Sigma detection rules, expert-reviewed

Suspicious MSIEXEC Launching NVIDIA GeForce Experience Named Binary

This rule detects msiexec.exe launching a child process named nvidia geforce experience.exe, the delivery chain observed in the Genesis Market malicious browser extension campaign where an MSI dropped a legitimately named host binary for DLL sideloading. This sequence points to masquerading and side-loaded payload staging.

Suspicious Process Execution from Public User Media Folders via process_creation

This rule detects executables launched directly from the Public Pictures, Music, or Documents folders. This staging location is abused by fake OpenClaw installers delivering GhostSocks to run payloads from world-writable directories that rarely host legitimate executables, helping the operator evade path-based scrutiny.

Suspicious Run Key Persistence Executing Node.js Script via MuddyWater Tsundere Botnet

This rule detects a Run key autostart entry that launches the Node.js interpreter against a JavaScript payload. This behavior is tied to the MuddyWater APT Tsundere botnet which resolves its command and control from an Ethereum smart contract using EtherHiding. Persisting node.exe via the Run key lets the operator survive reboots and maintain WebSocket beaconing.

Suspicious Password-Protected Archive Extraction of Everything64.dll by Elpaco Ransomware

This rule detects 7-Zip command-line extraction of a password-protected archive that deploys the Everything64.dll component. Elpaco ransomware, a Mimic variant, abuses the legitimate Everything search library for fast file enumeration prior to encryption. Password-protected extraction of this specific payload indicates staging of ransomware tooling on the host.

Suspicious Browser Login Data Copied to Temp File via type Command

This rule detects use of the cmd type command to copy a browser Login Data credential store into a temporary file. In SocGholish activity the stolen store was redirected into a rad prefixed tmp file for later DPAPI decryption. Copying the credential database is a precursor to bulk password theft from the endpoint.

Malicious COM Object Hijack Pointing to a User-Writable DLL (via registry_set)

This rule detects a CLSID InprocServer32 default value being pointed at a DLL in a user, temp or public directory, the hallmark of COM hijacking used for stealthy persistence and defense evasion. COM hijacking is a persistence technique profiled in the Red Canary Threat Detection Report. Detecting a COM object redirected to a user-writable payload surfaces a persistence mechanism before it is invoked.

Suspicious High Frequency Scheduled Task Creation via Schtasks

This rule detects creation of a scheduled task configured to run every few minutes which the TorNet backdoor uses to repeatedly relaunch its loader under a randomized task name. Minute interval recurring tasks are unusual for legitimate software and indicate persistence with frequent re execution.

Malicious UNC3944 Microsoft Defender Real-Time Protection Disable via Set-MpPreference (via ps_script)

This rule detects PowerShell invoking Set-MpPreference to disable Microsoft Defender real-time and behavior monitoring protections. UNC3944 disabled endpoint defenses this way to enable follow-on ransomware and tooling deployment after gaining access through SIM-swap and SMS phishing. Turning off real-time protection is a strong pre-encryption defense-evasion signal.

Malicious Windows Native Backup Size Re-configuration (via process_creation)

This rule detects delete existing Windows native backup by reducing the allocated backup storage.

TamperedChef Persistence via PDFEditorUpdater Run Key (via registry_set)

This rule detects the TamperedChef infostealer establishing autostart persistence through a PDFEditorUpdater Run key whose value invokes the PDF Editor binary with its hidden update flag. Adversaries use this key to relaunch the weaponized editor at logon, making detection of the registry write useful for catching persistence before credential theft resumes.

Suspicious SharePoint Webshell File Creation in LAYOUTS Directory via ToolShell (via file_event)

This rule detects creation of known ToolShell webshell and key harvester aspx files inside the SharePoint LAYOUTS directory. These filenames are associated with post exploitation of CVE-2025-53770 and related SharePoint flaws.

Malicious Replication Privileges Granted to Perform DCSync Attack (via security)

This rule detects grants replication privilege to an account to exflitrate Active Directory credentials.

Suspicious TimbreStealer Execution via rundll32 iernonce.dll (via process_creation)

This rule detects rundll32.exe loading iernonce.dll, the module executed via a run-once mechanism by the TimbreStealer information stealer targeting Mexican users. The stealer proxies its execution through rundll32 to evade defenses while collecting browser credentials.

Suspicious Windows Terminal Launching Hidden PowerShell with Execution Bypass (via process_creation)

This rule detects Windows Terminal (wt.exe) launching a hidden PowerShell instance with an execution policy bypass and a script file argument, a chain observed in the North Korea-nexus compromise of the Axios NPM package where a postinstall script dropped and ran a PowerShell payload. Adversaries use this to execute code stealthily while bypassing script controls, which makes it valuable for catching supply-chain-driven execution.

Malicious NetSupport RAT Masquerading as systeminfo.exe

This rule detects a process named systeminfo.exe loading a client32.ini configuration file, which is the EVALUSION NetSupport RAT masquerading as the benign Windows utility. The RAT was delivered inside a JPG-wrapped ZIP and run as systeminfo.exe alongside its client32.ini config. The legitimate systeminfo tool never reads a NetSupport config, so this name-and-context mismatch reveals the RAT.