Sigma detection rules, expert-reviewed

Suspicious AutoIt3 Compiled Script Execution via A3X File

This rule detects AutoIt3.exe executing a compiled .a3x script, a technique used by CastleLoader to run obfuscated AutoIt payloads dropped by an Inno Setup installer. Compiled AutoIt scripts are commonly abused by loaders to stage further code injection.

Suspicious Masquerading Python Interpreter csshost Executing Script

This rule detects a renamed Python interpreter named csshost.exe executing a Python script, a masquerading technique used by PyLangGhost RAT to hide its stealer logic behind a system-looking process name. The legitimate Python binary is copied and renamed to blend in.

Suspicious Interlock Fake Updater Executable Execution

This rule detects execution of Interlock loader binaries named with the upd_ prefix, dropped by fake browser and Teams updater phishing pages. This naming convention is used by Interlock to disguise its payloads as software updates.

Suspicious Hidden PowerShell Executing Substring of Dropped File

This rule detects a hidden PowerShell process that reads a dropped file with Get-Content, extracts a substring, and invokes it as code, matching the AZORult fileless loader stage. Reading an oddly named data file and executing a slice of it is characteristic of obfuscated PowerShell stagers.

Malicious PureMiner Persistence Executable in AppData HResult Folder

This rule detects execution of TypeId.exe from an AppData Roaming HResult directory, the persistence location used by PureMiner to launch its XMRig-based cryptominer at startup. This path and filename combination is specific to the Pure malware family.

Suspicious Outbound Connection From CasPol Binary

This rule detects the .NET CasPol.exe binary establishing outbound network connections, behavior consistent with the XWorm LATAM campaign hollowing CasPol to beacon to its C2. CasPol has no legitimate need for network communication.

Suspicious shfolder.dll Sideloading via VMware net-service Binary

This rule detects the VMware net-service.exe binary loading shfolder.dll from outside the System directory, the DLL search-order hijack abused by Gh0stBins RAT to run its loader. Legitimate shfolder.dll is loaded from System32, so a load from the application folder indicates sideloading.

Malicious Interlock Credential Stealer Output File

This rule detects creation of chrgetpdsi.txt, the file used by the Interlock ransomware credential stealer to store harvested browser credentials. This filename is a unique host-based indicator of Interlock stealer activity.

Suspicious WDigest UseLogonCredential Enablement for Plaintext Credential Theft (via registry_set)

This rule detects setting the WDigest UseLogonCredential value which forces Windows to cache plaintext credentials in memory as observed in the SoftEther VPN intrusion. Enabling this value is a credential access preparation step ahead of memory dumping.

Suspicious PebbleDash C2 Configuration Stored Under WMI Security Key (via registry_set)

This rule detects writes to the HKLM SYSTEM CurrentControlSet Control WMI Security value with the GUID used by the Kimsuky PebbleDash backdoor to store its encrypted command and control address. This registry location is not normally written by user applications.

Malicious Invoke-WMIExec Lateral Movement Download and Execute (via ps_script)

This rule detects a PowerShell one liner that downloads Invoke-WMIExec via a web client and executes it against a remote target using a pass the hash argument as observed in the MeshAgent and SuperShell intrusion. This chains in memory script download with WMI based lateral movement.

Suspicious Certutil UrlCache Download of Remote CAB Payload (via process_creation)

This rule detects certutil.exe using the urlcache and split options to download a remote CAB file into ProgramData as used by the Larva-26010 SoftEther VPN intrusion to stage tooling. This certutil pattern is a well known living off the land download technique.

Malicious Xctdoor XcLoader Execution via Regsvr32 AppX Path Abuse (via process_creation)

This rule detects regsvr32.exe loading a DLL named settings.lock from the Microsoft MicrosoftOffice365Hub AppX package settings directory. This loader technique is used by the Xctdoor and XcLoader backdoors to execute encrypted payloads from a user AppX path where legitimate COM registration is not expected.

Suspicious Hidden Backdoor Account Creation Ending With Dollar Sign (via process_creation)

This rule detects creation of hidden local accounts whose names end with a dollar sign such as mssql or adminweb1 as used by the MS-SQL intruder for stealthy persistence. Accounts ending in a dollar sign are hidden from the standard net user listing.

Malicious Potato Family Privilege Escalation Tool Execution (via process_creation)

This rule detects execution of Potato family token impersonation tools including JuicyPotatoNG, RasManPotato, SigmaPotato, BadPotato, and RustPotato used for local privilege escalation in the MS-SQL intrusion. These utilities abuse SeImpersonate privileges to elevate to SYSTEM.