Sigma detection rules, expert-reviewed

Suspicious Child Process Spawned by WMI Provider Host (via process_creation)

This rule detects the WMI Provider Host (WmiPrvSE.exe) spawning a command shell or script interpreter, an execution pattern that indicates local or remote code execution through Windows Management Instrumentation. WMI is a top execution and lateral-movement technique in the Red Canary Threat Detection Report because it runs under a trusted service and leaves little on disk. Detecting interpreter children of WmiPrvSE surfaces WMI-based hands-on activity.

Malicious Rundll32 DllRegisterServer Execution From a User-Writable Path (via process_creation)

This rule detects rundll32.exe invoking the generic DllRegisterServer export on a DLL located in a user-writable directory such as AppData, Temp or ProgramData, a proxy-execution pattern used to run attacker DLLs under a trusted binary and bypass application controls. Rundll32 abuse is a top System Binary Proxy Execution technique in the Red Canary Threat Detection Report. Detecting DllRegisterServer calls against non-system DLL paths surfaces the evasion.

PowerShell Encoded or Download-Cradle Command Line (via process_creation)

This rule detects PowerShell launched with an encoded command or an in-memory download-and-execute cradle on its command line, such as base64-encoded payloads or remote content pulled through Net.WebClient and piped into Invoke-Expression. PowerShell abuse is the single most prevalent technique in the Red Canary Threat Detection Report, used to stage and run payloads while evading disk-based controls. Flagging these command-line patterns catches the execution stage before follow-on activity.

Suspicious Trojanized ScreenConnect Client Installer with Guest Relay Parameters (via process_creation)

This rule detects the ScreenConnect client setup executed with the guest session and relay host parameters used by trojanized installers that drop AsyncRAT and PureHVNC on a single machine. Adversaries embed the e Support y Guest and h relay-host arguments so the agent silently connects to attacker infrastructure. The parameter combination distinguishes weaponized installers from legitimate deployments.

PATCHCORD SHEETCORD Startup Folder VBScript Persistence (via file_event)

This rule detects the SHEETCORD backdoor dropping SystemHelper.vbs into the user Startup folder to gain logon persistence during the PATCHCORD campaign against Afghan telecom targets. Adversaries place a VBScript launcher in the Startup directory so wscript executes their implant at every logon. Detecting the drop exposes persistence before the Google Sheets tasking channel activates.

Nullsoft Scriptable Installer Script (NSIS) execution

Detects the loading of the NSIS System plugin library, indicative of an NSIS script execution.

Malicious Kimsuky Remote HTA Execution via URL Shortener (via process_creation)

This rule detects mshta.exe launching a remote payload through a Korean URL shortener domain, the delivery behavior of the Kimsuky KimJongRAT campaign that hides its staging server behind link24 and buly redirects. Adversaries leverage mshta as a trusted scripting host to fetch and run remote HTA content while evading download controls, making early detection critical for catching execution at the initial access stage.

Possible DNS Queries to Public Ethereum RPC Endpoints for EtherHiding Payload Retrieval (via dns_query)

This rule detects DNS resolution of public Ethereum RPC provider domains queried by EtherRAT to read its command and control configuration from a smart contract using the EtherHiding technique. Adversaries leverage blockchain RPC endpoints as a resilient dead drop that resists takedown while blending with legitimate crypto traffic, making this a heuristic signal worth reviewing on hosts with no expected blockchain activity.

Masquerading Kimsuky Scheduled Task Persistence Executing VBE via Wscript (via process_creation)

This rule detects creation of a scheduled task that repeatedly launches wscript.exe against a VBScript encoded file, the persistence behavior used by a Kimsuky campaign to keep its bot.vbe beacon running at short intervals. Adversaries leverage the Task Scheduler to survive reboots and maintain access while masquerading as a browser update task, making early detection critical for surfacing persistence before further payload deployment.

Masquerading sLoad Ramnit Loader Execution via PowerShell Running a Masqueraded Log Script (via process_creation)

This rule detects PowerShell launching with an execution-policy bypass to run a script masqueraded as a .log file, the loader behavior used by the sLoad downloader to execute the encrypted Ramnit payload in the drIBAN banking-fraud operation. Adversaries rename PowerShell scripts to log extensions so the interpreter runs untrusted code while evading extension-based controls, making early detection critical for catching the loader before Ramnit injection.

Malicious Browser Master Key Decryption Artifacts Written by Katz Stealer (via file_event)

This rule detects creation of the decrypted browser master-key text files written by Katz Stealer after it extracts and decrypts Chrome, Edge, and Brave application-bound encryption keys. Adversaries leverage these staged key files to decrypt saved credentials and cookies offline, making detection valuable for catching browser credential theft in progress.

Renamed DLL Sideloading of TOTPGuard via Renamed Setup Binary in Nimbus Manticore Chain (via image_load)

This rule detects a setup.exe process loading TOTPGuard.dll, the AppDomain-hijacking DLL sideloading pair used by Nimbus Manticore to run a decrypted native implant from a renamed Microsoft Visual Studio host binary. Adversaries leverage sideloading through a signed executable to execute malicious code under a trusted process, making early detection critical for surfacing the infection chain before beacon establishment.

In-Memory Matanbuchus Loader DLL Sideloading via Notepad++ GenericUpdater Loading libcurl (via image_load)

This rule detects the legitimate Notepad++ GUP updater GenericUpdater.exe loading libcurl.dll from a user-writable location, the DLL sideloading behavior used by the Matanbuchus 3.0 loader after delivery through a fake Notepad++ update. Adversaries leverage sideloading against a signed updater to execute the loader under a trusted process while evading process-based detection, making early detection critical for stopping the chain before regsvr32 persistence and process hollowing deploy.

Masquerading Certificate Services Outbound LDAP or SMB Connection via Certighost Coercion (via network_connection)

This rule detects the Certificate Services process certsrv.exe initiating outbound connections to LDAP or SMB destination ports, the coerced-authentication behavior abused in the Certighost CVE-2026-54121 attack chain to force a Certificate Authority to authenticate against attacker-controlled infrastructure. Adversaries leverage this to relay CA credentials and impersonate Domain Controllers, making early detection critical for stopping certificate-based domain takeover.

PowerShell Spawned by SharePoint Worker Process After ToolShell Exploitation (via process_creation)

This rule detects the SharePoint worker process w3wp.exe spawning PowerShell, the post-exploitation execution pattern seen after ToolShell CVE-2025-53770 web shell deployment where decoded payloads are written to disk. Adversaries leverage the worker process to run commands under IIS context, making early detection critical for catching hands-on-keyboard activity following server compromise.