Sigma detection rules, expert-reviewed

Malicious rundll32 Execution of COLDCOPY DLL via COLDRIVER ClickFix

This rule detects rundll32.exe invoking COLDCOPY DLLs by their known filenames or by the humanCheck and verifyme export names used in COLDRIVER ClickFix lures. Attackers run these exports to launch the YESROBOT and MAYBEROBOT backdoors after tricking a user into pasting a Run dialog command.

Malicious High Risk Local/domain Local Group Membership Change (via security)

This rule detects scenarios where a suspicious group membership is changed. Having Microsoft LAPS installed may trigger false positive events for the builtin administrators group triggered by the system account (S-1-5-18).

Malicious RDP Reconnaissance with Valid Credentials Performed on Multiple Hosts (via security)

This rule detects brutforce RDP services with compromised credentials via tools like Hydra. Note that this event will be reported only with valid user and password credentials, and it may be reported only when RDP session is fully opened (so not during reconnaisance phase) if NLA is disabled. For further correlation, ID 4624/4625 (logon type 3, 7 or 10) should be used.

Suspicious curl Download of nvidiadrivers Archive to Temp (via process_creation)

This rule detects curl retrieving an archive named nvidiadrivers.zip into the user temp directory. The Lazarus ClickFake Interview campaign uses this command to stage its payload while masquerading as a legitimate GPU driver update. The specific archive name written to a temporary path with certificate checks disabled indicates malicious staging.

Suspicious Wscript Execution of File With Media Extension

This rule detects wscript.exe executing a file that carries a media or image extension such as .3gp. LNK-based malware renames script files with deceptive extensions to evade detection while the script host still interprets them. A script host running a supposed media file indicates masquerading and script-based execution.

Suspicious PowerShell Interactive Shell Spawn with Console Output Encoding

This rule detects PowerShell launched with a persistent interactive session that explicitly forces the console output encoding to UTF-8, a pattern used by Sliver C2 implants when spawning an interactive shell channel to the operator. Attackers use this to run hands-on-keyboard commands through the C2 tunnel. Catching this reveals active operator interaction on a compromised host.

Suspicious COM Hijack via CLSID InprocServer32 Pointing to Writable Path (via registry_set)

This rule detects a CLSID InprocServer32 registry value being pointed at a DLL in a user-writable directory such as Temp, AppData or ProgramData. VanHelsing hijacks COM objects by redirecting their server registration to attacker-controlled files, so a CLSID handler in a writable path indicates persistence via COM hijacking.

Malicious Shai-Hulud Bun Payload Execution via npm Preinstall Script (via process_creation)

This rule detects execution of the set_bun.js and bun_environment.js scripts used by the Shai-Hulud 2.0 npm supply chain worm, which are launched from a malicious preinstall entry in package.json to install the Bun runtime and run the worm payload. Adversaries use this staging step to establish execution inside developer and CI environments, so detecting these script invocations exposes a compromised package before credential theft and propagation occur.

Malicious Akira Ransomware Encryptor Execution (via process_creation)

This rule detects execution of the Akira ransomware encryptor invoked with its characteristic path, share and encryption-percentage arguments. Operators launched akira.exe and locker.exe with the -n, -p and -s flags to encrypt local drives and network shares.

Suspicious HTA Execution via Mshta From Shortcut Chain (via process_creation)

This rule detects mshta.exe launching an HTA file which the CoralRaider infection triggers from a malicious LNK to start its multi-stage information stealer chain. Using the trusted mshta LOLBin to run remote or local HTA content is a signed proxy execution technique that evades application controls.

Suspicious PowerShell IEX DownloadString In-Memory Execution via process_creation

This rule detects PowerShell that combines Invoke-Expression with the WebClient DownloadString method to fetch and run remote code entirely in memory. Head Mare and Twelve launched PowerShell with an execution policy bypass and hidden window to download and execute scripts including ADRecon. This fileless download and execute pattern is a common intrusion loader technique.

Suspicious Msiexec Execution with Undocumented -z Flag Proxying DLL (via process_creation)

This rule detects msiexec invoked with the undocumented -z switch, which forces execution of the DllUnregisterServer export of a bundled library. Matanbuchus and DarkGate loaders abused this to proxy malicious DLL execution through a trusted signed binary.

Suspicious Phantom Msfte.dll Load by Search Indexer (via image_load)

This rule detects the Windows Search Indexer loading msfte.dll, a phantom DLL that does not ship with modern Windows and that attackers plant to hijack the indexer search path for stealthy persistence. Because the legitimate file is absent on current systems, a successful load of msfte.dll by SearchIndexer.exe points to a planted malicious library.

Malicious UAC Bypass via SilentCleanup Scheduled Task Trigger

This rule detects schtasks running the built-in SilentCleanup task, the trigger stage of the environment-variable UAC bypass used by NightshadeC2. After hijacking the windir variable the botnet forced SilentCleanup to run so its auto-elevated context executed the attacker payload. On-demand invocation of SilentCleanup via schtasks is a reliable indicator of this UAC bypass.

Suspicious Rclone Remote-Control Daemon For Data Exfiltration

This rule detects rclone launched with the rcd remote-control daemon argument. The MedusaLocker operator used rclone rcd to exfiltrate victim data to cloud storage before deploying ransomware. Rclone running as a remote-control daemon on an endpoint is a strong sign of automated bulk exfiltration to a cloud service.