Sigma detection rules, expert-reviewed

Suspicious Image File Execution Options Debugger Hijack by Miner Campaign

This rule detects creation of a Debugger or MonitorProcess value under Image File Execution Options, an IFEO hijack the Wazuh-agent miner campaign uses for persistence and to launch its payload when a targeted process starts. IFEO debugger entries are seldom set legitimately and are a well-known persistence and injection vector.

Malicious ClickFix PowerShell IEX DownloadString Execution

This rule detects PowerShell running with no-profile and bypass execution policy while using DownloadString and IEX to fetch and run a remote payload, the EVALUSION ClickFix loader. Victims were social-engineered into executing this command which pulled Amatera Stealer and NetSupport RAT from attacker infrastructure. The combination of policy bypass and an in-memory download cradle is a high-confidence execution indicator.

Suspicious Security Center Health Notification Hidden via Registry

This rule detects modification of the Explorer policy value that hides the Security and Maintenance health notifications which the Trigona actor set to suppress warnings while disabling protections and this matters because hiding security health alerts is a user impact evasion technique meant to keep victims unaware of a degraded security posture.

Malicious NTDS.dit Copy for Domain Credential Theft (via file_event)

This rule detects an ntds.dit Active Directory database file being written to disk, the credential-theft step where Muddled Libra copies the domain database and SYSTEM hive from a mounted VMDK. Extracting ntds.dit yields every domain account hash for offline cracking and full domain compromise.

Malicious COM Hijack via CLSID InProcServer32 Registry Modification (via registry_set)

This rule detects a COM hijack targeting the CLSID 2227A280-3AEA-1069-A2DE-08002B30309D by writing to its InProcServer32 registry value. In Operation Phantom Net Voxel APT28 abuses this specific shell folder CLSID so that explorer loads a malicious DLL for persistence and execution. Redirecting this InProcServer32 value to an attacker DLL is a reliable indicator of COM hijacking.

Malicious Scheduled Task for Cryptominer Persistence at Logon (via process_creation)

This rule detects creation of the Monero mining operation scheduled tasks that run at logon with highest privileges. Observed in the Elastic Security Labs fake-installer campaign where SVCConfig or HostDataProcess tasks with ONLOGON and HIGHEST run levels persist the XMRig miner.

Suspicious DanaBot Updater Scheduled Task Running Rundll32 from AppData via schtasks

This rule detects creation of a scheduled task named Updater that launches rundll32.exe against a DLL staged under a per-user AppData Custom_update directory, a persistence pattern used by DanaBot when deploying IcedID. Attackers abuse task scheduler plus rundll32 proxy execution to survive reboots and blend malicious loader activity into routine update tasks.

Malicious Ntospy Network Provider DLL Registration for Credential Capture

This rule detects registration of a malicious Network Provider DLL under the credman service key, matching the Ntospy credential-stealing component used against organizations in the Middle East, Africa and the US per Unit 42. Registering a rogue authentication package as a network provider lets the actor intercept plaintext logon credentials which enables persistent credential theft.

Malicious VenomRAT Scheduled Task Masquerading as Windows Gaming Preview via process_creation

This rule detects creation of a scheduled task named Windows.Gaming.Preview that points to an executable inside the user AppData Drivers directory. The fake CVE-2023-40477 proof-of-concept lure installs VenomRAT with this masqueraded task that reruns the payload from a non-standard path, combining a benign-looking name with a wrong execution context for persistence.

Suspicious Curl POST Downloading PowerShell Payload to Temp Directory (via process_creation)

This rule detects curl issuing an HTTP POST request whose output is a PowerShell script, the ingress technique used in the Axios NPM supply chain attack where cmd.exe piped a curl POST response into a .ps1 file in the Temp directory. Adversaries stage second-stage scripts this way to pull payloads from attacker infrastructure, so the combination of curl, a POST verb, and a PowerShell target file is worth alerting on.

Suspicious ASPX Webshell Written to IIS inetsrv Directory via file_event

This rule detects an fd.aspx file being written under the IIS inetsrv directory, matching the webshell dropped by the hacktivist actors for server access. Web-facing script files appearing in the IIS binaries path are a hallmark of server-side webshell deployment. This supports persistence and remote command execution on internet-facing hosts.

PowerShell In-Memory Shellcode Execution via Memory Allocation APIs (via ps_script)

This rule detects a PowerShell script block that combines GlobalAlloc VirtualProtect and CreateThread calls to allocate executable memory and run shellcode, the in-memory loading behavior of the RokRAT search.dat loader read from the public directory. Adversaries leverage reflective shellcode execution to run their payload without touching disk as a file, making early detection critical for surfacing fileless code execution before RokRAT deploys.

Malicious more_eggs Scriptlet DLL Registration via regsvr32 Action Install from AppData (via process_creation)

This rule detects regsvr32 registering a DLL from a user AppData path with the /i Action install switch, the second-stage more_eggs loader behavior in which wmiprvse.exe spawned regsvr32 to activate a payload dropped under AppData Roaming Microsoft. Adversaries use the regsvr32 /n /i scriptlet-install path to run code through a trusted binary while avoiding on-disk executables, so this pattern from a user directory is a strong loader indicator.

Malicious SAM and SYSTEM Hive Dump via reg save (via process_creation)

This rule detects use of reg.exe to save the SAM or SYSTEM registry hives to disk for offline credential extraction. This technique was observed in the APT41 intrusion targeting government IT services in Africa. Dumping these hives lets attackers recover local account password hashes and boot keys away from the host and is a strong precursor to lateral movement.

Suspicious Wscript Executing UN VBS Cleanup Script via Command Line (via process_creation)

This rule detects wscript.exe executing a VBScript named UN.vbs, the cleanup component used by the Parallax RAT to remove infection artifacts. It is associated with the Parallax RAT campaign reported by Uptycs. Attackers run this script to erase traces after establishing access, so the execution is a useful indicator of post-infection cleanup activity.