Sigma detection rules, expert-reviewed

Suspicious Triada mms-core.jar Backdoor Dropped in App Data

This rule detects creation of an mms-core.jar file within an application data directory which the Triada trojan drops as a backdoor module loaded into hooked processes. This module implements the trojan command handling used to intercept SMS and manipulate clipboard cryptocurrency addresses. The specific filename in a per-app data path is a reliable Triada artifact.

Suspicious Quick Assist Spawning Command Interpreter or Download Tooling via Process Creation

This rule detects the Quick Assist remote assistance tool spawning a command interpreter or download utility, a technique used in social engineering attacks where operators abuse Quick Assist to run scripted downloads. Storm-1811 leveraged this to fetch Qakbot and Cobalt Strike leading to Black Basta ransomware, so a legitimate support binary launching cmd, PowerShell or curl warrants investigation.

Malicious curl Insecure Download to AppData or Temp

This rule detects curl.exe writing a downloaded file into the AppData or Temp directory using the insecure flag, the ClickFix installation pattern used in OpenClaw brand-lure campaigns to fetch infostealer payloads before immediate execution. Attackers instruct victims to paste a terminal command that curls the payload to a user writable path. Downloading executables into AppData or Temp with certificate checks disabled is a strong staging indicator.

Suspicious Defender Exclusion for Public Controller Path (via process_creation)

This rule detects PowerShell adding a Microsoft Defender exclusion for a Controller folder under C:\Users\Public as done by the Efimer Trojan to protect its payload. Whitelisting an attacker-controlled directory in a world-writable location lets the malware run and update without being scanned. This combination of Add-MpPreference and a public path is rarely legitimate.

Suspicious CTFMON Masquerade Persistence via Run Key (via registry_set)

This rule detects a Run key value referencing a ctfmon.bat script, a persistence mechanism used by the SugarGh0st RAT that masquerades as the legitimate CTFMON input service. The batch launcher re-executes the malware at logon while blending in with expected process names.

Suspicious Script Execution from Alternate Data Stream via WScript

This rule detects wscript executing content stored in an alternate data stream, seen when an APT targeting Vietnamese human rights defenders hid a PowerShell scheduler in a log.txt ADS. Execution from a colon-delimited stream path conceals the payload from casual file inspection. ADS-hosted scripts are a defense evasion technique used to stage hidden persistence.

LegionLoader Process Hollowing via SysWOW64 explorer.exe Self-Invocation (via process_creation)

This rule detects explorer.exe launched with explorer.exe passed as its own argument, the anomalous invocation used by the LegionLoader shellcode to spawn a SysWOW64 explorer.exe target for process hollowing. Legitimate Windows shell launches never pass the binary name as a command-line argument, so this pattern surfaces the injection host before LegionLoader is mapped into memory.

Suspicious Run Key Persistence Pointing to Temp or Public Folder

This rule detects creation of autorun registry values whose payload path resides in a temporary or public user writable directory which Phobos ransomware uses to survive reboots. Legitimate software rarely persists from these transient locations so this pattern is a reliable indicator of malicious persistence.

Suspicious PowerShell Download of scrss or ekrn Masquerading Scripts

This rule detects PowerShell referencing scrss.ps1 or ekrn.ps1, downloader script names used in the Gamaredon and Turla collaboration to fetch and stage further payloads. The script names imitate the legitimate csrss and ESET ekrn processes, and their presence in PowerShell activity indicates masqueraded ingress tooling and command execution.

Obfuscated Firewall Deactivation - Modern Command (via process_creation)

This rule detects disabled the Windows Firewall to evade defense.

Suspicious Encoded PowerShell Command Execution (via process_creation)

This rule detects PowerShell invoked with an encoded command payload passed through the EncodedCommand parameter. Adversaries base64-encode PowerShell to obscure their commands from casual inspection and simple content filters. While some administrative tooling encodes commands, encoded PowerShell on user endpoints is a frequent execution and obfuscation indicator worth reviewing.

Malicious DLL Sideloading of screen_retriever_plugin via TCLBANKER Loader

This rule detects the signed logiaipromptbuilder executable loading a screen_retriever_plugin DLL used to sideload the TCLBANKER banking trojan in Elastic research. Abusing a trusted host binary to load an attacker controlled DLL of this name lets the trojan execute under a legitimate process context.

Suspicious Process Injection via mavinject INJECTRUNNING

This rule detects mavinject.exe injecting a DLL into a running process via the INJECTRUNNING flag, a living-off-the-land process injection technique observed in Lancefly intrusions to load the Merdoor backdoor.

Possible Task Manager Access Indicator for Potential LSASS Dump (via process_creation)

This rule detects provides an indicator of a user accessing the task manager in order to eventually dump the LSASS process content using the "Details" tab > right click on "lsass.exe" > Create a dump file.

Suspicious Cloudflare Tunnel Masquerading as conhost.exe During Medusa Operations (via process_creation)

This rule detects a binary named conhost.exe running Cloudflare tunnel arguments, a masquerade Storm-1175 uses by renaming the cloudflared client to conhost.exe to establish covert command and control during Medusa ransomware operations. Legitimate conhost.exe never runs tunnel parameters, so this combination surfaces a disguised tunneling channel used for remote access and exfiltration.