Sigma detection rules, expert-reviewed

Malicious Impacket WMIExec ADMIN Share Output Redirection

This rule detects the Impacket wmiexec pattern where a command is executed through WMI and its output is redirected to the local ADMIN$ share on 127.0.0.1. The BlackJack group used WMIExec for remote command execution during lateral movement, and this loopback ADMIN$ redirection is characteristic of the tool.

Suspicious SafeBoot RunOnce Persistence for Safe Mode Encryption by RA World

This rule detects registry additions creating a RunOnce entry under the SafeBoot key, a technique the RA World ransomware group uses to force execution after rebooting the host into safe mode where security tooling is inactive. Encrypting in safe mode evades endpoint defenses that do not load there. Detecting this configuration exposes preparation for defense-evasive ransomware execution.

Malicious Salat Stealer Microsoft Defender Disable via Multiple Set-MpPreference Flags (via process_creation)

This rule detects PowerShell invoking Set-MpPreference with the behavior, real-time, or script-scanning disable flags used by the Salat Stealer Rust loader to turn off Microsoft Defender protections before deploying its payload. Adversaries leverage this to blind endpoint protection ahead of credential theft and exfiltration, making early detection critical for stopping the intrusion.

SmartLoader Execution via LuaJIT Interpreter Running Obfuscated Text Script (via process_creation)

This rule detects a renamed LuaJIT interpreter named compiler.exe executing a gc.txt script, the SmartLoader stage delivered through fake AI tools targeting developers. The malware ships lua51.dll and compiler.exe alongside gc.txt so a trusted-looking binary runs an obfuscated Lua payload from a plain text file, making this pairing a reliable loader signal before infostealer retrieval.

Suspicious Larva-24009 Scheduled Task Masquerading as Google Update or Intel Driver (via process_creation)

This rule detects schtasks creation of persistence tasks whose names impersonate legitimate Google update or Intel Ethernet driver tasks as used by the Larva-24009 phishing campaign. Attackers reuse trusted task naming to blend malicious persistence with normal scheduled jobs.

Suspicious Gh0stGambit Run Key Persistence for Phone Executable

This rule detects a Run key value named Phone pointing at a Phone executable being written for persistence. The Gh0stGambit dropper set this autorun entry to relaunch its payload across reboots. Autorun persistence under this specific value and image name maps to the Gh0st RAT deployment chain.

Malicious Event Log Cleared - Native (via security, system)

This rule detects cleared the event logs.

Suspicious Rundll32 Loading DLL From User Desktop

This rule detects rundll32.exe loading a DLL located under a user Desktop directory, a staging pattern seen when LockBit 3.0 payloads were dropped alongside a launcher batch file during hands-on-keyboard intrusions. Legitimate software rarely places and runs DLLs directly from the Desktop. Flagging this location reveals attacker-controlled payloads executed via a trusted signed binary.

Suspicious Outlook Security Manager DLL Load for Mail Harvesting (via image_load)

This rule detects the Grandoreiro banking trojan loading the secman or secman64 Outlook Security Manager component to iterate mailbox folders and harvest addresses for spam propagation. These third-party COM libraries are rarely present on standard endpoints. Their appearance alongside Outlook automation indicates mailbox collection.

Malicious GhostSocks Loader Execution with johnpidar Argument via process_creation

This rule detects process command lines containing the distinctive johnpidar argument. This hardcoded flag is passed to the GhostSocks loader delivered by fake OpenClaw installers, and its presence on a command line is a strong indicator of active infostealer and SOCKS proxy execution on the host.

Malicious rundll32 Loading DLL from WebDAV SSL Share

This rule detects rundll32 loading a DLL from a WebDAV SSL share indicated by the @SSL path token, an intrusion step observed in ACR Stealer delivery chains. Executing a remotely hosted DLL over WebDAV lets the attacker run code without writing the payload to local disk and evades application controls.

Suspicious Scheduled Task Creation Spawned by Microsoft Office

This rule detects a Microsoft Office application spawning schtasks to register a scheduled task which mirrors the Cobalt Kitty initial access chain described by WithSecure where a malicious Word document created a persistence task. An Office document launching schtasks is highly abnormal and typically indicates macro driven persistence or execution following a phishing lure.

Suspicious Forest Blizzard GooseEgg Batch Launcher Chain (via process_creation)

This rule detects execution of the GooseEgg batch launcher files that write and invoke servtask.bat. Forest Blizzard used execute.bat and doit.bat to drop servtask.bat and trigger CVE-2022-38028 privilege escalation.

Suspicious SCMBanker Remote Utilities RMM Install via Silent Msiexec

This rule detects a silent MSI install of the hosts.msi package which SCMBanker uses to deploy the Remote Utilities RMM agent for hands-on-keyboard control during banking fraud. Attackers abuse legitimate remote-management software to evade endpoint controls and maintain interactive access. A quiet install of this specific package indicates unauthorized RMM deployment.

Malicious TELEPUZ ClickFix Stager via Hidden PowerShell Grab Endpoint

This rule detects a hidden execution-policy-bypass PowerShell command that pulls a payload from an index.php grab endpoint which is the ClickFix stager of the TELEPUZ malware-as-a-service delivered through Vidar chains. Victims are lured into pasting the command from a fake verification prompt. The specific grab API path combined with bypass flags marks the malicious download.