Sigma detection rules, expert-reviewed

Suspicious VOLTZITE Single-Character Named ZIP Exfil Staging (via file_event)

This rule detects creation of ZIP archives whose file name is a single letter or digit, a staging convention observed in VOLTZITE intrusions. The group compresses collected data into minimally named archives to blend into disk activity before exfiltration. Detecting these staging files provides an opportunity to interrupt data theft prior to transfer.

Malicious regsvr32.exe Spawned by calc.exe via DLL Side-Loading

This rule detects regsvr32.exe launched with the Windows Calculator calc.exe as its parent process. During Qbot infections the side-loaded calc.exe uses regsvr32 to register and execute the trojan payload DLL. Calculator legitimately never spawns regsvr32, so this parent-child chain is a strong indicator of DLL side-loading and proxied code execution.

Malicious LSASS Credential Dump via comsvcs.dll MiniDump by APT28 (via process_creation)

This rule detects use of rundll32 to invoke the MiniDump export of comsvcs.dll against the LSASS process, the credential-access technique documented in CERT-FR analysis of the APT28 intrusion set targeting French entities. Adversaries leverage this signed LOLBin to capture a memory dump containing plaintext and hashed credentials, making early detection critical for stopping privilege escalation and lateral movement.

In-Memory MSBuild Proxy Execution of a Project From a User-Writable Path (via process_creation)

This rule detects MSBuild.exe building an inline-task project file located in a user, temp or AppData directory, a pattern adversaries use to compile and run C# payloads in memory under a signed Microsoft developer utility. MSBuild proxy execution is a trusted-developer-utility abuse technique in the Red Canary Threat Detection Report. Detecting builds sourced from user-writable paths surfaces code execution that evades application allowlisting.

Malicious Recovery Inhibition via Shadow Copy and WinRE Tampering

This rule detects command lines that delete Volume Shadow Copies with vssadmin or disable the Windows Recovery Environment with reagentc, actions used by NOVABLIGHT to prevent system and file recovery. Inhibiting recovery is a common precursor to destructive or extortion activity.

Suspicious Disk Image File Written by a Browser or Mail Client (via file_event)

This rule detects a browser or email client writing an ISO, IMG or VHD disk-image file to disk, the delivery half of an HTML-smuggling campaign that packages a payload inside a container to bypass Mark-of-the-Web and mail-attachment controls. HTML smuggling and container-file delivery are recurring initial-access techniques in the Red Canary Threat Detection Report. Detecting image files dropped by internet-facing apps surfaces smuggled payloads before they are mounted and run.

Suspicious Batch Script Unhiding Files via Attrib From Temp

This rule detects a batch script spawning attrib.exe to clear hidden and system attributes, a staging step used by Zhong Stealer to reveal and execute dropped components. Clearing attributes on files via a randomly named batch is uncommon in benign activity.

Suspicious Windows Defender Exclusion Added via PowerShell (via process_creation)

This rule detects PowerShell adding a Microsoft Defender exclusion via Add-MpPreference. The SonicCrypt crypter behind TA585 MonsterV2 deliveries added its payload to Defender exclusions to evade scanning.

Malicious Microsoft Defender Default Action Changed to Allow Any Threat - PowerShell (via powershell)

This rule detects change Defender default action to allow any threats.

Suspicious Ahnenblatt Application Execution From User-Writable Directory

This rule detects the legitimate Ahnenblatt genealogy application Ahnenblatt4.exe running from a Temp or AppData directory. In the RenEngine campaign this signed application was abused as a DLL side-loading host by dropping it next to malicious borlndmm.dll and cc32290mt.dll to launch HijackLoader as reported by Kaspersky. Execution of this uncommon application from a user-writable path signals a DLL search-order hijack rather than normal use.

WWLIB DLL Sideloading via WinWord Outside Office Directory in KamiKakaBot Chain (via image_load)

This rule detects WinWord.exe loading WWLIB.dll from a path outside the legitimate Microsoft Office installation directory, the DLL sideloading pair used by KamiKakaBot when a masqueraded Office binary is executed from an ISO or temporary folder. Adversaries leverage this sideload to run malicious code under a trusted Office process, making detection valuable for catching the initial execution stage.

Suspicious Local Account Creation via Net User

This rule detects local account creation using the net user add command which the REF0657 actors used to add a helpdesk account through a malicious service for persistent access. Interactive account creation may be legitimate for administrators so this activity should be corroborated with the creating context.

Windows Process Creation: curl.exe Using NTLM with Empty Username (-u :)

Alerts when curl is run on Windows with --ntlm and empty -u : credentials, a pattern that may leak the current user's NTLMv2 response.

Malicious Event Log Tampering via wevtutil Channel Disable by FunkSec Ransomware (via process_creation)

This rule detects use of wevtutil to disable the Security and Application event log channels, a defense-evasion action performed by FunkSec ransomware to blind logging before encryption. Adversaries turn off event channels so their tampering, service termination and encryption activity is not recorded for responders.

Obfuscated Fickle Stealer Injection Path Store prepares.dat Under Public (via file_event)

This rule detects creation of prepares.dat in the public users directory, the file where Fickle Stealer stores base64-encoded paths of injected components for its multi-stage execution. Adversaries leverage this world-writable location to persist loader state, making detection of the fixed filename and path a useful indicator of an active Fickle infection.