Sigma detection rules, expert-reviewed

Suspicious Microsoft Defender Path Exclusion of User Directories (via process_creation)

This rule detects Add-MpPreference adding a Microsoft Defender exclusion path for the AppData Roaming, AppData Local or ProgramData directories. GPUGate and similar malware families exclude these user-writable staging locations before dropping payloads.

Suspicious RustDesk Remote Access Service Installation via sc (via process_creation)

This rule detects creation of a Windows service that launches RustDesk with an imported configuration. Akira ransomware operators installed RustDesk as an auto-start service using sc create to maintain unattended remote access to compromised hosts.

Malicious Windows Defender Tampering via Set-MpPreference (via process_creation)

This rule detects PowerShell disabling multiple Microsoft Defender protection features in a single Set-MpPreference invocation. Akira ransomware operators ran this command to disable real-time, behavior, script and archive scanning before deploying tooling and the encryptor.

Malicious Non-Interactive Encoded PowerShell Stager (via process_creation)

This rule detects a non-interactive PowerShell process launched with an encoded command from a command shell. This staging pattern was observed during exploitation of Cleo managed file transfer software to decode and run the next-stage payload for the Cleopatra backdoor.

Malicious Service Creation Pointing to Public Data File via sc (via process_creation)

This rule detects creation of a Windows service whose binary path points to a .dat file staged under the Users Public directory. Operators exploiting ActiveMQ created a service named windowDefenSrv referencing a public payload file to gain persistence.

Malicious Remote MSI Execution with Image Extension via msiexec (via process_creation)

This rule detects msiexec silently installing an MSI package fetched from a remote HTTP URL where the payload uses an image file extension. Operators exploiting CVE-2023-46604 delivered ransomware as MSI files named with a .png extension via msiexec quiet install.

Malicious ActiveMQ Exploitation Java Spawning PowerShell Downloader (via process_creation)

This rule detects an ActiveMQ Java process spawning PowerShell that downloads a remote payload. Exploitation of CVE-2023-46604 caused the ActiveMQ java process to launch PowerShell IEX and DownloadFile commands to stage ransomware.

Suspicious BoryptGrab Infostealer Staging Directory (via file_event)

This rule detects creation of files within the Filegraber or decrypt_browser staging directories. The BoryptGrab-lineage infostealer wrote harvested browser data and logs to these folders, retaining the misspelled Filegraber directory name.

Malicious NTDS Database Staging to Audit Directory (via file_event)

This rule detects creation of an ntds.dit Active Directory database copy under a C drive audit Active Directory path. During the Anubis ransomware intrusion the operators exfiltrated domain credentials by copying the NTDS database into an audit directory and archiving it, an activity that does not occur during normal operations.

Suspicious Cleo Autorun Health Check File Drop (via file_event)

This rule detects creation of healthcheck.txt or healthchecktemplate.txt files inside a Cleo autorun directory. Operators exploited the Cleo autorun feature by writing these files to trigger execution of an embedded PowerShell stager.

Malicious Gh0stBins RAT Registry Marker HHClient

This rule detects creation of the HKCU SOFTWARE HHClient registry key, a host-based marker written by the Gh0stBins Chinese RAT to record its infection date. This key is not associated with any legitimate software.

Suspicious PowerShell Spawned by VBScript for RMM Delivery

This rule detects wscript.exe spawning a PowerShell process that skips the user profile, the delivery chain of the 46-country RMM phishing campaign that fetches and installs remote-access tools. A script-host parent driving profile-skipping PowerShell is characteristic of malicious RMM deployment.

Suspicious Banana RAT UAC Skip Environment Variable in PowerShell

This rule detects the MSEDGE_SKIP_UAC environment variable being set within a PowerShell command line, a marker used by Banana RAT during staging to bypass user prompts. This variable is not used by legitimate Microsoft Edge update processes.

Suspicious PowerShell Loading Fake Edge Update Script

This rule detects a PowerShell process that reads and invokes a msedgeupdate.txt payload, the staging technique used by Banana RAT to masquerade as a Microsoft Edge updater. Loading a text file from disk through PowerShell is a strong loader indicator when tied to this filename.

Suspicious JScript.NET Compiler Spawned by AutoIt for Process Hollowing

This rule detects jsc.exe being launched by AutoIt3.exe, a chain used by CastleLoader to create a suspended JScript.NET compiler process that is later hollowed with an injected PE. A jsc.exe process spawned from AutoIt3 is highly unusual in benign environments.