Sigma detection rules, expert-reviewed

Malicious ThrottleStop Vulnerable Driver Load for Defense Evasion

This rule detects loading of the ThrottleStop.sys driver, a signed but vulnerable component abused to disable or blind endpoint defenses from kernel space. The Gentlemen ransomware brings this driver to terminate security products before encryption. Detecting the driver load surfaces bring-your-own-vulnerable-driver activity used to impair defenses.

Malicious WinRing0 Vulnerable Driver Load for Coin Mining

This rule detects loading of the WinRing0x64.sys driver, a known vulnerable component abused to gain kernel level hardware access. The Vidar and XMRig campaign brings this driver to enable coin mining and to tamper with defenses. Detecting the driver load surfaces bring-your-own-vulnerable-driver activity tied to resource hijacking.

Malicious Axios Supply Chain C2 Beacon Domain (via dns_query)

This rule detects DNS lookups for sfrclak.com, the command and control domain contacted with a POST beacon roughly every 60 seconds by the payload deployed in the Axios supply chain attack. Resolution of this hardcoded C2 domain indicates an active beaconing implant on the host.

Suspicious DNS C2 to Microsoft Typosquat Domain

This rule detects DNS queries for the updatemicfosoft typosquatting domain used as a DNS C2 channel. The Project AK47 toolset linked to the SharePoint attacks tunnels commands over DNS to update.updatemicfosoft using an XOR key. Any resolution of this Microsoft lookalike domain indicates DNS-based command and control.

Possible DarkCloud Geo-IP Lookup to showip.net

This rule detects DNS queries for showip.net, a public IP-geolocation service. The DarkCloud stealer resolves this domain to learn the external IP of a compromised host during reconnaissance. Endpoint processes querying external geo-IP services can indicate malware profiling a victim before data theft.

Windows Registry Modification in Security Center AV Provider Keys (ProductEXE/DisplayName/ReportingExe)

Alerts on registry modifications under Security Center AV Provider keys that update antivirus product fields like ProductEXE and DisplayName.

PowerShell: Defendnot hacktool installation via one-liner fetching dnot.sh

Flags PowerShell one-liners that reference dnot.sh and GitHub/defendnot paths consistent with Defendnot installation.

Windows Security Log: Defendnot scheduled task (defendnot) persistence via --from-autorun

Detects Defendnot persistence by alerting on scheduled task create/update activity for \defendnot with --from-autorun.

Windows reg.exe Registry Tampering of Internal Tool and Explorer Policy Settings (T1112)

Alerts when reg.exe modifies Windows policy settings that disable or restrict internal tools and Explorer/System behavior.

Suspicious PikaBot Autorun Persistence Pointing to AppData Microsoft Dropzone via registry_set

This rule detects PikaBot autorun persistence where a Run key value references an executable planted in the AppData Roaming Microsoft dropzone. PikaBot writes its payload under a Microsoft themed folder and registers it for startup to survive reboots. Legitimate Microsoft software rarely autoruns loose executables directly from this user writable path, making the combination a useful loader persistence heuristic.

Malicious Live Ledger Persistence via Realter HD Audio Run Key via registry_set

This rule detects the Live Ledger crypto wallet stealer establishing autorun persistence through a Run key value named Realter HD Audio, a deliberate misspelling that masquerades as the legitimate Realtek HD Audio component. Live Ledger impersonates Ledger Live to steal cryptocurrency wallet data. The forged audio driver naming is a strong host based indicator of the stealer footholding for reboot survival.

Suspicious Execution Delay via Ping Localhost to Null via process_creation

This rule detects the execution delay trick used by the Spectre Ops stealer where cmd runs ping localhost with a count and redirects output to nul to sleep between stages. This ping based sleep evades sandbox timing and paces the infection chain. While some scripts use ping delays benignly, the localhost count and null redirection combination is a common malware self throttling pattern worth surfacing.

Suspicious Browser Kiosk Mode Forcing Credential Entry via process_creation

This rule detects the Credential Flusher technique that launches a Chromium based browser in fullscreen kiosk mode pointed at a login URL to coerce the victim into re-entering account credentials. The captured passwords are then harvested by an accompanying StealC infostealer delivered through Amadey. The pairing of kiosk mode with an app URL is a deliberate credential prompting behavior rather than normal browsing.

Suspicious Per Minute Scheduled Task Creation via schtasks via process_creation

This rule detects ZharkBot persistence that registers a scheduled task firing every single minute using schtasks with the SC MINUTE and MO 1 arguments. Such aggressive one minute recurrence is atypical of legitimate maintenance tasks and is used by the loader to guarantee frequent re-execution. The high frequency schedule pattern is a reliable behavioral indicator of malicious task based persistence.

Malicious Live Ledger Stealer Execution via Ledger Lives Masquerade via process_creation

This rule detects execution of the Live Ledger stealer disguised as Ledger Lives.exe, a typosquat of the legitimate Ledger Live wallet application. The malware targets cryptocurrency users and exfiltrates wallet material. The near identical process name is intended to blend with the real wallet client and is a reliable signal of the impersonation payload running.