Sigma detection rules, expert-reviewed

Suspicious Svchost Executed From Outside System32

This rule detects the svchost.exe image executing from a directory other than the Windows system folders as seen when the persistent actor ran a masqueraded svchost from ProgramData and this matters because the genuine service host always launches from System32 or SysWOW64 so any other path is a reliable masquerading indicator.

Enabling RDP service via reg.exe command execution

Detects the execution of reg.exe and subsequent command line arguments for enabling RDP service on the host

Suspicious WhatsAppBackup Data Staging Archive Creation

This rule detects creation of a WhatsAppData.zip archive inside a WhatsAppBackup directory on the system drive. Silver Fox drops a Python stealer that collects victim data into this fixed staging path before exfiltration. A backup themed archive assembled at this hardcoded location signals collection ahead of data theft.

Malicious TEARPAGE wtsapi32.dll Side-Load via BdeUISrv by UNC2970 (via image_load)

This rule detects the BitLocker helper BdeUISrv.exe loading wtsapi32.dll from outside the System32 directory, the DLL search-order hijack UNC2970 used to side-load the TEARPAGE loader. A signed system binary loading a system-named DLL from an unexpected path is a strong side-loading indicator.

Malicious NotDoor Outlook Macro Auto-Execution Enablement via Registry (via registry_set)

This rule detects registry modifications that make Outlook load a macro provider on boot and lower Outlook macro security, a persistence and defense evasion technique used by the NotDoor backdoor. Legitimate software rarely enables LoadMacroProviderOnBoot together with a relaxed macro security level.

Masquerading Kimsuky Troll Stealer Scheduled Task Deletion of ChromeUpdateTaskMachineUAC via schtasks (via process_creation)

This rule detects deletion of the scheduled task named ChromeUpdateTaskMachineUAC through schtasks, a cleanup behavior the Troll Stealer dropper used by Kimsuky performs to remove a masquerading update task after execution. Removing a disguised task named after a browser updater is an uncommon defense-evasion action tied to this intrusion, making it a useful post-compromise signal.

Malicious Regsvr32 Scriptlet or Remote COM Object Execution (via process_creation)

This rule detects regsvr32.exe registering a scriptlet through scrobj.dll or loading a COM object from a remote URL, the "Squiblydoo" proxy-execution pattern. Regsvr32 is a recurring System Binary Proxy Execution technique in the Red Canary Threat Detection Report, abused to run attacker script code under a signed Microsoft binary while bypassing application allowlisting. Detecting the scrobj and remote-URL invocations flags the evasion.

Suspicious SocGholish Domain User Enumeration via net1

This rule detects enumeration of the domain users group using net1 with the /domain switch. This behavior was observed in SocGholish fake update intrusions during hands-on-keyboard reconnaissance. Attackers use it to map account membership before lateral movement toward victim peers.

Suspicious Command Shell Spawned by WMI Provider Host Targeting ADMIN Share (via process_creation)

This rule detects cmd.exe spawned by the WMI provider host with a command line referencing the ADMIN administrative share, a remote execution pattern Volt Typhoon uses to run commands and stage output over WMI. Combining a WMI parent with administrative share access reflects remote lateral movement rather than routine local scripting, making it a strong signal of interactive intrusion activity.

OpenSSH Server Firewall Configuration on Windows - Command (via process_creation)

This rule detects configure the Windows firewall to allow incoming connections to perform stealthy lateral movement.

VSS Backup Deletion - WMI (via process_creation)

This rule detects delete existing VSS backup.

Suspicious Windows Sandbox Configuration Execution for AsyncRAT via Process Creation

This rule detects WindowsSandbox.exe launched with a .wsb configuration file, the technique MirrorFace uses in Operation AkaiRyu to run AsyncRAT inside Windows Sandbox and evade host-based monitoring. Interactive Windows Sandbox use driven by a dropped .wsb config is uncommon on managed endpoints. This indicates sandbox-based evasion hosting a remote access trojan.

Malicious Khmer Shadow DLL Sideloading via VMwareNamespaceCmd Loading vmtools (via image_load)

This rule detects the signed VMwareNamespaceCmd binary loading a vmtools DLL from outside the trusted VMware install path, the side-loading behavior used to run the Khmer Shadow loader against Cambodian government entities. Adversaries drop a malicious vmtools.dll beside a relocated VMware binary to execute under a trusted process. Loads originating outside Program Files expose the sideloaded implant.

Suspicious PowerShell Masquerading as Windows Terminal via process_creation

This rule detects a process whose original file name is PowerShell but which executes under the wt.exe Windows Terminal file name. The axios supply chain payload renamed powershell.exe to wt.exe to evade name-based detection, so a mismatch between the internal PowerShell identity and a wt.exe image name indicates a masqueraded interpreter.

Suspicious SMB Admin Share Accessed (via security)

This rule detects connect to the administrative SMB share.