Sigma detection rules, expert-reviewed

Suspicious Rundll32 Execution of WebDAV-Hosted DLL via Entry Export (via process_creation)

This rule detects rundll32.exe loading a DLL from a WebDAV UNC path and calling the exported function named Entry. Strela Stealer uses this technique to execute a fileless DLL payload delivered over WebDAV.

Suspicious Windows Defender Tamper Protection Disabled via Registry by Nova Ransomware

This rule detects the Windows Defender TamperProtection value being set to zero under the Defender Features key, disabling tamper protection so security tooling can be altered. Nova ransomware performs this change as part of multi-layered Defender evasion.

Suspicious Attrib Hiding of Stealer Artifacts (via process_creation)

This rule detects attrib.exe applying hidden and system attributes to Maranhao Stealer artifacts such as infoprocess.exe, crypto.key, or the Microsoft Updater directory. This hides malicious files from the user.

Suspicious Bitdefender Binary Sideloading log.dll Loader

This rule detects the legitimate Bitdefender bds.exe loading a malicious log.dll from its directory, a DLL sideloading loader used by the Billbug espionage group to decrypt and run its backdoor payload.

Suspicious Azure CLI Enumeration of Roles and Logic Apps

This rule detects Azure CLI discovery commands that enumerate role assignments and Logic App workflows in a tenant. It reflects post-authentication cloud reconnaissance where an attacker maps permissions and automation to find escalation paths. Detecting it can surface hands-on enumeration after a service principal compromise.

Suspicious Account Set with Password Not Required - Weakness Introduction (via security)

This rule detects set an account with password not required to perform privilege escalation attack.

Suspicious Unattended AnyDesk Silent Install with Auto-Start

This rule detects a silent unattended AnyDesk installation configured to start with Windows, a remote-access-tool deployment pattern abused by threat actors to establish persistent covert remote control of a compromised host. The combination of silent install and auto-start flags indicates non-interactive attacker-driven deployment rather than a normal user setup.

Suspicious Java Process Spawning Reconnaissance Commands via Cleo MFT (via process_creation)

This rule detects a Java process spawning a shell that runs host and domain reconnaissance commands. The Cleopatra Java backdoor, delivered by exploiting Cleo managed file transfer software, executed discovery utilities such as nltest, net view and systeminfo through child shells.

Malicious Tpwinprn DLL Loaded via Renamed rundll32 by Diplomatic Specter

This rule detects execution referencing the Tpwinprn.dll payload run through a renamed copy of rundll32 from SysWOW64, a loader behavior tied to the Operation Diplomatic Specter Chinese cyberespionage campaign. Renaming a signed system binary to proxy DLL execution helps the actor evade image-name detections. Detecting this reveals masqueraded loader activity delivering the espionage toolkit.

Suspicious Script Host Spawning PowerShell Or Cmd via Gootloader

This rule detects wscript.exe or cscript.exe launching PowerShell or cmd, matching the Gootloader chain where a malicious .JS extracted from a ZIP hands off to a shell. Gootloader delivers this JavaScript through SEO-poisoned search results posing as document templates. A Windows script host spawning a command interpreter is rarely benign on endpoints.

Suspicious Run Key Persistence Masquerading as MicrosoftUpdate via Axios npm Compromise (via registry_set)

This rule detects creation of an HKCU Run value named MicrosoftUpdate, the persistence entry installed by the postinstall payload from the compromised Axios npm package to relaunch a dropped VBScript and PowerShell loader. Adversaries choose the MicrosoftUpdate name to blend with legitimate Windows tasks, so a Run value using this masquerading name warrants review for supply chain compromise.

Obfuscated Extended Rights Backdoor Obfuscation - Via localizationDisplayId Attribute (via security)

This rule detects modifies the "configuration" partition in order to obfuscate sneaky changes that will allow him to introduce a stealthy AdminSDholder backdoor.

Suspicious Sednit Guardrailed Loader DLL Loaded Outside System32

This rule detects the Sednit SlimAgent and BeardShell loaders masquerading as eapphost.dll or tcpiphlpsvc.dll being loaded into their guardrail host processes explorer.exe, taskhost.exe or taskhostw.exe from a location outside the System32 directory. The genuine libraries live in System32, so a same-named module loaded from elsewhere into these processes indicates the impersonating implant.

Malicious SQL Server Spawning Command Interpreter via Mallox Ransomware

This rule detects the MS SQL Server process sqlservr.exe spawning a command interpreter such as cmd, PowerShell, or sqlps, the initial code-execution step in Mallox ransomware intrusions following database compromise. A database engine launching shells almost always reflects abuse of SQL for command execution and should be treated as an active intrusion.

Malicious Windows Defender Exclusion Path Addition via process_creation

This rule detects PowerShell using Add-MpPreference with the ExclusionPath parameter to exclude a directory from Windows Defender scanning. The Arcane stealer added Defender exclusions so its staged payloads under attacker controlled folders would not be inspected. Creating antivirus exclusions is a deliberate defense evasion step that usually precedes payload deployment.