Sigma detection rules, expert-reviewed

Malicious Word Spawning Rundll32 Loading DLL from Roaming Word Folder

This rule detects winword.exe launching rundll32.exe to load a DLL staged under the AppData Roaming Microsoft Word directory which is the Hancitor maldoc execution chain preceding Cuba ransomware. The malicious macro drops and side loads the loader from a user writable path. It is important because this parent child pattern reliably marks initial Hancitor infection.

Suspicious Service DLL Persistence Under Masquerading Service Names

This rule detects a ServiceDll value being set under the COMSysConfig or StorSyncSvc service keys which the ColunmTK APT41 cluster registers to load a malicious DLL through a svchost hosted service. The names impersonate legitimate Windows components to blend in. It is important because ServiceDll hijacking grants stealthy SYSTEM level persistence.

Suspicious PowerShell Invoke-WebRequest Download of Executable Payload

This rule detects PowerShell using Invoke-WebRequest to download an executable payload to disk. UAT-6382 used this technique after web-shell access to pull additional tooling from staging infrastructure over a non-standard port, a common ingress-tool-transfer step preceding beacon deployment.

Suspicious Kernel Service Creation for BYOVD Driver Loading (Qilin)

This rule detects creation of a kernel-type Windows service via sc create with a kernel service type, used by the Qilin group to load a vulnerable driver for bring-your-own-vulnerable-driver attacks. Loading a kernel driver through a newly created service enables disabling security products from kernel space. Unexpected kernel service creation is a strong defense-evasion signal.

Malicious PlugX Run Key Persistence via AvastSvcpCP Path

This rule detects a Run key value pointing at the AvastSvcpCP directory under the user profile used by the PlugX USB worm for persistence. PlugX copies its sideloading set into this folder and registers it for autostart, masquerading as Avast to survive reboots.

Malicious Cactus Ransomware Ransom Note Creation (via file_event)

This rule detects creation of Cactus ransomware ransom notes, which embed the fixed C.A.c_T.U-S-R.e-a_D.m-e marker between randomized prefixes and postfixes in the note filename. Adversaries leverage mass note deployment during the encryption stage, making detection of this distinctive embedded string a reliable late-stage indicator of a Cactus impact event.

Suspicious Scheduled Task Masquerading as MicrosoftEdgeUpdate with Minute Interval (via process_creation)

This rule detects creation of a scheduled task that impersonates the Microsoft Edge updater while triggering on a very short minute-based interval. The AsyncRAT phishing campaign registers a task named MicrosoftEdgeUpdate500 that runs every two minutes for persistence. Legitimate updaters do not run on such aggressive schedules, so this pairing of a trusted name with an abnormal trigger reveals the persistence mechanism.

Suspicious Scheduled Task Launching svczHost Masquerading Binary via schtasks

This rule detects schtasks creating a task that runs svczHost.exe, a masquerading binary imitating the legitimate svchost service name used for persistence in the Ducktail campaign. Attackers pick a lookalike host name so the scheduled task and running process blend into normal system activity.

AteraAgent malicious installations

Detects potentially malicious AteraAgent installations when the IntegratorLogin parameter is used to register a non-business email.

Malicious svchost Masquerading Binary scvhost Executed from Common Files

This rule detects execution of scvhost.exe, a typosquatted masquerade of the legitimate svchost.exe, deployed as a fake SQLlite service under Program Files Common Files by the Nezha threat actor. The misspelled name and non-system path reveal a persistence and masquerading attempt. Genuine svchost only runs from System32, so any scvhost binary is malicious.

Suspicious Service Creation for APT41 Loader via sc create (via process_creation)

This rule detects creation of a Windows service named server power via sc.exe as seen in the APT41 Africa campaign. The group used this service to gain SYSTEM level persistence for a sideloaded payload. A service with this whitespace-separated cover name combined with sc create points to hands-on-keyboard persistence rather than legitimate software installation.

Malicious Exchange or SharePoint Worker Process Spawning Command Shell from Web Shell (via process_creation)

This rule detects the IIS worker process w3wp.exe spawning command shells or the net utility on on-premises Exchange or SharePoint servers, the web-shell execution behavior these attacks use after deploying pages such as getidtoken.aspx or signout.aspx. Adversaries drop web shells into OWA auth and LAYOUTS directories to run commands in the server context, so command interpreters descending from w3wp indicate server-side compromise.

Suspicious Service Creation With Auto Start via process_creation

This rule detects use of sc.exe to create a new auto-start service which is a common persistence mechanism for miners and loaders. SilentCryptoMiner registered a service named to mimic the Windows Image Acquisition driver with an automatic start binary path. Alerting on service creation from sc.exe surfaces persistence attempts that survive reboots.

Suspicious Minimized Command Shell Launching Decoy PDF (via process_creation)

This rule detects a command shell started in a minimized window that echoes and opens a decoy NotaFiscal PDF which the CarnavalHeist banking trojan LNK uses to distract the victim while it stages its loader. Minimized window execution with an invoice-themed decoy is a social engineering and defense evasion pattern in Brazilian banking malware.

Malicious BLOODALCHEMY DLL Side-Loading via BrDifxapi Executable

This rule detects DLL side-loading where the BrDifxapi executable loads a BrLogAPI DLL which is the loading chain the BLOODALCHEMY backdoor abuses to execute its payload. Pairing this specific host binary with this specific module name reflects a known malicious side-loading combination rather than legitimate Brother software behavior.