Sigma detection rules, expert-reviewed

Malicious WSUS Service Spawning Command Shell via CVE-2025-59287 (via process_creation)

This rule detects the WSUS service or its worker process spawning a command interpreter, the immediate post-exploitation behavior of CVE-2025-59287 remote code execution. WSUS components should never launch cmd or PowerShell, so this chain marks active exploitation. Detecting it exposes attacker command execution on a patch-management server used as an entry point.

Suspicious Chrome Launch With Remote Debugging via Airstalk (via process_creation)

This rule detects a Chromium-based browser started with the remote debugging port flag, a technique the Airstalk malware uses to hijack browser sessions and steal cookies and tokens. Enabling the debugging protocol lets the malware drive the browser and read authenticated state. Detecting this launch surfaces credential and session theft in a suspected supply chain intrusion.

Suspicious PowerShell Spawned by WScript via PhantomVAI Loader (via process_creation)

This rule detects PowerShell executed as a child of WScript, an early link in the PhantomVAI loader chain that proceeds through msedge and MSBuild to injection. Script-host to PowerShell transitions are a common malware execution handoff. Detecting this chain catches the loader before the final infostealer injection stage.

Suspicious MSBuild Execution Spawned by PowerShell via PhantomVAI Loader (via process_creation)

This rule detects MSBuild launched as a child of PowerShell, the final stage of the PhantomVAI loader chain that injects infostealer code into the trusted Microsoft build utility. MSBuild is abused as a signed process host to evade defenses. Detecting this parent-child relationship exposes process injection delivering commodity infostealers.

Suspicious ClickFix cv.bat Staging in Temp via PowerShell (via process_creation)

This rule detects PowerShell referencing the cv.bat helper script staged in a temporary directory, an intermediate step in the ClickFix delivery chain that subsequently retrieves an MSI-packaged DeerStealer payload. The batch file bridges the initial pasted command and the final installer. Detecting this staging step interrupts the infostealer infection before installation completes.

Suspicious PowerShell Download Spawned From Explorer via ClickFix (via process_creation)

This rule detects PowerShell launched directly by Explorer with download cmdlets, matching the ClickFix social engineering technique where a victim pastes a malicious command into the Windows Run dialog. The IUAM ClickFix Generator produces lures that trick users into self-executing payload downloaders. Detecting this pattern catches the delivery of DeerStealer and similar infostealers at execution.

Suspicious Phantom Taurus mssq.bat SQL Execution via WMI (via process_creation)

This rule detects execution of the mssq.bat script used by Phantom Taurus to run SQL queries against databases via the privileged sa account, invoked through WMI. The batch file automates data collection and command execution against Microsoft SQL Server. Detecting this named script exposes hands-on-keyboard database targeting by the actor.

Suspicious Script Host Downloader via MSXML and WScript Shell

This rule detects the Windows script host executing a WSF or JS downloader that then spawns PowerShell. The DarkCloud delivery uses MSXML2.XMLHTTP and WScript.Shell inside a script file to fetch a PowerShell stage from remote infrastructure. Script host to PowerShell chaining is a common malware download and execute pattern.

Malicious SharePoint w3wp Spawning Command Shell and PowerShell

This rule detects the SharePoint IIS worker process w3wp.exe spawning cmd.exe or powershell.exe. Exploitation of the ToolShell SharePoint vulnerabilities results in the web worker launching shells to run base64 encoded commands. A web server process parenting an interactive shell strongly indicates webshell or exploitation activity.

Malicious Service Persistence via sc.exe Creating msdnetsvc

This rule detects sc.exe creating a Windows service named msdnetsvc. This service name is used by the backdoor targeting Southeast Asian governments to gain persistence and survive reboots. A named service with this masquerading identity is a high-confidence indicator of the intrusion.

Suspicious extrac32 CAB Extraction Abuse

This rule detects the extrac32 LOLBin extracting cabinet contents using the /Y overwrite and /E extract-all switches. In the observed ClickFix chain extrac32 is abused to unpack a staged payload such as Boat.pst. This living-off-the-land extraction step helps adversaries deploy secondary tooling while avoiding dedicated archive utilities.

Suspicious curl Spawning Script Host for Latrodectus Delivery

This rule detects curl.exe spawning the Windows script host to run JScript or VBScript. The ClickFix to Latrodectus infection chain uses curl to fetch a JavaScript payload which is then executed via cscript. Download utility parenting a script interpreter is highly abnormal on endpoints and marks a malware staging step.

Suspicious PowerShell Execution via Forfiles LOLBIN

This rule detects the forfiles utility used to spawn PowerShell, an indirect execution technique that breaks parent-child telemetry. Malicious LNK campaigns use forfiles to proxy execution of PowerShell payloads. Interactive use of forfiles to launch PowerShell is uncommon and suspicious.

Suspicious Encoded PowerShell Command Execution

This rule detects PowerShell invoked with an encoded-command switch, which conceals the executed script from casual inspection. Malicious LNK files analyzed by Unit 42 launch cmd to run PowerShell with EncodedCommand payloads. Base64-encoded PowerShell is a common obfuscation and execution technique that merits review.

Suspicious Chisel SOCKS Tunnel Command Line

This rule detects command lines invoking the Chisel tunneling tool in client mode with SOCKS proxying. In the Africa financial-sector intrusions Chisel established SOCKS tunnels for covert remote access and lateral movement. This command-line pattern reveals tunneling regardless of the binary name.