Sigma detection rules, expert-reviewed

Suspicious ScreenConnect Client Download via PowerShell (via process_creation)

This rule detects PowerShell using Invoke-WebRequest to download a ScreenConnect client setup installer. The FROZEN#SHADOW campaign deployed ScreenConnect as remote access tooling for persistence and hands-on-keyboard activity.

Malicious SAM and SYSTEM Hive Dump via reg save

This rule detects reg.exe saving the SAM or SYSTEM registry hives to disk which the Librarian Ghouls APT exports to a staging folder to harvest local credentials offline. Dumping these hives enables offline password and secret extraction after gaining local admin. Reg save of security hives is rarely part of legitimate administration.

Malicious Service Creation for DcRAT Persistence via sc.exe (via process_creation)

This rule detects use of sc.exe to create the MixedSvc service pointing at a masqueraded Mixed Reality.exe binary under the Windows Media Player folder, the persistence mechanism used by Operation DragonReturn to survive reboots. The actor abused Windows service control to auto-start its DcRAT loader with SYSTEM privileges, making this a high-value chokepoint for catching the intrusion before code injection into svchost.

Malicious Eldorado Ransomware Ransom Note Creation

This rule detects the creation of the HOW_RETURN_YOUR_DATA.TXT ransom note dropped by Eldorado ransomware across encrypted directories. The note appears once encryption completes and delivers the extortion demand. It matters because its widespread creation confirms an active Eldorado impact event on the host or shares.

Malicious MoustachedBouncer Service DLL Hijack of WmdmPmSp via Registry (via registry_set)

This rule detects modification of the legitimate WmdmPmSp service ServiceDll value to point at the malicious creh.dll, a persistence method used by the MoustachedBouncer toolset. Hijacking an existing service DLL lets the implant run inside a trusted svchost process and survive reboots.

Malicious Defender Real-Time Monitoring Disabled by The Gentlemen RaaS (via process_creation)

This rule detects Set-MpPreference invoked to disable Microsoft Defender real-time monitoring, a defense-evasion step used by The Gentlemen ransomware operators before deploying tooling. Turning off real-time protection lets subsequent payloads run unimpeded. Catching this reveals active tampering with endpoint defenses.

Suspicious Python Execution Spawned from Batch and Script Chain

This rule detects python.exe launched by a command interpreter that was itself started from a batch or PowerShell parent, matching the BAT to PowerShell to CMD to python execution tree of the Snake Python infostealer. Attackers use this chained launcher to unpack and run the Python stealer while blending into scripted activity. The interpreter-to-python lineage highlights the malware execution flow.

Malicious RDP Shadow Session Started - Command (via process_creation)

This rule detects would attempt to shadow a RDP session.

Malicious PowerShell Download Cradle From GitHub Raw (via process_creation)

This rule detects a PowerShell download cradle that pipes an Invoke-WebRequest against raw.githubusercontent into Invoke-Expression. Phantom Goblin uses this to fetch and execute its Go-compiled stealer binaries.

Malicious SharpGPOAbuse GPO Modification Tool from Public Directory

This rule detects execution of the SharpGPOAbuse tool renamed to gpo.exe from the C:\Users\Public directory during a CrazyHunter ransomware intrusion. The attacker abuses Group Policy to push ransomware components domain-wide, so an unsigned GPO manipulation binary launched from a world-writable path signals defense evasion and preparation for mass deployment.

Malicious Event Log Clearing via Wevtutil

This rule detects wevtutil clearing Windows event logs, an anti-forensics action used to erase traces of intrusion activity. This was observed during KawaLocker ransomware deployment alongside firewall and shadow copy tampering. Wiping logs removes the primary evidence responders use to trace attacker actions.

Suspicious DNS Tunneling With Hex Subdomain To info Domain (via dns_query)

This rule detects DNS queries to info domains whose leftmost label is a long hexadecimal string, the encoding CoinLoader uses to tunnel data and receive commands over DNS TXT records. High-entropy hex subdomains under a single parent domain are a strong signal of DNS tunneling rather than normal name resolution.

Suspicious MSBuild LOLBin Spawning Script Interpreter (via process_creation)

This rule detects MSBuild.exe spawning PowerShell or cmd child processes which indicates inline task code execution abused as a signed binary proxy. Legitimate build automation rarely has MSBuild directly launching interactive script interpreters.

Suspicious Regsvr32 Execution Of DLL From User Writable Path via Process Creation

This rule detects regsvr32.exe registering a DLL located in a user-writable directory such as Temp or AppData. Emotet drops its payload DLL into a temporary folder and executes it through regsvr32 to proxy execution and evade application controls, a pattern uncommon for legitimate software.

Suspicious SMB MaxMpxCt Registry Tuning (via registry_set)

This rule detects modification of the LanmanServer MaxMpxCt registry value, which Repellent Scorpius raises to increase the number of concurrent SMB commands and accelerate lateral movement and ransomware distribution. Tuning this value is uncommon outside of specialized administration and often precedes mass network encryption.