Sigma detection rules, expert-reviewed

Malicious Hidden Logon Scheduled Task RuntimeOptimizeService via TCLBANKER

This rule detects creation of a scheduled task named RuntimeOptimizeService with a logon trigger and hidden attribute as used by the TCLBANKER banking trojan for persistence in Elastic research. The service like task name combined with a hidden logon trigger indicates a masqueraded persistence mechanism for the implant.

Malicious Cloud Atlas PowerShell Download Cradle via IEX WebClient (via process_creation)

This rule detects PowerShell combining Invoke-Expression with a Net.WebClient object to fetch and execute remote content, the download cradle used by Cloud Atlas to run its next stage in memory. The technique avoids writing the payload to disk before execution. Detecting the IEX and WebClient combination surfaces staged payload execution.

Malicious Lateral Movement via Impacket WMIExec Command Pattern

This rule detects the Impacket wmiexec command pattern where cmd.exe runs with /Q /c and redirects output to a loopback ADMIN$ share, observed by Huntress during a targeted intrusion at a marketing research firm. Attackers use this pattern for semi-interactive remote command execution over WMI while capturing output through SMB. The loopback ADMIN$ output redirection is a distinctive signature of Impacket-style lateral movement.

PlugX DLL Sideloading via mcoemcpy.exe Loading McUtil.dll (via image_load)

This rule detects the legitimate McAfee binary mcoemcpy.exe loading a malicious McUtil.dll, the DLL side-loading behavior used to launch the PlugX backdoor in the NailaoLocker intrusions across Europe. Adversaries abuse a trusted signed executable to run the PlugX loader under a benign process while evading endpoint controls.

Suspicious Modification of rc.local Startup Script by Knife Framework

This rule detects modification of the rc.local startup script on Linux systems. The Knife framework inserts persistence markers into rc.local so its implants relaunch at boot on compromised edge devices. Unexpected changes to rc.local are a common Linux persistence indicator.

Suspicious 32-bit PowerShell Executed From SysWOW64 (via process_creation)

This rule detects invocation of the 32-bit PowerShell binary from SysWOW64, a technique GuLoader uses to run shellcode inside a 32-bit host on 64-bit systems. While some legacy tooling calls this path, its use as a malware execution surface makes it worth surfacing for review.

Renamed DLL Sideloading via Renamed Greenshot Loading GreenshotPlugin from AppData (via image_load)

This rule detects a masqueraded FortiClientCompliance.exe, which is a renamed signed Greenshot binary, sideloading GreenshotPlugin.dll from a user-writable FortiClient compliance directory. Adversaries abuse this signed executable to load an attacker-controlled plugin DLL that in turn decrypts and runs shellcode, making early detection critical for surfacing the loader before command-and-control is established.

Malicious PowerShell Masquerading as wt.exe in ProgramData via Axios npm Compromise (via process_creation)

This rule detects a PowerShell binary renamed to wt.exe and executed from ProgramData, a masquerading technique used by the malicious postinstall payload delivered through the compromised Axios npm package. Adversaries rename PowerShell to evade name-based detection while running follow-on scripts, so a PowerShell OriginalFileName under a wt.exe in ProgramData is a strong indicator of the supply chain implant.

Suspicious WScript Spawning PowerShell From VBS Loader via wscript.exe (via process_creation)

This rule detects wscript.exe launching powershell.exe, a script host chain used by the Kimsuky campaign against Japanese organizations where a malicious VBS decoded and executed PowerShell payloads. Attackers rely on this living-off-the-land chain to stage keylogging and infostealer functionality while evading direct execution of binaries.

Malicious DLL Sideload from Public Music Directory

This rule detects loading of package.dll from the C Users Public Music directory used for DLL sideloading. This behavior matches Ivanti CVE-2025-0282 post-exploitation where operators staged package.dll in a public path to be sideloaded by a signed host process. DLLs loaded from world-writable public folders are a hallmark of sideloading based defense evasion.

Malicious Windows Defender Disable via Set-MpPreference

This rule detects Set-MpPreference being invoked to disable Microsoft Defender protection features which the Dark Pink APT uses to blind endpoint defenses before deploying its tooling. Turning off real time monitoring and scanning lets subsequent payloads run unimpeded. It is important because tampering with Defender is an early and deliberate defense evasion step.

Suspicious PowerShell Downloader Spawned by Batch Script (via process_creation)

This rule detects a batch script spawning PowerShell to download further payloads as seen in the ScarletStealer installation chain where install.bat pulls additional stealer components from an attacker server.

Suspicious Python Inline Exec Execution in STARKVEIL Chain

This rule detects the Python interpreter executing an inline exec statement passed on the command line, matching the STARKVEIL dropper chain that pivots through py.exe to decode and run staged code from fake AI-themed websites. Attackers use this living-off-the-land step to run obfuscated loaders and deploy the XWORM and FROSTRIFT backdoors.

Suspicious PowerShell Spawned by Windows Script Host from HTML Smuggling (via process_creation)

This rule detects PowerShell launched by wscript or cscript, matching the IcedID chain where HTML smuggling dropped a Windows Script File that ran VBScript and then PowerShell. The PowerShell stage downloaded and executed the IcedID loader.

Suspicious Hidden Executable Launched from Mounted Image via Shortcut (via process_creation)

This rule detects a shortcut-launched executable running with a hidden or minimized window from a non-system drive letter that typically corresponds to a mounted image. EnvyScout ships an NV.lnk shortcut that silently starts the hidden BOOM.exe from the mounted NV folder after the victim opens the ISO. Hidden execution from freshly mounted removable media is characteristic of container-delivered malware.