Sigma detection rules, expert-reviewed

Suspicious Security Policy Export via SecEdit (via process_creation)

This rule detects secedit.exe exporting the local security policy configuration to a file. Lynx operators used this to enumerate account and password policy during host reconnaissance. Exported policy informs privilege escalation and account manipulation later in the intrusion.

Suspicious Enabling of Network Discovery Firewall Rules via PowerShell

This rule detects enabling of the Network Discovery firewall rule group via PowerShell, the step The Gentlemen ransomware took to widen host visibility for lateral movement. Programmatically enabling network discovery firewall rules during an intrusion facilitates spread across the environment.

Suspicious Antivirus Product Enumeration via WMI Query via process_creation

This rule detects command lines that query the Windows Security Center AntiVirusProduct class which attackers use to enumerate installed security software before deploying payloads. SideWinder profiled endpoint defenses through WMI antivirus enumeration to tailor its evasion. Discovery of security tooling frequently precedes defense evasion and payload delivery.

Suspicious pythonw.exe Executing winresume.pyc via Confucius AnonDoor Backdoor (via process_creation)

This rule detects the Confucius AnonDoor Python backdoor which is run by a scheduled task named NetPolicyUpdate invoking pythonw.exe against a hidden winresume.pyc file every five minutes. Execution of a compiled Python module named winresume.pyc by the windowless interpreter indicates the backdoor. The task provides persistence.

Suspicious Executable Written to Windows Fonts Directory via file_event

This rule detects executable or driver payloads being written into the Windows Fonts directory, an unusual location abused by GHOSTENGINE to stage its mining and defense-evasion components. Legitimate software does not deploy executables to this font resource folder. Files of this type in Fonts are a strong indicator of malicious staging.

HTTPSnoop Masquerading as CyveraConsole Outside Palo Alto Path

This rule detects a process named CyveraConsole.exe running from a directory other than the legitimate Palo Alto Networks installation path. The ShroudedSnooper HTTPSnoop implant masqueraded as CyveraConsole.exe, a genuine Cortex XDR component, to blend into endpoints. A CyveraConsole binary outside the vendor path indicates an impersonating implant rather than the real agent.

Suspicious rundll32 Loading DLL from AppData via DllRegisterServer

This rule detects rundll32 executing a DLL located under AppData through the DllRegisterServer entry point. OysterLoader stages its COPYING3.dll payload in the roaming profile and runs it with this export. Running an AppData resident DLL through rundll32 with DllRegisterServer is a recognised loader execution pattern.

Suspicious Script Host Execution from AppData WindowsHelper Staging Folder via process_creation

This rule detects wscript.exe running a run.vbs from an AppData WindowsHelper directory, the staging location Armored Likho uses to chain into a Python module payload. Script execution from this attacker staging folder is part of the BusySnake stealer loader. It indicates active execution of the stealer.

In-Memory Regasm Process Hollowing Spawned by PowerShell (via process_creation)

This rule detects the .NET Regasm.exe utility launched as a child of powershell.exe, the process-hollowing target used by 0bj3ctivityStealer to inject its final stealer payload. Adversaries leverage Regasm as a signed injection host that seldom runs from PowerShell, making this parent-child pairing a reliable indicator of code injection.

Malicious C2 Configuration Stored in TitanPlus Registry Key (via registry_set)

This rule detects writes to a TitanPlus registry key, the location where the intrusion described by Truesec stored encoded command-and-control server addresses using character substitution. Adversaries hide C2 configuration in an obscure registry value to survive reboots and evade file-based detection, making writes to this named key a targeted persistence and C2 indicator.

Suspicious PHP Webshell File Creation Linked to BeyondTrust Exploitation (via file_event)

This rule detects creation of PHP webshell files named aws.php and file_save.php observed after exploitation of BeyondTrust CVE-2026-1731. These webshells provide persistent remote command execution on the compromised host, so their appearance on a web-accessible path indicates an established foothold.

Malicious PlugX Scheduled Task Named InternetUpdateTask (via process_creation)

This rule detects creation of a scheduled task named InternetUpdateTask, the persistence artifact left by the PlugX malware family to relaunch its DLL sideloaded loader at logon. The benign sounding task name masks recurring execution of the implant, so its creation is a strong indicator of PlugX persistence being established.

Suspicious Python Execution from WebDAV Share via PowerShell (via process_creation)

This rule detects python.exe spawned by PowerShell while referencing a remote WebDAV share path in its command line. The Voldemort espionage campaign ran Python directly from mounted TryCloudflare WebDAV shares to load its backdoor without local staging.

Malicious Reverse SSH Tunnel via Renamed PuTTY svchosts.exe (via process_creation)

This rule detects the Hive0129 BlotchyQuasar RAT establishing a reverse SSH tunnel using a renamed PuTTY binary called svchosts.exe to forward internal SMB and RDP ports over the HTTPS port. The misspelled svchosts.exe name combined with remote-forward switches and batch mode reveals covert tunneling. Legitimate services do not run this binary.

Self-Deletion via Ping Loopback Delay and Del Command

This rule detects a command line that pings the loopback address to introduce a delay before deleting a file, the self-cleanup routine used by PlayBoy Locker to remove its own binary. Chaining ping 127.0.0.1 with del is a common anti-forensic indicator-removal technique in malware.