Sigma detection rules, expert-reviewed

Suspicious Windows Service ImagePath Pointing to AppData Directory

This rule detects creation or modification of a Windows service whose ImagePath references a user AppData directory. Legitimate services rarely execute from per-user AppData paths, so this pattern commonly indicates malware establishing persistence as a service. Reviewing such services helps surface service-based persistence.

Suspicious Daxin Backdoor Driver srt64.sys Loaded

This rule detects loading of a kernel driver named srt64.sys, associated with the Backdoor.Daxin espionage implant that hijacks legitimate network connections for covert command and control against hardened networks.

Malicious Impacket wmiexec Output Redirection via ADMIN Share

This rule detects the characteristic Impacket wmiexec command line that redirects command output to a temporary file on the local admin share over the loopback address as described in the WithSecure WMI lab. This redirection pattern is highly specific to semi interactive Impacket WMI execution and is a strong indicator of remote lateral movement by an attacker toolkit.

Suspicious Control Panel File Execution via control.exe with CPL Argument

This rule detects control.exe launching a Control Panel file, a proxy-execution technique observed in a martial-law-themed APT campaign where a disguised hwp.cpl was executed through control.exe to trigger CPlApplet and side-load a malicious DLL. It captures the abuse of the Control Panel host to run attacker code. Detecting this is important because control.exe invoking .cpl payloads outside settings interfaces is a recognized malware execution and DLL side-loading vector.

Suspicious Side-Loaded DLL Loaded by SSH Agent for Lazarus ServiceChanger

This rule detects the ssh-agent binary loading a libcrypto.dll from a non-standard path, a side-loading chain abused by the Lazarus ServiceChanger tool. The attackers convert ssh-agent into a persistent service and hijack its DLL dependency to run malicious code. A libcrypto.dll loaded by ssh-agent outside trusted install paths indicates side-loading.

Malicious Modification of a Fake Domain Controller SPN (DCshadow) - Directory Services (via security)

This rule detects update the Service Principal Name (SPN) of a computer account in order to perform "Kerberos redirection" and escalate privileges.

Suspicious Svchost Spawned by Non-Services Parent (via process_creation)

This rule detects svchost.exe launched by a parent other than the Windows Service Control Manager services.exe. Legitimate svchost instances are started by services.exe so any other parent suggests masquerading or code injected into a fake svchost. An anomalous svchost ancestry is a well-known indicator of process masquerading and injection.

Suspicious Shai-Hulud 2.0 Harvested Secret Dump File Creation

This rule detects creation of the secret dump files written by the Shai-Hulud 2.0 supply chain worm after it scans the host for cloud credentials and TruffleHog secrets during package install. These fixed filenames hold harvested AWS Azure and GCP credentials staged for exfiltration to attacker-controlled GitHub repositories.

Suspicious AutoIt Script Execution from User Writable Path via DarkGate (via process_creation)

This rule detects the AutoIt3 interpreter running a script from a user writable location such as AppData, Temp or ProgramData, matching DarkGate loader behavior that executes multiple AutoIt scripts staged after a JavaScript or LNK dropper. Some legitimate installers bundle AutoIt so parentage and path should be reviewed.

Suspicious Data Exfiltration to Elasticsearch Bulk API via ps_script

This rule detects PowerShell script content that posts data to an Elasticsearch bulk ingest endpoint targeting a systeminfo index. A threat actor abused an Elastic Cloud SIEM trial as exfiltration infrastructure by shipping collected host data to an attacker-controlled cluster via the _bulk API, so this pattern indicates outbound staging of stolen system information to a cloud index.

Suspicious Data Transfer via curl to Raw IP Address

This rule detects curl uploading or downloading files, the transfer mechanism this threat actor used to move a collection archive and tooling to and from attacker infrastructure. While curl has legitimate uses, its upload and download flags in interactive contexts frequently indicate ingress tool transfer or data exfiltration.

Suspicious Lancefly TdiProxy Driver Loaded

This rule detects loading of a kernel driver named TdiProxy.sys, installed as a service by Lancefly to intercept network traffic and support its Merdoor backdoor. This driver name is not associated with legitimate software.

Suspicious Foxit PDF Reader Spawning Command Interpreter

This rule detects Foxit PDF Reader spawning a command interpreter, the exploitation behavior triggered by a crafted PDF using OpenAction and Launch. Foxit should not normally launch cmd or PowerShell so this parent child pair signals abuse of the flawed design. Detecting it catches the initial code execution from the malicious document.

Malicious Safe Mode Boot Configuration via bcdedit for Defense Evasion via Process Creation

This rule detects bcdedit.exe forcing a minimal safe-mode boot, a technique the Embargo ransomware uses to restart the host into an environment where most security products do not run before encrypting files. Legitimate administrative use of this exact command is rare on endpoints. This indicates preparation for defense evasion and ransomware detonation.

Malicious LOLBin Download Saved as Windows Utility ping.exe via certutil or curl

This rule detects use of certutil or curl to download a remote file and save it under the name of a legitimate Windows utility such as ping.exe. The Mysterious Elephant APT used this masquerading technique to stage payloads disguised as trusted system binaries. Writing downloaded content to a well-known utility name in a non-System32 location is a strong indicator of ingress tool transfer combined with defense evasion.