Sigma detection rules, expert-reviewed

Malicious Windows Defender Tampering via Set-MpPreference and Add-MpPreference (via ps_script)

This rule detects PowerShell disabling Windows Defender sample submission and adding path exclusions through Set-MpPreference and Add-MpPreference. The RATatouille intrusion uses these commands to blind the antivirus by setting SubmitSamplesConsent to NeverSend and excluding its payload directory. Tampering with Defender preferences is a strong signal of attacker defense evasion.

Suspicious PowerShell AMSI Bypass via 8220 Gang Hadooken Loader

This rule detects PowerShell code that patches the Anti-Malware Scan Interface by reflectively accessing amsiInitFailed or the AmsiUtils type to disable in memory scanning. The 8220 gang uses an AMSI bypass before launching its CCleaner64.exe branded loader in the Hadooken campaign. Disabling AMSI is a common precursor to fileless payload execution and rarely appears in benign scripts.

Suspicious wscript Execution Forcing VBScript Engine in Batch Mode

This rule detects wscript.exe executing a script with an explicit vbscript engine selection and batch mode flag. Gamaredon GammaSteel launches its VBScript loader this way to suppress errors and dialogs during execution. Explicitly forcing the engine and silencing output is unusual for benign scripts and points to automated malware execution.

Suspicious mshta Execution of Inline JavaScript

This rule detects mshta.exe running an inline javascript command line. Gamaredon delivers HTA and LNK files that invoke mshta with javascript to launch the next stage of GammaPhish. Inline scripting through mshta is a well known living off the land execution and evasion technique.

Suspicious Hidden PowerShell Web Download via ClickFix Tactic

This rule detects PowerShell launched with a hidden window and no profile that immediately downloads and starts a remote payload. IClickFix and related WordPress driven ClickFix campaigns trick users into pasting this command from a fake verification prompt. The combination of a hidden window a bypassed profile and an inline web download reflects unattended payload retrieval rather than normal administration.

Malicious DLL Registration via regsvr32 Loading prnfldr (via process_creation)

This rule detects regsvr32.exe registering the prnfldr.dll payload using the silent install flags. In Operation Phantom Net Voxel APT28 executes its loader DLL through regsvr32 with the /n /i options to run code while bypassing application controls. Regsvr32 loading this named DLL is characteristic of the campaign proxy execution.

Suspicious File Hiding via attrib Hidden and System Attributes (via process_creation)

This rule detects use of attrib.exe to set both the hidden and system attributes on a file. The multi-stage infection chains hide their dropped startup scripts and payloads from casual inspection using this technique. Applying the hidden and system flags together is a common defense evasion move to conceal malicious artifacts.

Suspicious Command Interpreter Spawned by mshta (via process_creation)

This rule detects cmd or PowerShell being launched as a child of mshta.exe. The multi-stage infection chains analyzed by Sekoia deliver an LNK that opens an HTA which then spawns a command interpreter to continue the chain. A command interpreter descending from mshta indicates HTA-based staged execution rather than normal application behavior.

Suspicious Data Exfiltration to Azure Blob Storage via AzCopy (via process_creation)

This rule detects AzCopy copying local data to an Azure blob storage endpoint. The Interlock ransomware operators abuse AzCopy to exfiltrate stolen files to attacker-controlled cloud storage before encryption. AzCopy transferring data to blob core windows net from an unexpected host indicates exfiltration to cloud storage.

Suspicious Node.js Execution of nvidia.js Script via cmd (via process_creation)

This rule detects the Node.js runtime executing a script named nvidia.js. The Lazarus ClickFake Interview campaign runs its JavaScript backdoor through node while masquerading as GPU driver tooling. Node executing this specific script indicates malicious cross-platform payload execution.

Suspicious Service Creation Named RDP-Controller via sc.exe (via process_creation)

This rule detects creation of a Windows service named RDP-Controller with a custom binary path via sc.exe. The RATatouille intrusion installs this service to gain persistence and enable remote desktop control through its main.exe payload. A service using this masquerading name with an arbitrary binPath indicates malicious persistence.

Suspicious mshta Execution Spawned by Scheduled Task Service Host (via process_creation)

This rule detects mshta.exe being launched as a child of the Schedule service host process. In the Double-Tap campaign the HATVIBE loader is executed through a scheduled task so svchost hosting the Schedule service spawns mshta.exe. A scheduled task launching the mshta living-off-the-land binary is unusual and points to malicious HTA execution.

Suspicious Scheduled Task Creation Launching mshta via schtasks (via process_creation)

This rule detects creation of a scheduled task named ServiceDispatch that repeatedly launches mshta.exe. The Double-Tap campaign attributed to APT28 uses this persistence mechanism to run the HATVIBE HTA loader every few minutes. Combining a masquerading task name with the mshta living-off-the-land binary indicates malicious persistence rather than benign scheduling.

Malicious Volume Shadow Copy Deletion via wmic and vssadmin (via process_creation)

This rule detects deletion of volume shadow copies through wmic shadowcopy delete and vssadmin Delete Shadows commands. This behavior is used by the Helldown ransomware to inhibit system recovery prior to encrypting files. Removing shadow copies prevents victims from restoring their data which maximizes the impact of the intrusion.

Malicious MuddyRot Implant Execution From ProgramData SoftwareMemory Path

This rule detects execution of a binary from the ProgramData softwarememory documentsmanagerreporter.exe location, the fixed install path and filename used by the MuddyWater MuddyRot implant. The actor drops the payload here and registers persistence to maintain access. The hardcoded path and masqueraded name make this a high confidence indicator of MuddyRot infection.