Sigma detection rules, expert-reviewed

Suspicious Inline node.exe Command Executing Network and Process Spawning Code

This rule detects node.exe invoked with inline evaluated code that references network, command execution, and filesystem modules such as http, execSync, spawn, fs, and zlib. Microsoft attributed this pattern to Node.js malware that downloads and runs additional payloads directly from the command line. Inline module chaining lets the attacker fetch and execute code without dropping a script file, making it a strong indicator of malicious activity.

Malicious Remote Shell Execution via SMB Admin Share (via security)

This rule detects execute a remote shell via the admin share.

Suspicious DUser DLL Sideloading by credwiz via Image Load

This rule detects the Credential Wizard binary or its renamed variants loading DUser.dll from outside the System32 directory, the DLL side-loading technique Secret Blizzard used to launch its TwoDash and related backdoors. A signed host binary loading a same-named DLL from a non-system path is a hallmark of side-loading based execution.

Suspicious Denied RDP Login with Valid Credentials (via security)

This rule detects tries to move laterally using RDP and access attempt is blocked due to restricted logon policies.

Malicious BitLocker Abuse for Ransomware via PowerShell (via ps_script)

This rule detects PowerShell that enables BitLocker while removing the key protectors which the ShrinkLocker ransomware does to encrypt drives and lock out the legitimate owner without leaving a recovery key.

Malicious WinGUP Updater Sideloading libcurl via gup.exe (via image_load)

This rule detects the WinGUP updater gup.exe loading a libcurl.dll from outside its normal install directories. The BoryptGrab-lineage infostealer distributed through fake GitHub repositories abused this signed updater to sideload its malicious loader DLL from user-writable paths.

Suspicious Masqueraded Windows Update Python Script Execution

This rule detects the Python interpreter executing a script masquerading as a Windows update named Windows Update Script.pyw, as dropped by the DeceptiveDevelopment ClickFix chain alongside drvUpdate.exe. The naming disguises attacker code as a benign system task, so catching the interpreter launching this file exposes the initial foothold.

Suspicious GoGRPC Screen Capture Log File Creation (via file_event)

This rule detects creation of the appscreen.log artifact under the ProgramData appscreen directory that the GoGRPC backdoor writes while capturing screen data. This specific path and filename combination is unique to the malware.

Malicious Defender Exclusion Added via Add-MpPreference During Medusa Intrusion (via process_creation)

This rule detects PowerShell adding a Microsoft Defender path exclusion via Add-MpPreference, a defense-evasion step Storm-1175 uses to carve out an excluded location such as the C drive root before staging tools during Medusa ransomware operations. Adversaries blind Defender in this way to run payloads without detection, so an exclusion added from the command line ahead of impact is a high-confidence sign of an active intrusion.

Suspicious Storm-2561 Fake Pulse VPN Persistence via RunOnce Key (via registry_set)

This rule detects a RunOnce registry value configured to launch Pulse.exe, the persistence mechanism used by Storm-2561 after SEO-poisoned downloads deliver a fake Pulse Secure VPN installer. Adversaries use this autorun entry to relaunch the credential-stealing loader, so a RunOnce value pointing at Pulse.exe outside a genuine Pulse Secure deployment indicates the fake VPN foothold.

Malicious Microsoft Defender Tamper via Registry Modification

This rule detects registry modifications that disable Microsoft Defender protections under the Windows Defender policy keys. Attackers set DisableAntiSpyware or DisableRealtimeMonitoring to switch off protection persistently, a registry-based evasion technique covered in Sekoia detection engineering.

Malicious WeaXor Ransomware Encryption Artifacts on Disk (via file_event)

This rule detects file system artifacts left by WeaXor ransomware, namely files renamed with the wex extension and the dropped RECOVERY INFO note. It indicates active encryption on the host.

Suspicious DotNet Utility Spawned by Script Host for Hollowing (via process_creation)

This rule detects RegAsm, MSBuild, or AddInProcess32 launched by a script host or mshta. This layered loader spawns these signed .NET utilities as process hollowing targets for its final payload.

Malicious Windows Defender Exclusion for Windows Dell Folder

This rule detects Add-MpPreference adding a Defender exclusion path for a Dell folder under the Windows directory, a Prometei defense-evasion step. The botnet staged modules such as its Mimikatz variant in C:\Windows\Dell and excluded that path from Defender scanning. A Defender exclusion for a non-standard folder inside the Windows directory strongly indicates malware hiding its working directory.

Malicious RDP Session Hijacking via tscon Command Line

This rule detects execution of the native tscon.exe binary with a destination session and an rdp-tcp or console source argument, the living-off-the-land technique used to hijack another user's Remote Desktop session without their credentials. Adversaries with SYSTEM privileges connect an existing session to their own to inherit the victim's access for lateral movement and privilege escalation. Interactive tscon usage targeting another session is rarely legitimate.