorking Old Wine Cobalt Strike loader. This value is rarely set by legitimate software and is a well-known event-triggered execution vector.

Malicious Domain Admin Account Escalation via net group (via process_creation)

This rule detects a net group command adding an account to the Domain Admins or Enterprise Admins group over the domain. Operators exploiting BeyondTrust Remote Support via CVE-2026-1731 created a domain account and escalated it into these privileged groups.

Suspicious WinSvcUpd Scheduled Task Persistence via schtasks (via process_creation)

This rule detects creation of a scheduled task named WinSvcUpd that runs PowerShell with a bypassed execution policy at logon with highest privileges. The GPUGate malware registered this task masquerading as a Windows update service for persistence.

Suspicious RDP Wds StartupPrograms Persistence Modification (via registry_set)

This rule detects modification of the Terminal Server rdpwd StartupPrograms value which lists programs launched when a Remote Desktop session starts. Adversaries append their payload to this value to persist and execute code on incoming RDP logons.

Suspicious Scheduled Task TPMProfiler Executing QEMU Emulator

This rule detects creation of a scheduled task named TPMProfiler or a task configured to run qemu-system-x86_64, the persistence and execution mechanism observed after SolarWinds Web Help Desk exploitation where a QEMU emulator was launched to evade host-level inspection. Masquerading a task as a benign TPM profiler while it starts a full system emulator is a deliberate concealment tactic. This pairing of task name and QEMU binary is a reliable compromise indicator.

Suspicious Kimsuky Run Key Persistence via Masqueraded Value (via registry_set)

This rule detects creation of a Run key value named Everything, install or tdll, autostart names Kimsuky used to persist its PebbleDash based tools under benign looking labels. The autostart relaunches the implant at logon while masquerading as ordinary software. Detecting these value names surfaces registry persistence tied to the campaign.

Suspicious Privileged Docker Container Mounting Host Filesystem

This rule detects a privileged Docker container being started with the host root filesystem bind-mounted into it, a configuration used to break container isolation and read host secrets. It is associated with software supply chain attacks that abuse developer and CI Docker access to reach host credentials. Detecting privileged host-mount launches flags container escape and credential access attempts.

Suspicious Azure CLI Disk Snapshot and Copy for Data Theft

This rule detects Azure CLI commands that create a managed disk snapshot or clone a disk from an existing source. It maps to cloud data theft where an attacker snapshots a target VM disk and attaches a copy to an unmonitored instance to read its contents. Detecting it exposes disk exfiltration through the cloud control plane.

Suspicious Scheduled Task Creation Launching a Script Interpreter (via process_creation)

This rule detects schtasks.exe creating a scheduled task whose action runs a command shell, PowerShell or another script interpreter or a payload from a user-writable path. Scheduled Task abuse is a top persistence and execution technique in the Red Canary Threat Detection Report, letting adversaries survive reboots and run code on a trigger. Detecting task creation that wraps an interpreter or suspicious path surfaces the persistence attempt as it is registered.

Suspicious Data Exfiltration via Rclone to Cloud Storage (via process_creation)

This rule detects the rclone utility being run with copy, sync or transfer-tuning flags that indicate bulk movement of files to a remote cloud endpoint. Emotet-related intrusions abuse rclone to exfiltrate collected data to attacker cloud storage before disruptive follow-on activity. Automated cloud transfers driven from an endpoint are a common precursor to extortion and should be reviewed.

MintsLoader AMSI Bypass via amsiInitFailed Reflection (via ps_script)

This rule detects the MintsLoader in-memory AMSI bypass that reflectively sets the amsiInitFailed field on the AmsiUtils type to disable the Antimalware Scan Interface before staging the next payload. Adversaries leverage this bypass to run malicious PowerShell content without scanning, making it a high-confidence defense-evasion indicator.

Malicious Hiloti Configuration Registry Key Creation (via registry_set)

This rule detects creation of the Bfetipi registry key under the Windows software hive, a configuration and persistence artifact of the Hiloti DNS-tunneling malware observed in Unit 42 daily tunneling detections. This non-standard key name is unique to the malware family and indicates infection.