Sigma detection rules, expert-reviewed

Web Shell Written to ScreenConnect App_Extensions Directory

This rule detects aspx or ashx files written to the ScreenConnect App_Extensions directory, where post-exploitation of the authentication bypass drops server-side web shells for code execution. Huntress observed operators writing extension pages to this root after gaining admin access. Executable web content in this location is not part of normal product operation and signals web shell installation.

Suspicious Windows Service Trigger Configuration via Registry Modification

This rule detects creation or modification of service trigger information under the Services registry hive. Adversaries abuse service triggers to start otherwise disabled or on-demand services such as Remote Registry, WebClient, or EFS without direct start permissions, enabling stealthy persistence and privilege escalation.

Suspicious Run Key Persistence Launching Headless Conhost Node.js on EtherRAT Infection

This rule detects a Run key persistence value that chains conhost.exe with the --headless flag to silently launch the Node.js interpreter. This tradecraft is used by the EtherRAT SYS_INFO module to run its JavaScript backdoor without a visible console window. The headless conhost wrapper hides execution while maintaining autostart command and control.

SwimSnake AutoRecoverDat.dll Execution via rundll32 or regsvr32 (via process_creation)

This rule detects rundll32.exe or regsvr32.exe executing AutoRecoverDat.dll, the module the SwimSnake (Silver Fox) group drops into the user AppData Embarcadero folder to load shellcode and deploy the WinOS backdoor. Adversaries proxy execution of the malicious DLL through trusted signed binaries to evade application controls, making early detection critical for catching the loader before backdoor communication.

Suspicious System Process Name Executing From Non-System Path

This rule detects a process named csrss.exe or dllhost.exe running from a directory other than Windows System32. DCRAT in this campaign masqueraded as csrss.exe and dllhost.exe while executing from user-writable locations. Legitimate csrss and dllhost only run from System32 so execution from another path is a reliable masquerading indicator.

Suspicious PowerShell WebClient DownloadFile with Execution Policy Bypass (via process_creation)

This rule detects PowerShell launched with an execution policy bypass and a hidden window that instantiates Net.WebClient to call DownloadFile. This behavior was observed in the updated MATA campaign against industrial companies to stage additional payloads onto compromised hosts. Detecting this scripted download surfaces the ingress-tool-transfer stage of the intrusion.

Renamed Nimbus Manticore Stager Execution with doit Argument from 2FAGuard Directory (via process_creation)

This rule detects the renamed setup.exe stager executed with the doit argument from the 2FAGuard working directory, the GUI-suppressing invocation Nimbus Manticore uses through its BackupCheck scheduled task to load the native main.dll payload directly. Adversaries leverage this argument to run the implant without the decoy interface, making detection useful for catching the persistence stage of the infection chain.

Masquerading Machine-Like Local Admin Account Creation Ending With Dollar Sign (via process_creation)

This rule detects creation of a local account whose name ends with a dollar sign, a masquerading technique from the Truesec intrusion where operators created admin accounts mimicking machine accounts to blend into directory listings. Adversaries use dollar-suffixed names to hide backdoor accounts, making creation of such an account a focused persistence indicator.

Suspicious PowerShell Download to Public Libraries Folder (via process_creation)

This rule detects PowerShell using Invoke-WebRequest to download payloads into the Public Libraries staging directory. This behavior was observed in the MULTI#STORM campaign delivering Warzone and Quasar RAT payloads.

Malicious Veeam Credential Extraction via sqlcmd (via process_creation)

This rule detects use of sqlcmd to query the VeeamBackup Credentials table directly from the backup database. Akira ransomware operators extracted stored Veeam credentials this way to move laterally and destroy backups before encryption.

Suspicious Recursive icacls Grant of Full Access to Everyone via process_creation

This rule detects icacls granting the Everyone group full control over a directory tree recursively and quietly, a technique used by WannaCry ransomware to keep its dropped files accessible. The /T /C /Q flags silently apply permissions across all subdirectories. While administrators may occasionally adjust permissions this exact combination is strongly associated with malware staging.

Malicious Windows Defender Exclusion of Drive Roots via Add-MpPreference (via process_creation)

This rule detects a PowerShell Add-MpPreference command adding whole drive roots as Windows Defender scan exclusions, an impairment step the 8220 Gang cryptomining campaign runs before dropping miner payloads. Excluding entire drives blinds antivirus across the system. Detecting broad exclusion-path additions surfaces defense evasion that precedes cryptominer deployment.

Suspicious Aimmy Cheat Loader Executing Renamed LuaJIT Launcher via process_creation

This rule detects the trojanized Aimmy game cheat that uses Aimmy.bat to launch AimmyLauncher.exe, a renamed LuaJIT interpreter which executes malicious Lua bytecode. The threat abuses a signed scripting engine to run attacker supplied Lua while posing as a gaming aimbot. Flagging the batch launcher and the renamed interpreter surfaces the living off scripting execution chain before the bytecode payload runs.

Malicious Active Directory Database Backup via wbadmin to Loopback Admin Share (via process_creation)

This rule detects wbadmin backing up the NTDS database and registry hives while including ntds.dit in the target set, the domain credential-theft technique used in the Akira intrusion to copy the directory database via a loopback admin share. Adversaries abuse wbadmin to snapshot ntds.dit and the SYSTEM and SECURITY hives for offline hash extraction, so a wbadmin job referencing ntds.dit is a high-confidence dumping indicator.

Suspicious Font File Passed as Argument to Script Interpreter via Lua Loader (via process_creation)

This rule detects the TTF Trap loader in which a WScript or CScript host launches a bundled Lua or AutoIt interpreter and passes a file with a .ttf extension as the script to execute. Legitimate font files are never executed as interpreter scripts. This masquerade of a loader script as a font is characteristic of the campaign.