Sigma detection rules, expert-reviewed

Suspicious Flax Typhoon System Utility Masquerade Outside System32 via Renamed VPN Client (via process_creation)

This rule detects processes named conhost.exe or dllhost.exe executing from a directory other than the Windows system folders. Flax Typhoon renamed the SoftEther VPN client to these trusted binary names to blend in while tunneling traffic over TCP 443 for covert remote access.

Suspicious dllhost.exe Spawned with CLSID and Anomalous Parent (via process_creation)

This rule detects dllhost.exe running with a GUID/CLSID on its command line while not being parented by svchost.exe. Medusa ransomware leverages a COM elevation moniker so that dllhost hosts a malicious auto-approved COM object, and the abnormal parent process reveals the UAC bypass rather than legitimate COM surrogate activity.

Malicious ms-settings DelegateExecute UAC Bypass Registry Change

This rule detects creation of the ms-settings Shell Open command key together with the DelegateExecute value which is the registry state used to bypass UAC through computerdefaults.exe. The Batavia spyware abuses this technique to elevate silently before stealing data from Russian organizations. Writes to this ms-settings hijack path are almost always malicious.

Malicious KB Document Masqueraded Executable Spawned by Script Interpreter via RoKRAT Loader (via process_creation)

This rule detects execution of an executable named to impersonate a Windows KB update document such as KB400928_doc.exe when launched by cmd.exe or powershell.exe, as seen in the APT37 ToyBox Story cmd to powershell to payload chain delivering RoKRAT. The KB prefix with a _doc.exe suffix masquerades the payload as a benign document while it runs as a program. Catching this masqueraded binary being spawned by a script interpreter exposes the final loader execution stage.

Malicious aspnet_compiler.exe Injection Host Spawned by PowerShell via process_creation

This rule detects the .NET build utility aspnet_compiler.exe being launched by PowerShell, the process-injection host abused by the multi-stage Phantom Stealer campaign to run reflectively loaded payload code. Spawning the signed compiler from a scripting engine is a wrong-context indicator that the stealer is hollowing a trusted binary to evade detection, exposing the injection before credential theft and SMTP exfiltration.

Suspicious Windows Subsystem for Linux (WSL) Package Turned on - Native (via setup)

This rule detects enables the WSL to cary out malicious activities in a virtual instance to avoid detection.

Malicious Akira Ransomware Encrypted File Extension via File Event

This rule detects files being renamed with the .akira extension appended during encryption by Akira ransomware. Mass creation of .akira files indicates active encryption of the host.

Suspicious Contagious Interview Disk Enumeration via Node Spawning Wmic

This rule detects a Node.js or npm process spawning wmic to enumerate logical disks which the North Korean Contagious Interview malware runs for host reconnaissance after a fake coding challenge executes. Developer-tooling parents launching WMI discovery is anomalous and marks the malicious interview package. It reveals early victim profiling before credential theft.

Malicious Regsvr32 Executing DLL From Windows Temp

This rule detects regsvr32.exe registering or executing a DLL located in the Windows Temp directory which the ALPHV intrusion used after a VBS dropper wrote a payload there and this matters because regsvr32 loading a DLL from Temp is a common proxy execution and squiblydoo style evasion pattern that legitimate software does not exhibit.

Suspicious Process Memory Read from Proc Mem for Secret Extraction

This rule detects a command that reads another process memory through the proc mem pseudo-file, a technique malicious npm packages use to scrape OIDC tokens and other in-memory secrets from CI runners. This vector appears in the npm supply chain attacks tracked by Unit 42. Detecting direct proc mem reads exposes runtime credential theft that never touches disk.

Masquerading Exchange Server Impersonation via PrivExchange Relay Attack (via security)

This rule detects relays Exchange server authentication to abuse Exchange servers permissions and escalate privileges.

Suspicious Inline node.exe Command Executing Network and Process Spawning Code

This rule detects node.exe invoked with inline evaluated code that references network, command execution, and filesystem modules such as http, execSync, spawn, fs, and zlib. Microsoft attributed this pattern to Node.js malware that downloads and runs additional payloads directly from the command line. Inline module chaining lets the attacker fetch and execute code without dropping a script file, making it a strong indicator of malicious activity.

Malicious Remote Shell Execution via SMB Admin Share (via security)

This rule detects execute a remote shell via the admin share.

Suspicious DUser DLL Sideloading by credwiz via Image Load

This rule detects the Credential Wizard binary or its renamed variants loading DUser.dll from outside the System32 directory, the DLL side-loading technique Secret Blizzard used to launch its TwoDash and related backdoors. A signed host binary loading a same-named DLL from a non-system path is a hallmark of side-loading based execution.

Suspicious Denied RDP Login with Valid Credentials (via security)

This rule detects tries to move laterally using RDP and access attempt is blocked due to restricted logon policies.