Sigma detection rules, expert-reviewed

Malicious CatB Ransomware Oci.dll Hijack via Msdtc (via image_load)

This rule detects the Microsoft Distributed Transaction Coordinator service loading an oci.dll, the phantom DLL hijack CatB ransomware abuses by planting its payload in System32 where msdtc.exe searches for the absent Oracle Call Interface library. Windows ships no oci.dll by default, so this load reliably indicates the CatB persistence and execution mechanism rather than a genuine Oracle dependency.

Malicious SentinelOne DLL Sideloading via SentinelUI (via image_load)

This rule detects the SentinelUI executable loading a SentinelAgentCore.dll from a location outside the legitimate SentinelOne installation directory, the DLL search order hijack used by actors exploiting the ConnectWise ScreenConnect flaws to deploy Cobalt Strike and LockBit. Sideloading through a trusted security agent name lets the payload execute with reduced suspicion, so an off path load of this pairing indicates active post exploitation.

Malicious Gelsemium OwlProxy wmipd DLL Load via image_load

This rule detects the load of wmipd.dll which is the OwlProxy backdoor registered as a service masquerading as a WMI Provider. The suspected Gelsemium activity against a Southeast Asian government installed OwlProxy for proxying and persistence, and the impostor module name is a strong indicator of the malicious service DLL.

Malicious Turla TinyTurla w64time DLL Load via image_load

This rule detects the load of w64time.dll which is the TinyTurla backdoor payload masquerading as the legitimate Windows Time service module. Turla (Pensive Ursa) registers a malicious service named Windows Time Service that loads this DLL from system32 for stealthy persistence, and the impostor module name is a strong indicator of compromise.

Suspicious Infostealer Log Artifacts Written to Disk (via file_event)

This rule detects creation of the log artifacts victim_logs.txt and opsec.log written by AI-assisted malware samples analyzed by Unit 42, including a .NET infostealer and a Golang Sliver dropper. These operator log files record collected victim data and dropper activity, so their presence indicates malware staging harvested information locally.

Suspicious Storage Service Driver Masquerade swprv Typosquat (via file_event)

This rule detects creation of driver files swrpv.sys and swprv32.sys that typosquat the legitimate Windows Shadow Copy provider swprv, a masquerade used in a suspected China-based espionage operation against military targets. These misspelled driver names impersonate a trusted system component to blend malicious kernel or service components into the environment.

Suspicious Active Directory Reconnaissance Output via ADRecon CSV (via file_event)

This rule detects creation of the ADRecon output file ComputerSPNs.csv, an artifact generated when Muddled Libra enumerates Active Directory service principal names during discovery. The CSV captures SPN data that enables Kerberoasting and lateral-movement targeting.

Malicious VVS Discord Stealer Script Drop via injection-obf.js (via file_event)

This rule detects the injection-obf.js payload being written into a Discord application directory, the client-injection component of the Pyarmor-obfuscated VVS Discord stealer. The dropped script hooks the Discord client to harvest tokens and DPAPI-protected credentials for webhook exfiltration.

Malicious Ransomware Encryption Extension x2anylock

This rule detects files being created or renamed with the .x2anylock extension. The ransomware deployed in the Project AK47 campaign appends this extension to encrypted files. Mass creation of .x2anylock files is a definitive indicator of active ransomware encryption.

Malicious Mimikatz Credential Dump Log File Creation (via file_event)

This rule detects creation of the KB0722.log file in the Windows temp directory, the hardcoded output log that Mimikatz wrote when Jumpy Pisces dumped LSASS credentials during their Play ransomware intrusion. This fixed log path indicates credential theft from process memory.

Malicious ManagementMailboxPicker Webshell Written by Diplomatic Specter

This rule detects the creation of the ManagementMailboxPicker.aspx webshell used by the Operation Diplomatic Specter campaign to maintain access to compromised Exchange and web servers. The webshell provides persistent remote command execution and staging for mailbox theft. Detecting its file creation exposes server-side persistence and hands-on access by the espionage actor.

Malicious Glupteba UEFI Bootkit EfiGuard Driver Drop to ESP (via file_event)

This rule detects the creation of the EfiGuardDxe.efi driver, a component the Glupteba bootkit writes to the EFI System Partition to disable driver signature enforcement and PatchGuard. Persisting below the operating system through a UEFI bootkit gives Glupteba stealthy survival across reinstalls, so any drop of this driver signals a serious firmware level compromise.

Suspicious BeaverTail Payload Drop of store.node and Hidden Loaders

This rule detects creation of the BeaverTail dropped artifacts store.node and hidden .pyp or .npl loaders in the user profile, matching the North Korean job-hunter campaigns reported by Unit 42. These filenames staged in the profile root and dotted directories are markers of the BeaverTail infostealer and InvisibleFerret chain which precedes credential theft.

Malicious MOVEit human2 Webshell File Creation via file_event

This rule detects creation of the human2.aspx web shell dropped into the MOVEit Transfer wwwroot after exploitation of the CVE-2023-34362 SQL injection chain. This artifact gives the attacker web-accessible command and data-theft capability on the MOVEit host and its presence is a reliable sign of active exploitation.

Malicious ThrottleStop Vulnerable Driver Load for Defense Evasion

This rule detects loading of the ThrottleStop.sys driver, a signed but vulnerable component abused to disable or blind endpoint defenses from kernel space. The Gentlemen ransomware brings this driver to terminate security products before encryption. Detecting the driver load surfaces bring-your-own-vulnerable-driver activity used to impair defenses.