Sigma detection rules, expert-reviewed

Suspicious Script Interpreter Command Recorded in Explorer RunMRU History (via registry_set)

This rule detects the Windows Run dialog history under the Explorer RunMRU registry key recording a script-interpreter command such as mshta, powershell, or curl, the residual artifact left when a victim pastes a ClickFix command during this Booking.com themed phishing campaign. Adversaries drive users to run attacker-supplied commands via the Run dialog, so an interpreter invocation captured in RunMRU is a reliable sign of ClickFix-style execution.

Suspicious Python Backdoor Staging in SystemServices Folder (via file_event)

This rule detects creation of a Python script named svc.py inside a SystemServices directory under the local application data path. The DEEP#DOOR campaign staged its Python backdoor and credential stealer at this location.

Suspicious Command Shell Spawned by Service or Remote Execution Parent

This rule detects a command shell spawned by WMI provider host, PsExec, or the SQL Server engine, parent processes that indicate remote or service-based command execution rather than interactive use. These lineages were highlighted as reliable signals of living-off-the-land abuse during lateral movement and post-exploitation. Shells launched from these parents warrant review for hands-on-keyboard activity.

Suspicious Batch File Persistence in Startup Folder

This rule detects creation of the WindowsSecure.bat file inside the Windows Startup folder, the persistence mechanism used by the Snake Python infostealer to survive reboots. Attackers place a batch launcher here so the stealer re-executes at every user logon. A batch file dropped into a Startup directory is a reliable autostart persistence indicator.

Suspicious Copy of Outlook OST Email Data File for Exfiltration

This rule detects copying of an Outlook OST offline data file, a collection step used by the ToddyCat APT before extracting messages with XstExport. The attackers used xcopy to duplicate the .ost mailbox cache to a .ost2 file so its contents could be parsed offline. Copying a locked mailbox data file is a strong indicator of local email collection ahead of exfiltration.

Malicious Local Administrator Account Creation via CherryLoader (via process_creation)

This rule detects creation of a local account named Administrater, a misspelled account name hardcoded in the CherryLoader persistence batch script. The loader created this account and added it to the local administrators group for persistent access.

Malicious Windows Event Log Clearing via PowerShell

This rule detects Windows event log clearing performed through PowerShell log-management methods, an anti-forensic action Qilin ransomware used to wipe event logs during its intrusion. Programmatic clearing of event logs is rarely legitimate and typically indicates an adversary covering tracks.

QBot scheduled task REGSVR32 with C$ image path

Detects the creation of Scheduled Task with REGSVR32 (regsvr32.exe) and C$ in the image path field

Suspicious Cloudflared Tunnel Execution via Renamed svchost Binary

This rule detects a process named svchost.exe running Cloudflare tunnel arguments from outside the System32 directory, matching the renamed cloudflared tunnel used by the RMMProject operators for covert C2 access. Adversaries rename cloudflared to svchost.exe to blend in while establishing an outbound tunnel. A svchost image running tunnel arguments from a non-system path is anomalous and indicates masqueraded tunneling.

Malicious BYOVD ThrottleStop Vulnerable Driver Load (via image_load)

This rule detects loading of the ThrottleStop vulnerable driver including the renamed ThrottleBlood.sys variant used in a Bring Your Own Vulnerable Driver attack to terminate security products. The driver exposes a device that lets an unprivileged process kill protected antivirus and EDR processes such as MsMpEng and SentinelAgent. Loading this kernel driver on a server or workstation with no ThrottleStop application present is highly suspicious.

Suspicious Rclone Configuration File Creation in User Config Directory

This rule detects creation of an Rclone configuration file under a user config directory which stores the cloud remote definitions used for exfiltration. NCC Group observed rclone.conf written under the user profile before data transfer to MEGA. Presence of this artifact indicates staging of an exfiltration channel.

Suspicious Domain Computers Group Enumeration via Net Command (via process_creation)

This rule detects enumeration of the domain computers group using the net command, a discovery step observed during SolarWinds Web Help Desk post-exploitation. Observed in Elastic Security Labs telemetry where net group domain computers /domain maps Active Directory assets to plan lateral movement.

SharpHound Enumeration via SMB Named Pipes (via security)

This rule detects enumerate different host via named pipes with SharpHound for discovery purposes.

Suspicious Microsoft Teams Installer Masquerade via MC Teams Binary (via process_creation)

This rule detects execution of a binary named MC Teams.exe, the signed malware sample Red Canary documented masquerading as a Microsoft Teams installer while carrying a Neural Code Technologies Inc. signer. The legitimate Teams installer does not use this filename, so its execution suggests a freshly signed masquerading binary abusing code-signing trust.

Malicious RDP Session Hijack via Service Creation Abuse (via security)

This rule detects create a service that triggers TSCON in order to preform local RDP session hijack.