Sigma detection rules, expert-reviewed

Suspicious Hidden Encoded PowerShell Launching Node.js Runtime

This rule detects PowerShell invoked with hidden window style and an encoded command that launches node.exe, a loader chain used by the Tsundere Node.js botnet. The malware uses powershell -WindowStyle Hidden -NoLogo -enc to decode and start its Node.js payload out of sight. Combining hidden execution and base64 encoding to bootstrap a Node runtime is a strong indicator of malicious loader activity.

Suspicious Service Registration Loading Vulnerable Driver

This rule detects registry service registration where the ImagePath points to a known vulnerable kernel driver filename which adversaries create to load an exploitable driver into the kernel during bring your own vulnerable driver attacks. Creation of a service that maps to these driver binaries indicates staging of a kernel level defense evasion or privilege escalation capability.

Suspicious tapiperf.dll Load by WMI Provider Host via Image Load

This rule detects wmiprvse.exe loading tapiperf.dll, which the Lunar toolset abuses through DLL replacement to gain execution inside a trusted Windows process. Legitimately tapiperf.dll is a TAPI performance counter library and is not loaded by the WMI provider host. This anomalous load points to DLL hijacking used for stealthy persistence and code execution.

Suspicious Firewall Rule Opening Backdoor Port 49683 via Process Creation

This rule detects a netsh advfirewall command that adds a rule for local port 49683. ToddyCat opens this specific port to expose its passive UDP backdoor (aspnet.exe) for command-and-control, so a firewall rule referencing it indicates attacker setup.

Suspicious Service Creation Masquerading as FortiGateUpdate (via process_creation)

This rule detects sc.exe creating a service named FortiGateUpdate whose binary path launches svchost with a service grouping switch. This behavior was observed in Cyber Partisans activity that masqueraded a DNSCat2 tunneling service as a Fortinet update to blend into industrial environments. Detecting the masqueraded service creation exposes the persistence stage of the intrusion.

Suspicious wscript Execution of Short-Name JavaScript from AppData (via process_creation)

This rule detects GootBot persistence where a scheduled task runs wscript.exe against a second-stage JavaScript file using its short name ending in a tilde-one JS pattern inside an AppData subfolder. Execution of a short-name js from AppData by the script host is characteristic of the GootLoader chain. Legitimate software rarely launches scripts this way.

Obfuscated Firewall Configuration Enumerated - Command (via process_creation)

This rule detects extract current Windows firewall configuration to prepare an attack.

Enable WDigest using PowerShell (ps_module)

Rule to detect registry modifications to enable WDigest using powershell script modules.

Suspicious Hidden Local Account Creation Via Net User

This rule detects creation of a local account whose name ends with a dollar sign using net user with the add flag. DragonRank created a hidden admins$ local account to maintain access on compromised web servers. Appending a trailing dollar sign hides the account from casual net user enumeration making this a stealthy persistence and account-manipulation move.

Suspicious LDAP Enumeration of Certificate Templates (via security)

This rule detects LDAP queries enumerating pKICertificateTemplate objects, an AD CS reconnaissance step used to find misconfigured templates vulnerable to certificate-based privilege escalation. This activity commonly precedes malicious certificate requests observed in Security Events 4886 and 4887.

Suspicious Run Key Persistence via reg add

This rule detects reg.exe writing a value under a CurrentVersion Run or RunOnce key, a common autorun persistence mechanism. Adversaries add these entries so their payload executes automatically at user logon, and living-off-the-land toolkits frequently script this step.

Suspicious VMware and Cortex Binaries Executing From User-Writable Paths

This rule detects processes named after legitimate VMware guest tools or the Palo Alto Cortex updater running from AppData, Temp, or other user-writable directories. Actors in the Africa financial-sector campaign renamed their PoshC2 tooling to vmtoolsd.exe, vm3dservice.exe and CortexUpdater.exe to blend in. Trusted binary names executing from non-standard paths indicate masquerading.

Suspicious Executable Running from PerfLogs Directory

This rule detects execution of a binary from the Windows PerfLogs directory which ransomware operators use as a staging location for tooling. Observed in NCC Group research into active ransomware families dropping a min.exe binary into the PerfLogs directory. Execution from PerfLogs is highly abnormal which makes it a useful indicator of stager or tooling activity.

Suspicious Domain Trust Discovery via Nltest

This rule detects nltest enumerating trusted domains, an Active Directory discovery step used to map trust relationships for lateral movement. This was observed after SonicWall VPN exploitation preceding Akira ransomware. Domain trust enumeration from user context or servers often marks hands-on-keyboard reconnaissance.

Suspicious RunMRU Entry Containing Script Download from ClickFix

This rule detects a RunMRU history value that records a scripted download command such as PowerShell or mshta invoking a remote resource. ClickFix social engineering has the victim paste the command into the Run dialog which leaves the payload in RunMRU before it is cleared. Script interpreters and download utilities in the Run dialog history strongly suggest a ClickFix style delivery.