Sigma detection rules, expert-reviewed

Masquerading Blank Grabber Payload Decoding via Certutil Decode Flag (via process_creation)

This rule detects certutil being run with its decode flag to convert a base64-encoded file back into an executable payload, the deobfuscation step Blank Grabber uses to reconstruct its loader while masquerading the data as a certificate. Adversaries leverage certutil as a trusted LOLBin to decode staged payloads and evade content controls, making early detection critical for catching the loader before execution.

Malicious Named Pipe REDSUN Created by Nightmare-Eclipse Tooling

This rule detects creation of a named pipe called REDSUN, a hardcoded inter-process channel used by Nightmare-Eclipse tooling observed in a real-world Huntress intrusion. The agent relies on this fixed pipe name for command relay between its components. Because the pipe name is a distinctive tool-specific constant, its presence is a high-confidence indicator of the framework.

Malicious Windows Defender Real-Time Monitoring Disabled via PowerShell

This rule detects use of Set-MpPreference to disable Windows Defender real-time monitoring. In the WithSecure Catching Lazarus research the actor turns off real-time protection before dropping and running further tooling. Attackers disable defensive agents to run payloads without antivirus detection.

Suspicious PowerShell Download From catbox.moe (via process_creation)

This rule detects PowerShell referencing the catbox.moe file-sharing service, abused in the Cascading Shadows campaign to deliver later stages of a multi-step loader chain. Retrieving payloads from this public host lets the attacker stage malware while blending with legitimate file-sharing traffic.

Suspicious Hidden PowerShell Retrieving VBScript from mcdir.me by Millenium RAT (via process_creation)

This rule detects hidden PowerShell fetching a VBScript stager from the mcdir.me delivery host used in the Millenium RAT malware-as-a-service infection chain launched from a malicious LNK. The script downloads and runs the next-stage executable while showing the victim a decoy PDF. Detecting the download cradle interrupts the RAT installation early.

Renamed Computer Account Renamed Without a Trailing $ - CVE-2021-42278/42287 (via security)

This rule detects spoof the SAM account name of a a domain controller in order to impersonate it. Vulnerability comes from that computer accounts should have a trailing $ in their name (i.e. sAMAccountName attribute) but no validation process existed until the patch was released. During the offensive phase, attacker will create and rename the sAMAccountName of a computer account to look like the one of a domain controller. Once the attack is done, attacker will rollback the sAMAccountName to its original name.

Malicious Lazarus DLL Side-Loading of ualapi.dll via spoolsv.exe (via image_load)

This rule detects the Windows Print Spooler process spoolsv.exe loading a ualapi.dll from a directory other than System32. In the Lazarus SIGNBT campaign the actor plants a rogue ualapi.dll that is side-loaded by spoolsv.exe to gain execution and persistence, so a ualapi.dll load from an unusual path indicates print-processor abuse and hijacked system code.

Suspicious DLL Written to Explorer IconCache Path

This rule detects a DLL written to the Explorer icon cache directory using an iconcache prefixed name with a numeric suffix. In Operation ForumTroll a LNK triggered PowerShell chain dropped a payload DLL named iconcache_<4digits>.dll to this location as reported by Kaspersky. Legitimate icon cache files use the .db extension so a .dll in this path is a strong masquerading and payload staging indicator.

Suspicious MSBuild Execution from Writable Directory (via process_creation)

This rule detects MSBuild being launched with a project file located in a user-writable directory such as ProgramData, AppData, Temp or Downloads. Following CVE-2025-31324 exploitation adversaries abuse MSBuild as a trusted developer utility to compile and execute inline payloads, so MSBuild running from a staging directory indicates defense evasion.

Malicious Modification of a Fake Domain Controller SPN - DCshadow (via security)

This rule detects updates the Service Principal Name (SPN) of a fake domain controller account in order to perform DCshadow attack.

Suspicious CherryLoader Execution via Encrypted Stage Arguments (via process_creation)

This rule detects execution of the CherryLoader binary invoked with its encrypted stage-two and privilege-escalation payload file arguments. CherryLoader passed NuxtSharp.Data and Spof.Data as arguments to decrypt and run embedded PrintSpoofer and JuicyPotatoNG modules.

Suspicious Imjp14k DLL Side-Loading From Non-System Path

This rule detects a process loading imjp14k.dll from a path outside the standard Windows System32 directory. APT41 abused DLL side-loading of imjp14k.dll to launch ShadowPad on a compromised Taiwanese network. Side-loading a system-named DLL from a writable non-system directory is a hallmark of hijack execution used to run malicious code under a trusted host process.

Malicious Chisel Tunneling Tool Masquerading as Microsoft Binary (via process_creation)

This rule detects the Chisel tunneling utility renamed to Microsoft-themed filenames such as MsChSoft.exe or MicrosoftExchange32.exe while running with client, server, or reverse forwarding arguments, a tunneling technique used by the Seashell Blizzard subgroup during the BadPilot access operation. Adversaries deploy renamed Chisel to establish persistent encrypted tunnels into compromised networks, and the mismatch between a Microsoft-styled name and tunneling arguments is a strong compromise indicator.

Malicious BRUSHWORM Persistence via Scheduled Task (via process_creation)

This rule detects scheduled task creation using the BRUSHWORM masquerading task names targeting financial services. Observed in Elastic Security Labs analysis where schtasks registers MSGraphics or MSRecorder tasks to persist the paint.exe backdoor and its keylogging component.

Suspicious Run Key Persistence Referencing SharePoint Executable via Registry Set

This rule detects a Run or RunOnce registry value pointing to an executable named SharePoint.exe, a masquerading persistence technique used by the Iranian actor Peach Sandstorm to launch its Tickler malware at logon. The use of a benign-sounding Microsoft product name in an autostart key helps the payload blend in and survive reboots.