Sigma detection rules, expert-reviewed

Suspicious IIS Logging Disabled via appcmd

This rule detects appcmd.exe being used to disable IIS request logging with the dontLog setting, matching defense-evasion activity in the Defence Impairment intrusion. Adversaries turn off IIS logging to hide webshell and web-based command execution from server logs. Disabling logging on a web server is a strong anti-forensic signal.

Suspicious Rundll32 Loading DLL from LocalAppData with Short Export (via process_creation)

This rule detects rundll32.exe invoking a DLL staged in the user LocalAppData directory with a single character export ordinal, the loader behavior of the KimJongRAT sys.dll module that Kimsuky drops into the user profile. Adversaries leverage rundll32 as a signed proxy to execute their DLL under a trusted process, making early detection critical for surfacing loader activity before browser and credential theft.

Suspicious type Command Piping Encoded Log to Renamed git Binary (via process_creation)

This rule detects a command line that pipes the contents of glog.txt via the type command into the renamed git binary, the staging technique used by APT-C-60 to feed an encoded payload to its execution proxy. Reading a benign-looking log file and piping it into a proxied binary conceals the true payload source.

Suspicious Run Key Masquerading as GoogleUpdate From Wrong Path via Registry Set (via registry_set)

This rule detects a Run key autostart entry masquerading as GoogleUpdate but pointing to a payload outside the legitimate Google update directory, a persistence and masquerading technique used by malware from MSIX installers per Red Canary. A trusted-looking name paired with the wrong file path is a high-confidence indicator of a malicious autorun disguised as software updater.

PowerShell Remote Download From Bunny CDN Host

This rule detects PowerShell download activity referencing a b-cdn.net Bunny CDN host, an abused delivery infrastructure in the LummaStealer campaign. Attackers stage payloads on legitimate CDN domains to blend malicious downloads with normal traffic.

Suspicious Lateral Movement Detection - Based on "special Groups" Feature (via security)

This rule detects scenarios where a user of a predefined set of group(s) logs on a target machine.

Malicious IFEO Debugger Hijack of vds.exe by FishMonger

This rule detects registration of an Image File Execution Options Debugger value for vds.exe, a persistence and defense-evasion technique used by the FishMonger group deploying SprySOCKS. The activity abuses the IFEO mechanism so that a malicious binary is launched whenever the Virtual Disk Service is invoked. Detecting this key is important because it silently redirects execution of a legitimate system component to attacker-controlled code.

Suspicious Stately Taurus Visual Studio Code Tunnel Abuse via VSCode CLI (via process_creation)

This rule detects execution of the Visual Studio Code command line binary with the tunnel argument, which creates a remote-access tunnel back to a VSCode account. The Stately Taurus espionage group abused this feature to obtain interactive reverse-shell access to government hosts in Southeast Asia while blending in with legitimate developer traffic. Abuse of a trusted developer tool for command and control lets the actor evade network controls and persist covertly.

Possible Ngrok RDP Tunnel Exposure via TCP 3389

This rule detects command lines that tunnel TCP port 3389 which exposes internal Remote Desktop Protocol to the internet. The BlackJack group used ngrok tcp 3389 to reach RDP on compromised hosts, and such tunneling enables covert lateral movement and remote interactive access.

Malicious Vulnerable Driver HwRwDrv Loaded for BYOVD

This rule detects loading of the HwRwDrv vulnerable driver, a bring-your-own-vulnerable-driver component observed in a Huntress-tracked Tiflux RMM malspam campaign to gain privileged kernel access. Attackers load this signed but vulnerable driver to tamper with protected processes and security tooling. Presence of this driver name is a strong indicator of BYOVD privilege escalation.

Suspicious HDUtil Loader Execution with NoUac Arguments via process_creation

This rule detects the OkoBot HDUtil.exe loader running with its distinctive nouac and noattach arguments to launch further payloads. These custom flags are specific to the OkoBot framework targeting cryptocurrency wallet users. The unusual argument set is a reliable execution fingerprint for the loader.

Suspicious PerfWatson2 Execution from Local AppData

This rule detects a process named PerfWatson2.exe running from a user LocalAppData directory, where the genuine Visual Studio telemetry helper never lives. CL-STA-1062 stages a masqueraded PerfWatson2.exe in LOCALAPPDATA as part of its backdoor toolset. Flagging the trusted name in this unexpected location reveals an implant impersonating a developer utility.

Suspicious Event Log Clearing via wevtutil During Ransomware Activity

This rule detects wevtutil clearing Windows event logs which ransomware operators perform to destroy evidence of intrusion and lateral movement. Clearing logs immediately before or after encryption impairs incident response and timeline reconstruction.

Malicious Scheduled Task Masquerading as Auto Update via schtasks (via process_creation)

This rule detects creation of a scheduled task named Auto apdate that launches Trays.exe at logon with highest privileges, the persistence mechanism used in the AnyDesk phishing campaign targeting Russian aerospace firms. The misspelled update-themed task name masquerades as a benign auto-updater to hide malicious auto-start, so catching the task registration exposes the persistence before the tool executes.

Malicious Brutforce on Windows OpenSSH Server with Valid Users (via security)

This rule detects sSH brutforce a Windows OpenSSH server with a valid user.