Sigma detection rules, expert-reviewed

PureHVNC RAT Execution via AutoIt Interpreter from WordGenius Technologies Directory (via process_creation)

This rule detects the PureHVNC AutoIt interpreter, renamed SwiftWrite.pif or AutoIt3.exe, executing a compiled script from the WordGenius Technologies directory in the user profile. Adversaries run the RAT through AutoIt to abuse a legitimate interpreter and evade static detection, making the combination of the renamed interpreter and the campaign install path a reliable execution signal.

Malicious regsvr32 DLL Execution with Custom Install Argument

This rule detects regsvr32 executed silently with the /n and /i install switches to register and pass a custom argument to a DLL, a technique observed in the AppleSeed triple-combo campaign that ran tripservice.dll with the marker /i:tgvyh. It captures signed-binary proxy execution used to run attacker DLL code while bypassing application controls. Detecting this is important because the combination of /s /n /i on regsvr32 rarely appears in legitimate software.

Suspicious Event Log Clearing via wevtutil (via process_creation)

This rule detects use of wevtutil to clear Windows event logs which was observed being run in a loop over multiple log channels during a BitLocker ransomware intrusion. Clearing logs removes forensic evidence of attacker activity. Destroying event history hinders incident response and hides the actions leading up to encryption.

Suspicious Cloudflared Tunnel Execution with Token

This rule detects execution of the cloudflared client to run a named tunnel with an embedded token, establishing an outbound encrypted channel that bypasses perimeter controls. Akira ransomware operators used cloudflared tunnels for covert remote access into victim networks. Unsanctioned tunneling tools provide attackers persistent command and control that evades firewall inspection.

Malicious Nova Ransomware Note and Encrypted File Extension via File Event

This rule detects creation of the Nova ransomware note README_NOVA.me alongside files bearing the .xgWLckNV extension appended during encryption. These artifacts are dropped as Nova encrypts a host and demands ransom.

Malicious Defender Behavior Monitoring Disable via Set-MpPreference

This rule detects commands that disable Microsoft Defender behavior monitoring through Set-MpPreference or the MpPreference registry path. A fake KMSPico installer delivering Vidar Stealer used a javaw hosted stage to switch off behavior monitoring before running AutoIt. Turning off behavior monitoring lets the loader execute without real-time detection.

Suspicious Recursive Credential and Wallet Search Written to Temp Inventory File

This rule detects a recursive filesystem search for wallet and credential material whose results are written to a temporary inventory file which matches the collection behavior observed when adversaries abuse AI command line tools to harvest secrets. Automating discovery of keys and wallets into a single staging file precedes exfiltration. Detecting this pattern surfaces credential and data collection on the host.

Malicious Scheduled Task Masquerading as Google Updater via Schtasks

This rule detects creation of a scheduled task named after the Google updater with the highest run level triggered on user logon. The CL-STA-1062 actor deploying the TinyRCT backdoor against Southeast Asian governments registers a task called GoogleUpdaterTaskSystem to blend with legitimate Chrome update tasks. Detecting this masqueraded persistence surfaces an elevated logon-triggered foothold hiding behind a trusted name.

Suspicious Executable Running From Fake Chrome User Profile Directory

This rule detects a process executing from a user profile directory named Chrome such as C\Users\Chrome. QwixxRAT copies itself as a hidden rat.exe into this fabricated profile path to blend with the Chrome browser and evade casual inspection. A process running from a user folder named after a browser is an uncommon masquerading pattern that warrants review.

Malicious Recovery Disablement via bcdedit

This rule detects bcdedit disabling Windows recovery, used by the hacktivist ransomware operators to block system restoration before encryption. Turning off automatic recovery removes a victim safety net. Combined with shadow deletion this is a strong pre-encryption impact signal.

Malicious Node.js Execution of test.js from .vscode Folder in Lazarus Lure (via process_creation)

This rule detects the Node.js runtime running a script named test.js located inside a .vscode project folder, the exact loader pattern used by the Lazarus BeaverTail campaign after a victim runs npm install. The hidden .vscode directory disguises the malicious bootstrap among normal editor files. This execution kicks off the download of the follow-on Python infostealer.

Suspicious Regsvr32 Loading DLL from Remote WebDAV Location via Strela Stealer (via process_creation)

This rule detects regsvr32 executing a DLL from a remote WebDAV or HTTP location without writing it to disk, the fileless second stage delivery technique used by Strela Stealer.

Suspicious Lateral Movement via Invoke-WMIExec or Invoke-SMBExec (via ps_script)

This rule detects PowerShell use of the Invoke-WMIExec or Invoke-SMBExec pass-the-hash tooling observed alongside the ThrottleStop AV-killer intrusion. These functions authenticate to remote hosts with an NTLM hash and run commands such as local account creation without a plaintext password. Their presence indicates hands-on lateral movement using stolen credential material.

Malicious Update Orchestrator Service Reconfiguration for Privilege Escalation

This rule detects reconfiguration of the Update Orchestrator Service binary path via sc.exe, the abuse chain behind CVE-2019-1322 that runs an attacker command as SYSTEM. Repointing UsoSvc to an arbitrary command lets a low-privileged user escalate to SYSTEM when the service restarts.

Suspicious Command Prompt Spawned by Winlogon

This rule detects winlogon.exe spawning cmd.exe, an anomalous parent-child relationship used by Backdoor.Stupig to run a SYSTEM command prompt on the secure logon desktop. Winlogon rarely launches an interactive shell.