Sigma detection rules, expert-reviewed

BitLocker Feature Configuration - Reg via Command (via process_creation)

This rule detects configures BitLocker for ransomware purposes.

Suspicious File Upload via curl Multipart Form

This rule detects curl.exe uploading a local file using a multipart form field. In the Notepad++ supply chain attack the operators used curl with a form file argument to exfiltrate collected reconnaissance output as reported by Kaspersky. Command line file upload via curl can indicate staged data exfiltration although some administrative scripts also use this pattern.

Malicious Bring-Your-Own-Vulnerable-Driver Load for EDR Killing

This rule detects loading of vulnerable signed drivers abused by EDR-killer tooling including BdApiUtil.sys, TfSysMon.sys, K7RKScan.sys, ThrottleStop.sys and HwRwDrv.sys. Attackers load these drivers to gain kernel primitives for terminating security processes via DeviceIoControl, so their presence signals an imminent defense-disabling attempt.

Suspicious RegAsm or RegSvcs Spawned by Script Host (via process_creation)

This rule detects RegAsm.exe or RegSvcs.exe launched by a script host such as PowerShell, wscript, or cscript, the injection target abused in the Cascading Shadows phishing chain. The actor hollows these signed .NET utilities to run Agent Tesla, Remcos, or XLoader while evading defenses through trusted binary proxy execution.

Suspicious Scheduled Task Masquerading as Edge Update Running as SYSTEM via schtasks

This rule detects creation of a scheduled task that masquerades as a Microsoft Edge update while running as SYSTEM. This technique was observed in a DLL hijacking campaign analyzed by Kaspersky where attackers created a task named \Microsoft\Windows\Edge\Edgeupdates to gain persistent SYSTEM-level execution. Abusing a legitimate-looking task name in the wrong namespace lets an adversary blend malicious persistence with benign updater activity.

Suspicious DNS Query for TryCloudflare Tunnel Abused for Malware Delivery (via dns_query)

This rule detects DNS resolution of trycloudflare.com subdomains, which threat actors abused as disposable tunnels to host WebDAV shares delivering AsyncRAT and XWorm. TryCloudflare is a legitimate developer service so correlate with script or LNK activity.

Suspicious Windows Security Spoofing via pin Executable Writing output.txt via process_creation

This rule detects execution of pin.exe with an output.txt argument. In the rogue RMM campaign this binary spoofs the Windows Security interface while writing harvested data to output.txt, so its presence indicates a fake security prompt used to capture credentials or user input in support of the intrusion.

Suspicious Autorun Persistence Masquerading as VMware NAT Service

This rule detects a Run key value named VMware NAT Service being created under the current user hive, a persistence method used by Gh0stBins RAT to masquerade as the legitimate VMware NAT service. The genuine VMware service does not register user-level Run key persistence.

Malicious PowerShell Exfiltration to webhook.site Following WSUS Exploitation

This rule detects PowerShell using Invoke-WebRequest to PUT data to the webhook.site service, the exfiltration channel observed after Windows Server Update Services remote code execution. Attackers stage discovery output and upload it to a disposable webhook endpoint for collection. Outbound PUT requests to webhook.site from PowerShell are a strong exfiltration indicator.

Malicious Scheduled Task Deploying DYNOWIPER Payload (via process_creation)

This rule detects scheduled task creation referencing the DYNOWIPER wiper payload filenames used against Poland's energy sector. Observed in Elastic Security Labs telemetry where schtask.exe creates tasks running dynacom_update.exe or Source.exe to launch destructive file-corruption routines, enabling persistence and destructive execution.

ValleyRAT DLL Sideloading via Douyin Loading Non-Standard DLL (via image_load)

This rule detects the legitimate Douyin (TikTok) binary loading a tier0.dll or sscronet.dll, the DLL sideloading behavior used by ValleyRAT to run its loader from the Common Files System directory under a signed application. Adversaries leverage sideloading against a trusted binary to execute shellcode that injects into svchost.exe, making early detection critical for surfacing the intrusion before keylogging and remote-control commands begin.

Suspicious Scheduled Task Creation for HijackLoader Persistence (via process_creation)

This rule detects the creation of a scheduled task named mlt_Archive through schtasks, the persistence mechanism observed in the IObit side-loading intrusion delivering AsyncRAT. This task name is not associated with legitimate software.

Malicious Stopping of Security or Backup Services Before Impact (via process_creation)

This rule detects service-control commands (net stop, sc stop or Stop-Service) targeting antivirus, EDR, SQL or backup services, a defense-impairment step ransomware operators run to disable protection and free locked files before encryption. Stopping security and backup services is an impact-precursor technique in the Red Canary Threat Detection Report. Detecting these commands surfaces the final staging move before data is encrypted.

Malicious SCMBanker ClickFix Payload Fetch via Curl Piped to Cmd

This rule detects a curl download of a remote resource piped directly into a cmd.exe interpreter which is the ClickFix delivery step of the SCMBanker Mexican banking-fraud toolkit. Adversaries trick victims into pasting a clipboard command that fetches and runs a staged validation script. Catching this pipe-to-interpreter pattern exposes the initial foothold before the wider toolkit is pulled.

Suspicious BadIIS Service Persistence Masquerading as System Services

This rule detects creation of Windows services under the BadIIS masquerading names Winlogin, FaxService or AudiosService, which imitate legitimate system service names through subtle misspellings. The commodity BadIIS ecosystem installs services under these deceptive names to persist and blend into service inventories. Creation of a service with these typo-squatted names indicates BadIIS persistence.