Sigma detection rules, expert-reviewed

Suspicious LampoRAT Command Dispatcher via Cmd Delayed Expansion Flags (via process_creation)

This rule detects the distinctive cmd.exe flag combination /e:ON /v:OFF /d /c used by the LampoRAT command dispatcher attributed to Boggy Serpens. This precise switch pattern is atypical of interactive or scripted administration and reflects the implant executing operator commands on the host.

Suspicious Data Staging via Rar Archive With Delete Flag (via process_creation)

This rule detects use of rar to build an archive while deleting source files after archiving, a collection and staging technique used by CL-UNK-1068 to compress stolen data into files such as host.rar prior to exfiltration. The delete flag reduces on-disk footprint and reflects deliberate staging of collected data.

Malicious FRP Reverse Proxy Tunnel Identified by Hardcoded Token (via process_creation)

This rule detects the hardcoded FRP authentication token frpforzhangwei used by CL-UNK-1068 to establish fast reverse proxy tunnels into victim networks. This unique token constant identifies the actor's tunneling infrastructure, providing persistent encrypted access for command and control and lateral movement.

Suspicious Extraction of PuTTY SSH Host Keys via Reg Export (via process_creation)

This rule detects export of the PuTTY SshHostKeys registry key, used by CL-UNK-1068 to harvest cached SSH host key material for lateral movement to Unix and network infrastructure. Recorded SSH host keys reveal previously accessed remote systems, so this extraction supports pivoting deeper into the environment.

Suspicious IIS Configuration Reconnaissance via Appcmd (via process_creation)

This rule detects enumeration of IIS sites, virtual directories, and application pools using appcmd, a discovery behavior used by the CL-UNK-1068 cluster during long-running operations against high-value sectors. Attackers use this reconnaissance to map web application deployment for webshell placement and lateral movement, making it an early indicator of hands-on-keyboard activity.

Malicious NTDS Credential Dump via Ntdsutil IFM Snapshot (via process_creation)

This rule detects use of ntdsutil to create an Install From Media snapshot of the Active Directory database, a credential access technique used by actors following BeyondTrust CVE-2026-1731 exploitation. The IFM snapshot exports the NTDS.dit hive containing domain password hashes, enabling full domain compromise, so this activity should be treated as active credential theft.

Malicious BeyondTrust Bomgar Agent Spawning Command Shell via Remote Support Exploitation (via process_creation)

This rule detects the BeyondTrust Bomgar remote support agent spawning a command shell, a behavior observed during exploitation of critical vulnerability CVE-2026-1731 by actors deploying VShell and SparkRAT. The remote support binary should not launch cmd.exe or powershell.exe, so this chain indicates remote code execution against the appliance and warrants immediate response.

Suspicious Data Exfiltration via Rclone Cloud Transfer (via process_creation)

This rule detects Rclone copying or syncing data to a remote backend, the exfiltration tool used by the Ashen Lepus AshTag operators to move staged diplomatic data to attacker cloud storage. Rclone copy and sync operations bulk-transfer collected files off the host to web services.

Malicious Scheduled Task Masquerading as Windows Defender Updater (via process_creation)

This rule detects creation of a scheduled task named to impersonate Windows update or Defender maintenance, a persistence technique used by the Hamas-affiliated Ashen Lepus AshTag malware suite. The benign-looking task names Windows Defender Updater and Automatic Windows Update disguise attacker-controlled recurring execution.

Suspicious Self-Delete Chain via Loopback Ping and File Deletion (via process_creation)

This rule detects a self-deletion chain that pings the 127.0.0.7 loopback address as a timing delay before force-deleting a file, a cleanup routine used by the 01flip ransomware to remove its own binary after execution. Chaining ping to loopback with del /f /q lets the malware wait for its parent to exit and then erase traces.

Suspicious Anti-Recovery Zeroing via fsutil setZeroData (via process_creation)

This rule detects use of fsutil setZeroData, which overwrites file regions with zeros to prevent forensic recovery, a self-delete and anti-recovery step in the 01flip Rust ransomware Windows chain. The technique destroys the original binary and data remnants after encryption to inhibit recovery and analysis.

Malicious Shai-Hulud npm Worm Marker via SHA1HULUD Process Name (via process_creation)

This rule detects a process launched with the SHA1HULUD marker on its command line, the self-identifying tag used by the Shai-Hulud npm supply-chain worm. The worm spawns processes named SHA1HULUD during propagation and token theft, so this constant is a high-confidence indicator of compromise on developer and CI hosts.

Malicious WSUS Service Spawning Command Shell via CVE-2025-59287 (via process_creation)

This rule detects the WSUS service or its worker process spawning a command interpreter, the immediate post-exploitation behavior of CVE-2025-59287 remote code execution. WSUS components should never launch cmd or PowerShell, so this chain marks active exploitation. Detecting it exposes attacker command execution on a patch-management server used as an entry point.

Suspicious Chrome Launch With Remote Debugging via Airstalk (via process_creation)

This rule detects a Chromium-based browser started with the remote debugging port flag, a technique the Airstalk malware uses to hijack browser sessions and steal cookies and tokens. Enabling the debugging protocol lets the malware drive the browser and read authenticated state. Detecting this launch surfaces credential and session theft in a suspected supply chain intrusion.

Suspicious PowerShell Spawned by WScript via PhantomVAI Loader (via process_creation)

This rule detects PowerShell executed as a child of WScript, an early link in the PhantomVAI loader chain that proceeds through msedge and MSBuild to injection. Script-host to PowerShell transitions are a common malware execution handoff. Detecting this chain catches the loader before the final infostealer injection stage.