Sigma detection rules, expert-reviewed

Suspicious Curl Download and Silent MSI Install of Remote Management Software (via process_creation)

This rule detects a command chain that uses curl to fetch an MSI package and then runs msiexec with a silent install flag, the delivery technique used in the vishing campaign against US law firms to deploy SuperOps and other remote management tooling. Adversaries pair remote download with unattended installs to stand up remote access without user interaction, so this chained behavior is worth flagging.

Suspicious MOVEit w3wp Child Process Execution via process_creation

This rule detects the MOVEit Transfer IIS worker process w3wp.exe spawning command interpreters, which is the expected behavior when a dropped ASPX web shell is executed. During CVE-2023-34362 exploitation the attacker used the web shell under w3wp to run follow-on commands, so interpreter children of this worker are a strong web exploitation signal.

Default Account Usage

Threat actor (APT35) created user, enabled it, set password, add to admins and remote desktop users.

Malicious NTDS.dit Extraction via ntdsutil IFM Snapshot (via process_creation)

This rule detects use of ntdsutil to create an install-from-media snapshot, the technique Storm-1175 uses to extract the NTDS.dit Active Directory database and steal domain credential hashes during Medusa ransomware operations. Adversaries dump NTDS.dit to obtain every domain account hash for offline cracking and mass lateral movement, so this command on a domain controller is a critical credential-access alert.

Malicious DcRAT Payload Masquerading as Mixed Reality.exe via process_creation

This rule detects execution of a binary named Mixed Reality.exe from the Windows Media Player directory, a masquerading trick used by Operation DragonReturn to stage its multi-stage DcRAT loader. The China-nexus actor placed the payload under a trusted vendor folder to blend with legitimate software while conducting espionage against Indian tax infrastructure, so early detection exposes the loader before injection and C2.

Malicious SUNBURST Command and Control DNS Query to avsvmcloud Domain (via dns_query)

This rule detects DNS lookups containing the avsvmcloud domain used as the SUNBURST first-stage command and control and victim beaconing channel. The backdoor encodes environment data into subdomains of avsvmcloud during its DGA-style callbacks. Detecting any avsvmcloud query is a high fidelity indicator of a SUNBURST compromised host.

Suspicious action.inf Dropped Alongside ViPNet Update Loader

This rule detects the creation of an action.inf file inside a ViPNet update directory which carries the extra_command configuration consumed by the malicious update loader. This drop is part of a backdoor masquerading as ViPNet updates that stores its attacker-controlled parameters next to the substituted binary. Catching the config write reveals the staging step before execution.

Suspicious DLL Sideloading via Signed Utility Binaries Used by Storm-2603

This rule detects execution of signed helper binaries such as 7z.exe, clink_x86.exe, MpCmdRun.exe and VMToolsEng.exe from outside their legitimate installation directories, a DLL search-order hijacking technique abused by Storm-2603 to load malicious payload DLLs under a trusted process. Running these tools from user-writable or temporary paths is anomalous and indicates staged loader activity during the intrusion.

Suspicious WScript Execution Spawned by Microsoft Word (via process_creation)

This rule detects wscript.exe spawned as a child of Microsoft Word, indicating macro-driven script execution. The returning Bumblebee campaign used a macro-enabled document that dropped a temp script and ran it via wscript to fetch the loader.

Malicious Mimikatz Credential Dumping Command Line

This rule detects Mimikatz style command modules on the process command line such as privilege debug and sekurlsa logonPasswords. In the WithSecure Catching Lazarus Part Two research the actor runs these modules to dump credentials from lsass memory. Attackers use Mimikatz to harvest passwords and hashes for lateral movement.

Suspicious BITSAdmin File Transfer Download (via process_creation)

This rule detects use of bitsadmin with the transfer switch to download a remote payload which the LilacSquid actor uses to retrieve the MeshAgent remote management tool. Living-off-the-land download via the Background Intelligent Transfer Service evades network monitoring and blends with legitimate update traffic.

Suspicious PowerShell Spawning wscript with Silent Flag (via process_creation)

This rule detects PowerShell launching wscript.exe with the silent background flag to run a JScript wrapper. This chain was observed in the JS#SMUGGLER campaign to execute the NetSupport RAT loader while suppressing script errors.

Obfuscated Firewall Deactivation - Deprecated Command (via process_creation)

This rule detects disabled the Windows Firewall to evade defense.

QBot process creation from scheduled task REGSVR32 (regsvr32.exe), -s flag and SYSTEM in the command line

Detects the process creation from Scheduled Task with REGSVR32 (regsvr32.exe), -s flag and SYSTEM in the command line

LOTUSLITE Renamed Loader DataTechnology Executed with DATA Argument (via process_creation)

This rule detects the LOTUSLITE renamed loader DataTechnology running with its DATA switch from the ProgramData Technology360NB directory during the geopolitical espionage campaign. Adversaries copy the sideloading executable as DataTechnology and pass a DATA argument to trigger the malicious export. The renamed binary with that argument from ProgramData is a distinctive execution marker.