Sigma detection rules, expert-reviewed

Suspicious LocalAccountTokenFilterPolicy Registry Modification

This rule detects modification of the LocalAccountTokenFilterPolicy value, which disables remote UAC filtering so local admin accounts retain full privileges over the network. Play ransomware operators set this to ease lateral movement.

Malicious Kimsuky Run Key Autostart to desktop.ini.bak in Public Folder (via registry_set)

This rule detects a Run key persistence value pointing to a masqueraded desktop.ini.bak file under C:\Users\Public, a technique used by Kimsuky to autostart its VBS/PowerShell keylogger against Japanese targets. The abuse of a system-looking filename in a world-writable public path is intended to blend persistence into normal-looking artifacts.

Suspicious AMSI Bypass via AmsiScanBuffer Patching (via ps_script)

This rule detects PowerShell script blocks that reference AmsiScanBuffer together with VirtualProtect, the combination used to patch the Antimalware Scan Interface in memory. This AMSI bypass technique disables in-memory scanning so obfuscated loaders delivering Agent Tesla and XWorm can execute undetected.

Malicious Chaos Ransomware Ransom Note and Encrypted Extension (via file_event)

This rule detects Chaos C++ ransomware writing the ransom note READ_IT.txt into the AppData folder and appending the .chaos extension to encrypted files. Creation of these artifacts indicates active encryption by the locker. The malware also drops debug logs under the temp folder.

Malicious Ransomware Encryptor Execution with Password Gate (via process_creation)

This rule detects a binary launched with password and no-admin arguments characteristic of the Qilin ransomware encryptor. Operators executed the encryptor with a long password and a no-admin flag to skip UAC prompts during mass encryption.

Suspicious AppLaunch Process Hollowing Target

This rule detects execution of the .NET AppLaunch.exe host outside of legitimate Visual Studio contexts. This behavior matches HeartCrypt which performs process hollowing into AppLaunch.exe and csc.exe to run decrypted payloads under a trusted binary. AppLaunch.exe spawned by unexpected parents is a hollowing indicator used to disguise malicious code as a signed Microsoft process.

Malicious Mimikatz Credential Access Module Invocation

This rule detects command lines invoking Mimikatz credential-access modules such as privilege debug sekurlsa logonPasswords or lsadump sam. The BabyLockerKZ MedusaLocker operator used these Mimikatz modules to dump credentials during pre-encryption operations. Chained privilege debug and LSASS or SAM dumping commands are unambiguous credential-theft activity preceding lateral movement and ransomware.

Suspicious Edge Update Setup Spawning PowerShell via ClearFake

This rule detects a MicrosoftEdgeUpdateSetup lure executable spawning PowerShell. The ClearFake fake-update campaign delivers a spoofed Edge updater that launches PowerShell to fetch and run its next stage, an execution chain that legitimate browser updates do not produce.

ToneShell Backdoor GUID Store SystemRuntimeLag.inc in ProgramData (via file_event)

This rule detects creation of the SystemRuntimeLag.inc file that the Frankenstein ToneShell variant writes under ProgramData to store its per-host victim GUID. This uniquely named artifact is not associated with legitimate software and marks the backdoor recording its infection state.

Suspicious Hidden Account Creation - With Fast Deletion (via security)

This rule detects creates a hidden local account. See also rule "User account creation disguised in a computer account".

Malicious PlugX DLL Side-Loading via LMIGuardianSvc from SamsungDriver Directory (via process_creation)

This rule detects the legitimate LMIGuardianSvc binary executing from a SamsungDriver directory created by Mustang Panda to side-load PlugX. The signed binary search-order loads a malicious LMIGuardianDll from this attacker-controlled path. Running this LogMeIn component from a non-standard user directory is anomalous.

Suspicious PowerShell Execution of Script from Netlogon Share by Cyber Anarchy Squad

This rule detects PowerShell launched with an execution policy bypass to run a script hosted on the domain netlogon share. The Cyber Anarchy Squad uses this technique to distribute and execute tooling such as rm.ps1 across compromised environments. Bypassing execution policy to run a remote logon-share script indicates malicious lateral distribution.

Suspicious Run Key Persistence via Masqueraded svhostss Value by Elpaco Ransomware

This rule detects creation of a Run key value named svhostss which masquerades as the legitimate Windows svchost process. Elpaco ransomware, a Mimic variant, uses this autorun entry to persist across reboots. The deceptive naming combined with an autorun context indicates persistence for a ransomware payload.

Suspicious Java Runtime Executing JAR from User Download or Temp Directory

This rule detects java.exe or javaw.exe running a JAR file from a user download, Temp or AppData path, the execution stage of the Java RAT delivered through HTML smuggling in tax themed phishing. A JRE launching a JAR from a download folder is a common cross platform RAT delivery pattern rather than normal application behavior.

Suspicious Renamed Python Interpreter WinAeroModule via Process Creation

This rule detects execution of a binary named WinAeroModule.exe, a masquerading name GoldenJackal gives to a renamed Python interpreter used to run its collection and exfiltration scripts on air-gapped hosts. The name mimics a Windows Aero theme component to appear benign. This indicates masqueraded interpreter execution supporting espionage tooling.