Sigma detection rules, expert-reviewed

Suspicious rclone Masquerading as Avast Binary by The Gentlemen RaaS (via process_creation)

This rule detects execution of a binary named avastrclone.exe, the renamed rclone client The Gentlemen operators disguise as an Avast component to blend in while exfiltrating data over cloud storage. The masqueraded name combines a legitimate-looking brand with an untrusted tool. Detecting it exposes covert bulk exfiltration.

Suspicious Edgecution Decryption Key Storage in Edge AppKey Value (via registry_set)

This rule detects creation of a non standard AppKey value under the HKCU Microsoft Edge key where Edgecution stores the hex string used to decrypt strings inside its Python backdoor. The genuine Edge configuration does not use an AppKey value in this location.

Malicious Shadow Copy Deletion via vssadmin Delete Shadows (via process_creation)

This rule detects vssadmin deleting all volume shadow copies quietly, the inhibit-recovery step in the RansomHub intrusion performed alongside log clearing before encryption. Adversaries destroy shadow copies so victims cannot restore files without paying, so this command outside a maintenance window is a strong pre-encryption impact indicator.

Suspicious UAT-8302 Scheduled Task Creation for Recon Tooling

This rule detects schtasks creating tasks named ReconLiteDebug or RunWhatPC, matching the UAT-8302 persistence that schedules its host-profiling and command tooling under recognizable task names. These campaign-specific task names betray the attacker even when the underlying payload is renamed. Presence of either scheduled task indicates UAT-8302 foothold and tasking.

Suspicious Indirect Command Execution via Pcalua for UAC Bypass

This rule detects use of the Program Compatibility Assistant pcalua to indirectly launch a command which the Lazarus chain used to bypass user account control and break parent child process lineage as documented by NCC Group. Attackers proxy execution through pcalua to evade detections that key on direct parent processes.

Suspicious SQL Service Principal Name Enumeration via Setspn

This rule detects setspn.exe querying for SQL related service principal names which the ColunmTK APT41 cluster uses to identify Kerberoastable service accounts. Enumerating MSSQL SPNs precedes requesting and cracking their Kerberos tickets offline. It matters because this reconnaissance directly enables credential compromise of high privilege database accounts.

OCSP Responder Auditing Settings Changed or Disabled (via security)

This rule detects would attempt to alter or disable OCSP responder auditing settings to evade detection and perform further escalation via ADCS vulnerabilities.

Suspicious PowMix Scheduled Task Launching LNK via Explorer

This rule detects creation of a scheduled task that runs explorer.exe against a shortcut file, matching the PowMix botnet persistence that fires a daily task at 11:00 to relaunch its malicious LNK through Explorer. Abusing explorer.exe to open an attacker LNK on a schedule masks the loader chain as ordinary shell activity. This persistence pattern indicates a PowMix foothold on the host.

Suspicious Domain Trust Enumeration via Nltest

This rule detects nltest querying domain trusts or domain controllers, an Active Directory reconnaissance step performed by the Malichus malware after exploiting Cleo file transfer software. Enumerating trusts and controllers helps attackers plan lateral movement across the domain. This discovery activity commonly follows initial access on an exposed server.

Malicious Remote XSL Script Execution via WMIC Squiblytwo Technique

This rule detects WMIC invoking a remote XSL stylesheet via the format switch which is the squiblytwo technique used by the Lazarus chain to execute attacker script content as analysed by NCC Group. Loading a remote XSL through a signed system binary evades application control and downloads code from adversary infrastructure.

Suspicious PsExec Copying Payload To Windows Temp (via process_creation)

This rule detects PsExec running as SYSTEM to copy a payload into the Windows temp directory, a lateral movement and staging pattern used to distribute the Rhysida ransomware. Remote execution that copies binaries into windows temp is characteristic of hands-on ransomware deployment across hosts.

Suspicious DLL Payload Dropped Under Non-Standard Assembly Directory (via file_event)

This rule detects the creation of a DLL under the non-standard C\assembly\tmp staging directory used by the DCOM Upload and Execute backdoor documented by Deep Instinct. The backdoor abuses the DCOM MSI install server to upload and load a managed assembly for remote code execution. Detecting this drop exposes lateral tool transfer before the payload is loaded into a victim process.

Malicious DeceptiveDevelopment Defender Exclusion for Coin Miner via PowerShell

This rule detects PowerShell adding Microsoft Defender exclusions for cryptomining components used by the DeceptiveDevelopment cluster after a ClickFix fake-interview lure. Attackers whitelist TsunamiClient and XMRig paths so the dropped miners run undetected, and matching this behavior surfaces active defense evasion before mining begins.

Suspicious Domain Controller and Trust Enumeration via Nltest

This rule detects nltest enumerating domain controllers or domain trusts which the BlackSuit ransomware actor used to map the environment before lateral movement and this matters because bulk trust and DC listing through nltest is a frequent discovery step in intrusions and stands out against sparse legitimate use on endpoints.

Suspicious COLDRIVER Fileless Payload Storage in Explorer CLSID DefaultIcon (via registry_set)

This rule detects registry writes storing encrypted payload data in the Explorer CLSID DefaultIcon subkey using the EnthusiastMode and QatItems values as done by the COLDRIVER SIMPLEFIX loader. Storing binary blobs in this location is a fileless evasion technique.