Sigma detection rules, expert-reviewed

CMSTP UAC Bypass via Automatic Install Flag (via process_creation)

This rule detects cmstp.exe invoked with the /au automatic-install flag, the User Account Control bypass used by the Caminho loader in the PureRAT chain to run an INF-defined command with elevated privileges. Adversaries leverage CMSTP as a trusted binary to silently elevate and execute payloads, making detection of this rarely legitimate flag critical for catching privilege escalation before process hollowing.

Suspicious Scheduled Task Masquerading as EdgeUpdateHelper via process_creation

This rule detects schtasks.exe creating a scheduled task named EdgeUpdateHelper. GhostSocks operators use this Edge-updater-themed task name to blend malicious persistence with legitimate Microsoft Edge update tasks, keeping the infostealer running while evading casual review of scheduled tasks.

Malicious C2 Configuration Stored in Registry via TitanPlus Key (via registry_set)

This rule detects the creation of the TitanPlus registry key used by the STAC5777 threat cluster to store a list of command and control IP addresses and ports read by a sideloaded malicious DLL. The activity followed Microsoft Teams vishing and Quick Assist abuse and provides resilient C2 configuration storage.

Malicious Member Added to DNSadmin Group (via security)

This rule detects scenarios where a suspicious change is done on DNSadmin group in order to abuse DNSadmin privileges for DLL load.

Suspicious Deletion of a Scheduled Task to Cover Tracks (via process_creation)

This rule detects schtasks being used to force-delete a scheduled task, a cleanup step attackers take to remove an execution or persistence artifact after it has served its purpose. Scheduled-task deletion is an indicator-removal technique noted in the Red Canary Threat Detection Report. Detecting the deletion surfaces anti-forensic activity around task-based execution.

Suspicious Chained Host Reconnaissance One-Liner via DenoGate Backdoor

This rule detects a single cmd.exe command chaining ipconfig, route print, and tasklist to profile the network and running processes. The DenoGate backdoor runs this reconnaissance one-liner shortly after gaining access to map the victim environment. Bundling several enumeration commands into one line is uncommon for administrators and signals automated triage by an implant.

Suspicious DNS Query to HTML Smuggling AiTM Phishing Domain

This rule detects DNS resolution of the rnsnno phishing infrastructure hosted under the .pro top-level domain that was used in an HTML smuggling adversary-in-the-middle campaign. Victims delivering credentials to these domains had their Microsoft 365 sessions relayed and stolen. Resolution of this infrastructure indicates a user has interacted with the phishing lure.

Suspicious Run Key Persistence Masquerading as Edge Updater

This rule detects a Run key named EdgeUpdater whose value points into the user AppData directory. The Blitz malware creates this entry to masquerade as a legitimate Microsoft Edge updater while referencing a payload in a user-writable location. The mismatch between a trusted name and an untrusted path indicates masquerading persistence.

Suspicious PowerShell Locating and Running MSBuild Project (via process_creation)

This rule detects a PowerShell one-liner that recursively searches for msbuild.exe and downloads a project file into ProgramData for execution. This ClickFix style command was observed in the PHALT#BLYX campaign.

Malicious COM Object Hijack Pointing to IconCache DLL

This rule detects a COM object InProcServer32 registration whose default value references an iconcache prefixed DLL in the Explorer directory. Operation ForumTroll established persistence via a COM hijack under HKCR CLSID InProcServer32 pointing at its payload DLL as documented by Kaspersky. This combination of a COM handler mapped to a masquerading DLL path indicates stealthy persistence and defense evasion.

TAG-144 Dynamic DNS C2 Resolution via Structured DuckDNS Subdomain (via dns_query)

This rule detects DNS resolution of TAG-144 command-and-control hosts using the campaign envio dynamic-DNS naming scheme on duckdns.org, matching the structured envio prefix with a short numeric suffix. Adversaries leverage dynamic DNS to rotate resilient C2 endpoints, making the specific subdomain pattern a useful command-and-control indicator.

Suspicious WScript Executing VBScript from Masqueraded File Extension

This rule detects wscript.exe running a VBScript engine against files with non-script extensions such as drv, regtrans-ms or ntuser.dat, an execution and masquerading technique used by Shuckworm to hide its GammaSteel loader.

Masquerading Firewall Allow Rule Masquerading as Windows Defender Update Service via Netsh (via process_creation)

This rule detects netsh adding an advfirewall rule named to impersonate a Windows Defender update service, a defense-evasion step in the Salat Stealer chain that whitelists its own network traffic. Adversaries leverage a benign-looking firewall rule name to allow C2 and exfiltration traffic while blending into legitimate configuration, so this behavior warrants review alongside surrounding activity.

Web Server Worker Process Spawning Command Interpreter

This rule detects the IIS worker process w3wp.exe spawning command shells or administrative utilities, behavior consistent with the China Chopper web shell used in Operation Soft Cell against telecommunications providers. A web server worker launching cmd, wmic or PowerShell strongly indicates web shell command execution.

Malicious Akira Ransomware Encryption Execution (via process_creation)

This rule detects the Akira ransomware encryptor invoked with its characteristic path and share targeting switches. These combined command-line flags drive selective encryption across local and network locations. Detection here indicates active encryption and imminent impact on the environment.