Sigma detection rules, expert-reviewed

MintsLoader AMSI Bypass via amsiInitFailed Reflection (via ps_script)

This rule detects the MintsLoader in-memory AMSI bypass that reflectively sets the amsiInitFailed field on the AmsiUtils type to disable the Antimalware Scan Interface before staging the next payload. Adversaries leverage this bypass to run malicious PowerShell content without scanning, making it a high-confidence defense-evasion indicator.

Malicious Hiloti Configuration Registry Key Creation (via registry_set)

This rule detects creation of the Bfetipi registry key under the Windows software hive, a configuration and persistence artifact of the Hiloti DNS-tunneling malware observed in Unit 42 daily tunneling detections. This non-standard key name is unique to the malware family and indicates infection.

Malicious Port Forwarding Tunnel via Netsh Portproxy (via process_creation)

This rule detects netsh interface portproxy commands that create a local port-forwarding tunnel, which adversaries use to relay traffic through a compromised host and reach otherwise unreachable internal systems. Netsh portproxy tunneling is a command-and-control and lateral-movement technique in the Red Canary Threat Detection Report. Detecting the tunnel setup surfaces network pivoting through the endpoint.

Suspicious External IP Discovery via Curl to Ipinfo

This rule detects curl querying ipinfo.io to learn the host external IP address, a reconnaissance step attackers use to geolocate and fingerprint a compromised environment. This was observed in a hands-on-keyboard operation. External IP lookups from servers or non-admin contexts can indicate attacker situational awareness.

Malicious Firewall Rule Any/any Created (via firewall-as)

This rule detects scenarios where a firewall rule any/any is added to allow any incoming or outgoing traffic.

Suspicious PowerShell AMSI Bypass In-Memory Patching

This rule detects PowerShell attempting to disable the Antimalware Scan Interface by reflectively locating and patching amsiInitFailed or amsi.dll in memory. The ARECHCLIENT2 information stealer uses this AMSI bypass so subsequent in-memory stages are not inspected by endpoint scanning.

Suspicious Windows Subsystem for Linux (WSL) Installation - PowerShell (via powershell)

This rule detects enables the WSL to cary out malicious activities in a virtual instance to avoid detection.

Suspicious pythonw.exe Executing LICENSE.txt Downloader from AppData

This rule detects a hidden pythonw.exe process launched from the AppData Local directory with a LICENSE.txt argument, matching an AI-themed lure that drops a Python downloader loading shellcode. Running a Python interpreter over a text file disguised as a license from a user writable path is a strong sign of staged malware execution.

Suspicious UAC Bypass via CMSTP INF Auto-Install

This rule detects execution of cmstp.exe with the auto-install switch pointing to an INF file, a technique used to bypass User Account Control and execute arbitrary commands at high integrity. The Sliver C2 framework and multiple threat actors abuse this living-off-the-land binary to elevate privileges while evading defenses. Detecting it early helps stop attacker privilege escalation before further post-exploitation activity.

Malicious DLL Sideloading of wke.dll via DriverAssistant acvb (via image_load)

This rule detects the signed DriverAssistant binary acvb.exe loading a wke.dll located alongside it, a DLL side-loading chain used to bypass UAC and launch FatalRAT. This behavior was observed in Operation SalmonSlalom against Chinese-speaking targets in APAC. Detecting the abnormal module load exposes the defense-evasion and execution stage of the loader.

Malicious Windows Defender Disable via Policy Registry Keys

This rule detects modification of the Windows Defender policy registry values that switch off antispyware antivirus and real time monitoring as performed in the SystemBC intrusion described by WithSecure. Disabling Defender through policy keys is a defense evasion step attackers take to clear the path for credential theft and ransomware staging.

Malicious Shai-Hulud npm Payload Execution via bun_environment Script (via process_creation)

This rule detects execution of the Shai-Hulud worm install-hook payloads setup_bun.js and bun_environment.js, dropped and run via npm pre/post-install scripts during the supply-chain compromise. These scripts scan for cloud and SSH credentials and self-propagate, so their execution signals active infection of the npm ecosystem.

Malicious Volgmer Payload Storage in WMI Security Registry Key

This rule detects creation of specific named values under the WMI Security registry key used by the Hidden Cobra Volgmer backdoor to hide its encoded configuration and payload. Writing data to this rarely used registry location under these hardcoded GUID value names is a high-confidence indicator of a Volgmer infection.

Suspicious rundll32 shell32.dll Ordinal 61 Execution

This rule detects rundll32.exe calling shell32.dll by ordinal number 61, a proxy-execution trick observed in the NightshadeC2 loader chain. Invoking shell32 functions by ordinal avoids readable export names and is used to launch further stages while blending into normal rundll32 usage. Ordinal-based shell32 execution rarely appears in legitimate activity.

Suspicious Execution of Microsoft.Http.Api.exe from AppData

This rule detects execution of a binary named Microsoft.Http.Api.exe from a user AppData path, used by the SHELBY backdoor to masquerade as a legitimate Microsoft component. A Microsoft-branded executable running from AppData rather than a system directory indicates masquerading and side-loading staging used to blend malicious execution with trusted software.