Sigma detection rules, expert-reviewed

Malicious WannaCry Run Key Persistence to tasksche via registry_set

This rule detects the creation of a Run key registry value pointing to the WannaCry payload tasksche.exe, establishing persistence at user logon. The malware writes this value under the CurrentVersion Run key to survive reboots. Presence of a tasksche.exe reference in an autostart location is a high-confidence indicator of WannaCry infection.

Suspicious File Created in Startup Folder by WinRAR via CVE-2025-8088

This rule detects WinRAR or its extraction binaries writing a file into a user Startup folder which indicates exploitation of the CVE-2025-8088 alternate data stream path traversal flaw. Attackers drop LNK HTA or BAT payloads into Startup to gain logon persistence when a user opens a crafted archive.

Suspicious Service Host Spawning Command Interpreter in Session 0 via WFP Kernel Backdoor (via process_creation)

This rule detects svchost.exe spawning command interpreters such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe, the command-execution pattern produced by the wskmon.sys WFP kernel backdoor when it injects operator commands into a service host in Session 0. Adversaries leverage this parent-child relationship to run shells under a trusted system process, making detection valuable for catching kernel-driven command execution.

Malicious ESXi Secure Boot Bypass via execInstalledOnly Disable

This rule detects an esxcli command disabling the execInstalledOnly kernel setting on an ESXi host, matching UNC3944 tampering that allows unsigned binaries to run so the actor can deploy ransomware and offline tooling. Turning off this protection removes a core defense against untrusted code on the hypervisor.

Malicious Payload Download and Execution via certutil urlcache (via process_creation)

This rule detects certutil being used with the urlcache option to download a remote executable to disk, a living off the land technique used by a ransomware actor after exploiting an unsupported ColdFusion server to fetch and launch beacon payloads into the Windows temp directory. Legitimate use of certutil to download arbitrary executables over HTTP is rare.

Suspicious Kerberos Password Account Reset to Issue Potential Golden Ticket (via security)

This rule detects scenarios where a suspicious password reset of the Krbtgt account is performed by attacker to issue a potential Golden ticket.

Suspicious Scheduled Task Masquerading as Realtek Audio Service (via process_creation)

This rule detects the AsyncRAT campaign registering scheduled tasks that impersonate Realtek audio maintenance to launch its batch and AutoHotkey loaders. The tasks use names such as CheckRealtekAudioVersion and execute dropped RealtekAudioService64 components. Creation of these named tasks indicates persistence by the loader.

Suspicious Remote Desktop Enablement via Registry fDenyTSConnections and Firewall Rule (via process_creation)

This rule detects Remote Desktop being switched on by setting fDenyTSConnections to zero or by opening the RDP firewall group through netsh advfirewall, the lateral-access preparation in the ELPACO-team intrusion before RDP movement to backup and file servers. Adversaries enable inbound RDP to pivot with stolen credentials, so these host-hardening reversals outside change control warrant investigation and can be filtered on approved administration hosts.

Suspicious TALONITE Certutil LOLBIN Decode and Download Abuse (via process_creation)

This rule detects certutil.exe invoked with decode, URL cache, or verifyctl arguments used to deobfuscate or download payloads. TALONITE abuses certutil as a living-off-the-land binary to decode staged content and retrieve additional tooling during intrusions. Certutil used for file decoding or remote fetch outside certificate management is a common defense-evasion and delivery technique.

Suspicious Disabling of Windows Firewall via Netsh (via process_creation)

This rule detects netsh being used to turn the Windows firewall off across profiles, a defense-impairment step attackers take to unblock command-and-control or lateral-movement traffic. Disabling the host firewall is a defense-evasion technique tracked in the Red Canary Threat Detection Report. Detecting these commands surfaces an attacker lowering host defenses ahead of further activity.

Malicious TALONITE FlowCloud Renamed HTML Help Workshop Binary (via process_creation)

This rule detects a process whose original file name is the legitimate HTML Help Workshop binary hhw.exe but which runs under a different image name. TALONITE FlowCloud executes a renamed copy of hhw.exe to store harvested host data in database files while evading name-based detection. A mismatch between the embedded original name and the on-disk name is a strong masquerading signal.

Malicious PowerShell IEX DownloadString One-Liner

This rule detects PowerShell using Invoke-Expression together with a WebClient DownloadString call to fetch and run remote code in memory. This one-liner is delivered through the Win+R fake CAPTCHA lure used to distribute Lumma Stealer. Catching the fetch-and-execute pattern flags fileless staging before the stealer touches disk.

Malicious Mimikatz LSASS Credential Dumping via Command Line

This rule detects Mimikatz command modules such as sekurlsa logonpasswords or lsadump on the process command line, the credential harvesting method TrickBot uses through its Mimikatz-based module to dump LSASS memory. These module strings are distinctive to Mimikatz regardless of the binary name. Their presence indicates active credential theft supporting lateral movement.

Masquerading Noodlophile Payload Execution via Video File Double Extension (via process_creation)

This rule detects execution of an image named with a video double extension such as .mp4.exe, the masquerading technique used by the Noodlophile stealer campaign delivered through fake AI video-generation platforms. Adversaries leverage a video-looking filename so users who expect a rendered clip instead launch the wrapper binary, making early detection critical for catching the intrusion at first execution before the CapCut loader and XWorm injection proceed.

Suspicious Windows Event Log Clearing via wevtutil

This rule detects clearing of Windows event logs using wevtutil cl. Ransomware operators covered in this report chain wevtutil cl commands against the Security, System and Application logs to erase forensic evidence around encryption. Bulk event-log clearing is a strong indicator of anti-forensic activity.