Sigma detection rules, expert-reviewed

Malicious regsvr32 Scriptlet Execution via scrobj.dll

This rule detects regsvr32.exe executing a remote or local scriptlet through scrobj.dll, the Squiblydoo signed-binary proxy execution technique. The CPU-Z watering-hole intrusion used regsvr32 with a .sct scriptlet to run attacker code while bypassing application controls as documented by Kaspersky. This combination of regsvr32 with the scriptlet handler is rarely legitimate and indicates evasive code execution.

Malicious ESX Admins Domain Group Creation via Process Creation

This rule detects creation of or membership changes to a domain group named ESX Admins using net.exe, the core exploitation step for CVE-2024-37085 in which ESXi hypervisors grant full administrative access to any member of that group. Multiple ransomware operators created this group to obtain hypervisor admin rights and mass-encrypt virtual machines.

Suspicious Script Host Spawning PowerShell via BlindEagle Chain

This rule detects a Windows Script Host process (wscript or cscript) spawning PowerShell, the execution chain used by BlindEagle after its VBS downloader retrieves remote payloads. This VBS-to-PowerShell handoff drives multi-stage RAT delivery such as njRAT and AsyncRAT, so the pattern is a strong early indicator of the infection.

PowerShell Base64 Download Cradle via FromBase64String and Invoke-Expression (via ps_script)

This rule detects PowerShell that decodes a base64 blob with FromBase64String and immediately runs it through Invoke-Expression, the staged download-and-execute cradle used by the LNK phishing chains analyzed by STRT to fetch and launch a second-stage script. Adversaries leverage this pattern to reconstruct and execute obfuscated code in memory, so this behavior warrants review during phishing investigation.

Suspicious Rundll32 Loading DLL from User-Writable Path (via process_creation)

This rule detects rundll32.exe loading a DLL from a user-writable directory such as ProgramData or AppData. AresLoader downloads its DLL into %AllUsersProfile% and invokes it through rundll32 with an exported ordinal to run the loader. Rundll32 executing a DLL from a staging directory is a frequent proxy-execution and defense-evasion pattern.

Suspicious Winlogon AutoAdminLogon Credential Registration

This rule detects enabling of Winlogon automatic logon by writing AutoAdminLogon, DefaultUserName or DefaultPassword under the Winlogon key. The ToyMaker access broker set these values so a reboot into their controlled session authenticates automatically, cementing persistence and easing the handoff of the compromised host to extortion affiliates.

Possible Andariel Keylogger Output Archive Staged in Temp (via file_event)

This rule detects creation of the password-protected keylog archive and its embedded log file staged in the Temp directory by a keylogger attributed to the North Korean group Andariel. Adversaries write captured keystrokes and clipboard data to a compressed archive on disk before exfiltration, so these named artifacts indicate active credential capture.

Suspicious Active Directory Enumeration via AD Explorer Snapshot Process Creation

This rule detects the Sysinternals AD Explorer tool being run with the snapshot argument to capture an offline copy of Active Directory, a discovery technique used by Peach Sandstorm to enumerate accounts and objects. An AD snapshot pulls the full directory for later analysis and is rarely part of routine endpoint activity.

Malicious Secretdump Password Dumping via SMB Admin Share (via security)

This rule detects execute Secretdump in order to remotely dump credentials over SMB.

Suspicious Base64 Decoding via Certutil

This rule detects certutil used with its decode flag to deobfuscate Base64-encoded content on disk. The KimJongRAT variant chains certutil and findstr to decode staged payloads before execution. Certutil-based decoding is a living-off-the-land deobfuscation technique that bypasses many controls.

Malicious LSASS Process Dump by a Non System Account (via security)

This rule detects will dump the LSASS memory content using tools like Mimikatz, ProcDump, TaskMgr, ...

Malicious LSB Steganography Image Decoding via PowerShell (via ps_script)

This rule detects PowerShell loading an image as a bitmap and iterating pixel values to extract an embedded payload. The Caminho loader used a GetPixel loop over a downloaded image to decode a hidden .NET assembly for fileless execution.

Malicious Payload Assembly via MZ Header Prepend and copy Concatenation (via process_creation)

This rule detects the technique of writing an MZ header and concatenating it with a downloaded blob using copy to reconstruct an executable, used by Bitter APT against PTCL to rebuild the WmRAT payload. The disguised binary is downloaded as a PNG then reassembled on disk. This MZ-prepend and copy pattern is a distinctive evasion behavior.

Suspicious VBScript Execution From ProgramData Microsoft Subfolder

This rule detects wscript or cscript executing a .vbs file from a subfolder under C:\ProgramData\Microsoft, a persistence and staging path used by Banana RAT. Legitimate scripts rarely run from these attacker-created directories.

Malicious Exchange Group Membership Change to Perform DCsync Attack (via security)

This rule detects adds its account into a sensitive Exchange group to obtain "Replicating Directory Changes /all" and perform DCsync attack.