Sigma detection rules, expert-reviewed

Malicious APT29 DLL Side-Loading via msoev.exe from Windows Tasks Directory (via process_creation)

This rule detects the signed msoev binary executing from the Windows Tasks directory, the side-loading launcher APT29 used to load the Duke malware in the German Embassy lure campaign. Running this legitimate binary from C:\Windows\Tasks side-loads a malicious Mso DLL from the same folder. Execution of msoev from this path is highly anomalous.

Suspicious EastWind Named Pipe Creation

This rule detects creation of a named pipe whose name starts with the Y prefix used by EastWind implants for inter-process communication and local tasking. Named pipes with this structure support covert component coordination, so their appearance on endpoints should be correlated with the DRM staging activity.

Malicious IIS Native Module Installation via Appcmd IsapiCachesModule (via process_creation)

This rule detects appcmd.exe installing a native IIS module named IsapiCachesModule backed by a caches.dll image as used by the Larva-25003 IIS malware. Registering a malicious native module allows the actor to intercept and manipulate all HTTP traffic on the server.

Suspicious Vulnerable Driver Load for BYOVD Abuse by DragonForce Ransomware (via driver_load)

This rule detects loading of the TrueSight.sys or RentDrv.sys vulnerable drivers that DragonForce abuses in a bring-your-own-vulnerable-driver technique to call ZwTerminateProcess and disable endpoint protection. Attackers exploit these signed drivers to kill security agents from kernel space. Flagging their load exposes tampering with defensive tooling.

Malicious System Crash Behavior Manipulation - WMImplant - Registry (via registry_event)

This rule detects abuses the Windows "system failure and recovery" capacities (CrashControl) to store information or to establish persistence.

Malicious Head Mare Credential Dumping via XenAllPasswordPro

This rule detects execution of XenAllPasswordPro with the -a switch writing to report.html, the credential-recovery tool used by Head Mare to harvest stored passwords into an HTML report. Presence of this dual-use recovery utility in an interactive attack context signals active credential theft.

Malicious IIS Worker Process Spawning Command Shell via process_creation

This rule detects the IIS worker process w3wp.exe spawning a command interpreter, PowerShell or certutil which is a strong indicator of web shell command execution on a compromised web server. Kaspersky observed a Behinder web shell driving w3wp.exe to launch cmd.exe and download follow-on payloads. Web shell to shell transitions are an early sign of hands-on-keyboard server intrusion.

Uncommon Kimsuky OneNote Document Spawning Script Interpreter (via process_creation)

This rule detects Microsoft OneNote launching a scripting or shell interpreter such as wscript, cscript, mshta, cmd or powershell, the execution behavior seen when Kimsuky embeds rows of VBS files inside a .ONE document disguised with a Hangul document icon. OneNote spawning an interpreter is abnormal for legitimate note-taking and is a reliable indicator of embedded-object abuse for initial execution.

Possible CVE-2023-23397 Outlook Forced Authentication via Outbound LDAP (via network_connection)

This rule detects a Windows host initiating an outbound LDAP or Global Catalog connection to a non-private external address, which is anomalous because directory traffic normally stays inside the enterprise. Exploitation of CVE-2023-23397 can direct a client to an external LDAP endpoint as part of the forced authentication chain against Microsoft Outlook. Traffic to an external directory service indicates possible credential coercion or beaconing and warrants investigation.

Suspicious Double Extension PDF Executable via Process Creation

This rule detects execution of a file using a .pdf.exe double extension. The Lumma stealer is distributed with this masquerading trick so the payload appears to be a document while it is in fact an executable, tricking users into launching the stealer.

Suspicious SugarGh0st Persistence via CTFMON Masqueraded Run Key (via registry_set)

This rule detects a Run key persistence entry referencing CTFM0N.exe, a binary named to impersonate the legitimate ctfmon.exe with a zero substituted for the letter O. The SugarGh0st RAT used this masqueraded autorun value to survive reboot.

Suspicious Remote Execution via WMIC Node Process Call Create

This rule detects wmic.exe with the node parameter invoking process call create which the ColunmTK APT41 cluster uses to run install.bat on remote hosts for lateral movement. The technique executes commands against a specified target without dropping a service binary. It is important because remote WMIC execution is a stealthy hands-on-keyboard propagation method.

Suspicious GigaWiper Execution Counter under OneDrive Environment Key

This rule detects writes to the HKCU SOFTWARE OneDrive Environment key which GigaWiper abuses as an execution counter to track its wiping stages. This uncommon registry location under a OneDrive branded path is a distinctive marker of the destructive backdoor tracking its own progress.

Malicious Volume Shadow Copy Deletion via vssadmin by RA World

This rule detects deletion of all volume shadow copies through vssadmin, an inhibit-recovery action the RA World ransomware group performs to prevent victims from restoring encrypted files. Destroying shadow copies is a hallmark of ransomware staging. Detecting this exposes imminent or in-progress encryption impact on the host.

Suspicious Restic Cloud Backup Exfiltration via Renamed winupdate Binary via process_creation

This rule detects the restic backup tool being run, including copies renamed to winupdate.exe, with arguments targeting a Wasabi or S3 object store. The threat actor renamed restic to a Windows-update-like name and used it to back up and exfiltrate victim data to attacker-controlled cloud storage, so this pattern indicates staged bulk exfiltration disguised as backup activity.