Sigma detection rules, expert-reviewed

Suspicious Command Execution from NTFS Alternate Data Stream via cmd Redirection (via process_creation)

This rule detects cmd.exe reading and executing content from an NTFS alternate data stream attached to a decoy PDF using input redirection. TA397 delivered LNK files that ran a hidden PowerShell stage stored in a PDF ADS such as ~tmp.pdf.

Suspicious Executable Launched from Public Music Folder

This rule detects process execution from the C:\Users\Public\Music directory, a staging path used by RansomHub affiliates to run randomly named ransomware encryptor binaries. Legitimate applications rarely execute from the public Music folder, so execution there is a strong indicator of staged malware.

EtherRAT Node.js Backdoor Execution via Headless Conhost (via process_creation)

This rule detects the EtherRAT backdoor launched through conhost.exe in headless mode running a bundled Node.js payload from the hidden MicrosoftSltt directory, an execution behavior observed in The Gentlemen ransomware intrusions using Ethereum smart-contract C2. Adversaries leverage the signed conhost host to run a Node.js runtime and blend malicious JavaScript execution into normal process activity.

Malicious Veeam Credential Dumping Script Execution

This rule detects execution referencing a PowerShell script named to extract stored Veeam backup credentials which ransomware operators use to obtain privileged accounts. Observed in NCC Group research into active ransomware families pairing Mimikatz with a Veeam credential script. Harvesting backup credentials enables lateral movement and recovery sabotage which makes this a strong credential-access signal.

Malicious BoomBox Run Key Persistence via MicroNativeCacheSvc (via registry_set)

This rule detects creation of a CurrentVersion Run value named MicroNativeCacheSvc or referencing the NativeCacheSvc DLL used by the BoomBox downloader. This autostart entry ensures the malicious NativeCache DLL is relaunched on logon, maintaining persistence for the Nobelium implant.

Suspicious DLL Sideloading via usysdiag.exe Loading sensapi.dll via NailaoLocker (via image_load)

This rule detects the NailaoLoader stage of NailaoLocker ransomware which side loads a malicious sensapi.dll through the legitimate security tool usysdiag.exe to decrypt and run the locker payload. The genuine sensapi.dll ships in System32 so a copy loaded from the usysdiag application directory is anomalous. This pairing indicates the loader.

Suspicious Lateral Movement via PsExec Service (via process_creation)

This rule detects the PsExec service executable running on a host, which indicates remote command execution through the Service Control Manager. Nokoyawa operators use PsExec together with WMI to move laterally and deploy Cobalt Strike and the ransomware across the network. PsExec service activity outside of sanctioned administration is a strong lateral-movement signal.

Malicious UAC Bypass via mscfile Handler Hijack (via registry_set)

This rule detects a command being written under HKCU Classes\mscfile\shell\open\command, the registry hijack eventvwr.exe follows to auto-elevate an attacker process while bypassing UAC. The mscfile handler hijack is a privilege-escalation technique tracked in the Red Canary Threat Detection Report. Detecting this modification surfaces a UAC-bypass preparation.

Suspicious DAEMON Tools Exfiltration Binary Execution via envchk.exe (via process_creation)

This rule detects execution of envchk.exe, a masqueraded utility used by the DAEMON Tools supply chain backdoor to collect and exfiltrate host identifiers such as the MAC address and hostname. The tool transmits reconnaissance data to attacker infrastructure. Detecting this binary surfaces data collection and exfiltration activity.

Suspicious Renamed credwiz Binary Execution via Process Creation

This rule detects execution of the Windows Credential Wizard binary under typosquatted names used by the Russian actor Secret Blizzard to side-load its DUser.dll payload. Renaming the trusted credwiz.exe to cridviz.exe or crezly.exe is a masquerading technique that helps the DLL side-loading chain evade name-based detection.

Suspicious PowerShell Spawning .NET LOLBIN (via process_creation)

This rule detects PowerShell spawning uncommon .NET framework utilities used as living-off-the-land execution proxies. The Veil#Drop loader cascaded through these binaries as fallback execution paths for its payload.

Malicious SYSTEM Registry Hive Dump via reg.exe by Sandworm

This rule detects reg.exe saving the HKLM SYSTEM hive to a file, a credential access step Sandworm uses to obtain secrets for offline extraction. Exporting registry hives is a common precursor to dumping cached secrets and boot keys.

Suspicious Remote Thread Created in notepad Process

This rule detects a remote thread being created inside a notepad process which is the CreateRemoteThread injection step described in the WithSecure Windows lab where shellcode was written into a suspended notepad and executed. Notepad is rarely a legitimate target of cross process thread creation so this pattern is a reliable process injection indicator.

SearchIndexer Suspicious Process Activity (via process_creation)

This rule detects scenarios where SearchIndexer spwaned another process with the same name, or when SearchIndexer process exists in an unexpected directory.

Suspicious SharpShares Network Share Enumeration Tool Execution

This rule detects execution of SharpShares, an offensive tool that enumerates accessible network shares across a domain, matching the discovery stage of the vibe-coded malware intrusion. Operators run SharpShares to map reachable shares before staging and exfiltration. Its execution indicates active share reconnaissance by an intruder.