Sigma detection rules, expert-reviewed

Malicious UNC1549 MINIBIKE DLL Side-Load of secur32.dll via FileCoAuth (via image_load)

This rule detects the OneDrive-associated FileCoAuth.exe binary loading a secur32.dll from a non-system directory, the side-load path for UNC1549 MINIBIKE and MINIBUS backdoors. The suspected Iranian actor abused a trusted-looking executable to load a malicious DLL of the same name as a system library. Loading secur32.dll from outside System32 through FileCoAuth is a high-fidelity side-loading indicator.

Possible DLL Side-Loading via DicomPortable Spawned by ITarian RmmService

This rule detects DicomPortable launched by the ITarian RmmService process which the phishing RMM campaigns abuse to side-load HijackLoader and DeerStealer through a trojanized DLL. Chaining a legitimate RMM service into a vulnerable portable binary lets adversaries execute malware under a trusted parent. Detecting this parent-child pair surfaces DLL search order hijacking used for stealer delivery.

Suspicious File Download via Certutil URLCache

This rule detects certutil being used with its url cache download flags which the ALPHV intrusion leveraged as a living off the land downloader to stage tooling and this matters because certutil is a signed system binary frequently abused to retrieve remote payloads and its download flags rarely appear in legitimate certificate operations.

Suspicious PowerShell Invoke-WebRequest and Invoke-Expression Download Cradle via ClickFix

This rule detects PowerShell combining Invoke-WebRequest with Invoke-Expression to download and execute a payload in memory as seen in the ClickFix Revenge of detection campaign. This download cradle avoids writing the payload to disk and is triggered from a pasted Run dialog command. The pairing of remote fetch and dynamic execution is a strong malicious signal.

Malicious DLL Side-Loading of SBAMBRES.DLL by VIPRE Binary via DeedRAT (via image_load)

This rule detects the legitimate VIPRE MambaSafeModeUI.exe binary loading SBAMBRES.DLL from the ProgramData Micro directory, the side-loading step that launches the DeedRAT backdoor. Genuine VIPRE components load this DLL from their install directory, not ProgramData.

Suspicious notepad Spawned by mshta for Process Injection

This rule detects mshta spawning notepad which in the WithSecure Windows lab was created suspended as an injection host for a Covenant Grunt implant. The script host mshta launching notepad has no legitimate purpose and strongly suggests it is being used as a hollow target for process injection.

Suspicious Child Process Spawned by WmiPrvSe

This rule detects the WMI provider host WmiPrvSe.exe spawning command interpreters or scripting engines. This process tree is characteristic of remote WMI execution abuse for code execution and lateral movement. Shell processes parented to WmiPrvSe should be reviewed for unauthorized activity.

Conhost Suspicious Command Execution

Detects use of conhost in "headless" mode. By running conhost.exe in "headless" mode, it means that no visible window will pop up on the victim's machine.

Suspicious Windows Credential Manager Enumeration (via process_creation)

This rule detects cmdkey /list or vaultcmd /list enumerating saved credentials in the Windows Credential Manager, a credentials-from-password-stores technique used to reveal cached logins for lateral movement. Credential Manager enumeration is tracked in the Red Canary Threat Detection Report. Detecting these commands surfaces stored-credential discovery.

Malicious Service Abuse with Backdoored "command Failure" - Reg via Command (via process_creation)

This rule detects modify the configuration of a service to trigger an action when the service is crashed.

Suspicious MonsterV2 Payload Masquerading as Windows Health Executable (via process_creation)

This rule detects execution of WinHealth.exe or WindowsSecurity.exe, filenames the SonicCrypt crypter used to disguise the MonsterV2 payload. The crypter spawned these binaries through a Task Scheduler COM object to load the RAT.

Malicious NotPetya Payload Execution via Rundll32 Ordinal Export from Windows Directory

This rule detects rundll32 launching a DLL from the Windows root directory by ordinal export number one which matches the NotPetya execution pattern documented by NCC Group. The ransomware was copied into the Windows folder and executed via its first ordinal to encrypt disks and spread laterally.

Windows Process: SystemSettingsAdminFlows.exe Used to Disable Windows Defender

Alerts when SystemSettingsAdminFlows.exe is launched with command-line arguments consistent with disabling Windows Defender.

Failed WMI NTEventLogFile ClearEventLog attempts (Windows WMI Event 5858)

Alerts on WMI errors (Event 5858) tied to attempted NTEventLogFile ClearEventLog calls on Windows.

Suspicious AnyDesk Silent Install With Unattended Password

This rule detects AnyDesk being configured with the --set-password flag to enable unattended access without user interaction. The Librarian Ghouls APT installs AnyDesk this way to maintain covert remote control of compromised machines for data theft and crypto mining. Silent password provisioning of a remote-access tool is a common hands-on-keyboard persistence step.