Sigma detection rules, expert-reviewed

Suspicious EastWind Implant Execution from ProgramData DRM Directory

This rule detects execution of a process from the C\ProgramData\Microsoft\DRM directory, a staging path used by the EastWind campaign for DLL sideloading and implant hosting. Legitimate DRM components do not run from this location, so process execution here signals attacker payload deployment and warrants investigation.

Suspicious CasPol Execution Spawned by PowerShell for Injection

This rule detects the .NET CasPol.exe utility being launched by PowerShell, a system binary proxy execution chain used by the XWorm LATAM campaign to hollow CasPol and host the RAT payload. CasPol is seldom executed interactively, and a PowerShell parent is highly suspicious.

Suspicious Massive Remote Schedule Task Creation via Named Pipes - CrackMapExec with ATexec (via security)

This rule detects remotely creates a scheduled task on multiple hosts over named pipes to execute commands or elevate privileges.

Malicious Named Pipe kesknq for Token Impersonation (via pipe_created)

This rule detects creation of the named pipe kesknq used for privilege escalation and token impersonation in an Apache ActiveMQ exploitation leading to LockBit. The specific pipe name was reused across the getsystem routine and a service of the same name. Named pipe impersonation lets the operator elevate from a service context to SYSTEM.

Suspicious Edgecution Malicious Extension Load via Headless Edge (via process_creation)

This rule detects Microsoft Edge being launched with a load-extension argument together with headless mode and a Recovery user data directory as used by Edgecution to run its malicious browser extension backdoor. Legitimate Edge sessions do not side load unpacked extensions in headless mode.

Malicious BlackCat Boot Configuration Change to Safe Mode with Networking via bcdedit (via process_creation)

This rule detects bcdedit being used to force the system to boot into Safe Mode with networking, a pre-ransomware defense-evasion step observed in the Nitrogen campaign before BlackCat encryption. Adversaries reboot endpoints into Safe Mode so that most security agents do not load while the ransomware still reaches network shares, making this a high-value early indicator of imminent encryption.

Suspicious WinRAR Silent Archive Staging

This rule detects WinRAR invoked with the specific silent recursion and monitoring flag combination used to stage data for exfiltration. This behavior matches Akira operators who archive victim files quietly prior to theft. This distinctive flag set is uncommon in normal usage and indicates automated collection of files before ransomware exfiltration.

Suspicious Staged Payload Execution from User Downloads or Pictures Folder

This rule detects execution of attacker-staged binaries with names such as FunnyApp.exe, RedSun.exe, or z.exe from user Downloads or Pictures folders. These payloads were staged during a Huntress-investigated intrusion following VPN access and used to advance the attack, including bring-your-own-vulnerable-driver activity. Execution of these specific filenames from staging directories indicates deployment of hands-on-keyboard tooling.

Malicious NotDoor Outlook VBA Persistence via VbaProject.OTM Deployment (via process_creation)

This rule detects command lines that copy a staging file into the Outlook VbaProject.OTM macro container used by the NotDoor backdoor for persistence. Overwriting VbaProject.OTM lets attacker VBA code execute on Outlook startup and mail events.

Malicious Shell Spawned by Windows Script Host (via process_creation)

This rule detects wscript or cscript spawning PowerShell, cmd or another script host, the staging behavior Gootloader and SocGholish use when a first-stage JScript file launches a second stage. A script host launching a shell is an execution technique tracked in the Red Canary Threat Detection Report. Detecting this parent-child pair surfaces script-based malware progressing to its next stage.

Suspicious Windows Defender Exclusion for PowerShell via Add-MpPreference (via process_creation)

This rule detects the AsyncRAT loader disabling Microsoft Defender coverage by adding process and path exclusions through Add-MpPreference. The campaign excludes the entire C drive and the powershell.exe process to protect its staged payloads. Adding a scripting host as a Defender exclusion is rarely legitimate.

Suspicious Renamed Pythonw Interpreter Execution via XWorm Loader (via process_creation)

This rule detects execution of the pythonw interpreter that has been renamed away from its original filename, a masquerading technique used by an XWorm loader that ships pythonw as pw.exe to run obfuscated Python payloads.

Malicious QEMU Covert Network Tunnel via User-Mode netdev Socket (via process_creation)

This rule detects qemu-system emulator processes started with a user-mode network device that connects to a remote socket while running headless. Actors abuse QEMU by launching it with -netdev user socket connect to a remote host and -nographic to build a covert tunnel out of an environment, so this command line indicates network tunneling through a legitimate virtualization binary rather than normal VM use.

Suspicious AutoIt Execution from PIF File Masquerade

This rule detects an AutoIt interpreter running with a pif extension image such as Flour.pif from a user writable location. This masquerade delivered an RC4 decrypted Vidar Stealer payload in the KMSPico drive-by chain. Renaming the AutoIt engine to a pif hides script based execution from casual review.

Suspicious China Chopper Web Shell in Temporary ASP.NET Files

This rule detects compiled App_Web assemblies written into the Temporary ASP.NET Files directory, the artifact left when Tropic Trooper's China Chopper web shell embedded in an Umbraco page is compiled by IIS. While ASP.NET compiles legitimate pages here too, unexpected App_Web DLLs on a static or CMS server warrant review for web shell activity.