Sigma detection rules, expert-reviewed

Suspicious Phantom Msfte.dll Load by Search Indexer (via image_load)

This rule detects the Windows Search Indexer loading msfte.dll, a phantom DLL that does not ship with modern Windows and that attackers plant to hijack the indexer search path for stealthy persistence. Because the legitimate file is absent on current systems, a successful load of msfte.dll by SearchIndexer.exe points to a planted malicious library.

Malicious UAC Bypass via SilentCleanup Scheduled Task Trigger

This rule detects schtasks running the built-in SilentCleanup task, the trigger stage of the environment-variable UAC bypass used by NightshadeC2. After hijacking the windir variable the botnet forced SilentCleanup to run so its auto-elevated context executed the attacker payload. On-demand invocation of SilentCleanup via schtasks is a reliable indicator of this UAC bypass.

Suspicious Rclone Remote-Control Daemon For Data Exfiltration

This rule detects rclone launched with the rcd remote-control daemon argument. The MedusaLocker operator used rclone rcd to exfiltrate victim data to cloud storage before deploying ransomware. Rclone running as a remote-control daemon on an endpoint is a strong sign of automated bulk exfiltration to a cloud service.

Malicious Command Shell Spawned by SQL Server via xp_cmdshell

This rule detects the SQL Server process sqlservr.exe spawning a command shell, indicative of xp_cmdshell abuse. Estate Ransomware operators enabled xp_cmdshell on a Veeam-linked MSSQL instance to run operating system commands. Command execution from the database engine signals exploitation of the SQL layer.

Suspicious msiexec Installation From Non-Standard Path

This rule detects msiexec.exe installing an MSI package from a user writable or remote location such as AppData, Temp, ProgramData or an HTTP URL, an execution-proxy technique used by the Handala group to run malicious installers from untrusted paths. Legitimate installers usually run from trusted staging or download folders rather than these locations. Combined with other indicators this points to attacker-driven payload deployment.

Suspicious AS-REP Roasting LDAP Search Filter for DONT_REQ_PREAUTH Accounts

This rule detects Directory Service search event 1644 carrying an LDAP filter that uses the bitwise OID to select accounts with the DONT_REQUIRE_PREAUTH flag set, matching Impacket GetNPUsers enumeration for AS-REP roasting. Adversaries query these accounts to request roastable tickets crackable offline. This precise bitwise filter is rarely produced by legitimate directory tooling.

Malicious NOOPDOOR Registry Persistence under Software License Key (via registry_set)

This rule detects creation of registry values under Software\License with a hex-named subkey, the storage location used by the NOOPDOOR backdoor deployed by MirrorFace against Japanese organizations. The implant hides encoded configuration and payload data in this uncommon path to survive reboots and blend with legitimate keys.

Suspicious node.exe or code.exe Execution from Public Music Directory

This rule detects node.exe or code.exe running from the C:\Users\Public\Music directory, where ChaosBot staged a FRP tunneling client and a downloaded VS Code binary. Legitimate Node.js and VS Code do not execute from a Public media folder, so this path indicates staged tooling for tunneling and command execution. The wrong-path execution of dual-use binaries reveals attacker infrastructure on the host.

Malicious Command Shell Spawned by Wing FTP Server Process

This rule detects the Wing FTP server process WFTPServer.exe spawning cmd.exe or powershell.exe, the remote code execution chain Huntress observed during in-the-wild exploitation of CVE-2025-47812. Attackers abuse a null-byte and Lua injection flaw to run arbitrary commands as the FTP service. A command shell parented by the FTP server is rarely legitimate and is a high-confidence exploitation indicator.

Suspicious NetSupport Client Execution via Scheduled Task

This rule detects execution of the NetSupport remote control client client32.exe spawned by the Windows task scheduler, observed in a Huntress ClickFix CastleLoader campaign that established persistence through a scheduled task. NetSupport is frequently abused as a covert remote access tool after loader execution. Launch of client32.exe from the scheduler service indicates attacker-installed remote access persistence.

Suspicious Executable Launched from SYSVOL Share

This rule detects an executable running directly from a domain SYSVOL path. The Twelve and BlackJack groups deployed payloads such as letsgo.exe through Group Policy scripts hosted on SYSVOL to distribute malware across the domain, so an EXE executing from SYSVOL warrants review.

Malicious PowerShell Download From Storjshare With UAC Elevation via OXLoader

This rule detects PowerShell downloading a payload from the storjshare distribution service and relaunching it with RunAs to trigger UAC elevation as used by the OXLoader loader delivering CASTLESTEALER in Elastic research. Combining a remote fetch with an elevation prompt indicates the loader staging its next component with administrative rights.

Suspicious PowerShell ReadAllBytes and Expand-Archive Payload Staging (via process_creation)

This rule detects PowerShell reading raw bytes from a dropped file and expanding an archive in the same command, a loader chain launched from a malicious LNK in the SmugX campaign delivering PlugX. Chaining ReadAllBytes with Expand-Archive is characteristic of staged payload extraction rather than normal scripting.

In-Memory Offensive PowerShell Tooling Cmdlet Usage (via process_creation)

This rule detects command lines that reference offensive PowerShell tradecraft such as Invoke-Mimikatz, PowerView, Invoke-Kerberoast or Get-Keystrokes, revealing use of red-team frameworks for credential access, discovery and post-exploitation. Weaponized PowerShell is the most prevalent technique in the Red Canary Threat Detection Report, and these function names are strong indicators of adversary tooling loaded in memory. Detecting the cmdlet names surfaces the activity even when the payload is fileless.

Suspicious Run Key Referencing Alternate Data Stream Payload

This rule detects an autorun value whose data references an alternate data stream on the user profile. Gamaredon hides GammaPhish payloads in named streams such as USERPROFILE GTR and points a Run entry at them for stealthy persistence. Autorun values pointing into alternate data streams are a strong sign of hidden payload persistence.