Sigma detection rules, expert-reviewed

Suspicious Domain Trust Discovery via Nltest

This rule detects nltest enumerating trusted domains, an Active Directory discovery step used to map trust relationships for lateral movement. This was observed after SonicWall VPN exploitation preceding Akira ransomware. Domain trust enumeration from user context or servers often marks hands-on-keyboard reconnaissance.

Suspicious RunMRU Entry Containing Script Download from ClickFix

This rule detects a RunMRU history value that records a scripted download command such as PowerShell or mshta invoking a remote resource. ClickFix social engineering has the victim paste the command into the Run dialog which leaves the payload in RunMRU before it is cleared. Script interpreters and download utilities in the Run dialog history strongly suggest a ClickFix style delivery.

Suspicious Scheduled Task Creation Pointing to AppData (via process_creation)

This rule detects creation of a scheduled task whose action points to an executable inside the user AppData directory. Nokoyawa-linked loaders register an hourly task in AppData Roaming to maintain persistence for IcedID and follow-on tooling. Scheduled tasks launching binaries from AppData are unusual and a common persistence mechanism for commodity loaders.

Malicious Defender Real-Time Monitoring Disable via Registry

This rule detects the DisableRealtimeMonitoring registry value being enabled to turn off Microsoft Defender real-time scanning. This was observed during Cephalus ransomware deployment alongside service stops and exclusions. Disabling real-time monitoring removes on-access detection so the encryptor can run freely.

Suspicious MSHTA Remote HTML Application Execution via Amatera Stealer ClickFix

This rule detects mshta.exe launching an HTML application from a remote URL, the ClickFix delivery step for the Amatera Stealer 4.0.2 variant. The victim is lured into running a copied command that pulls an HTA from attacker infrastructure. Remote mshta execution is a common living-off-the-land loader technique and should be reviewed against expected administrative activity.

Suspicious propsys.dll Sideload via ComputerDefaults UAC Bypass (via image_load)

This rule detects ComputerDefaults.exe loading propsys.dll from outside the Windows system directories, the DLL sideload and UAC bypass the 8220 Gang chains to elevate and continue its cryptomining deployment. The auto-elevating ComputerDefaults binary is abused to load an attacker propsys.dll placed in a writable path. Detecting this non-system load surfaces the UAC bypass and sideloading step.

Malicious Obsidian Spawning Command Interpreter via Shell Commands Plugin

This rule detects the Obsidian note taking application spawning PowerShell, cmd or a shell as abused by the PhantomPulse RAT delivery chain through the Shell Commands plugin in Elastic research. A document editor launching a command interpreter is anomalous and indicates weaponized vault content executing attacker code.

Suspicious Mshta Execution Of Remote HTA

This rule detects mshta.exe executing an HTA hosted at a remote http or https URL. In the WithSecure Initial Access Lab 2 the Koadic stager is delivered as a remote HTA run directly by mshta. Attackers use mshta to fetch and run remote HTML applications as a proxy execution and download technique.

Suspicious Atera Agent Silent Installation via Command Line (via process_creation)

This rule detects silent installation of the Atera RMM agent identified by its IntegratorLogin and CompanyId command-line parameters. Adversaries deploy Atera as an unsanctioned remote access channel using these silent-install arguments, so their presence outside an approved rollout indicates RMM misuse.

Suspicious schtasks Persistence Spawned from PowerShell or Script Chain

This rule detects schtasks creating a scheduled task when launched from a PowerShell or command-shell parent, a persistence step observed in the Suky Castle ClickFix-style campaign where an obfuscated PowerShell to cmd to attrib to schtasks chain established persistence. It captures scheduled-task creation originating from an interactive scripting context rather than an installer. Detecting this is important because attacker-driven schtasks activity typically descends from a script host rather than a legitimate management tool.

Suspicious Access To Chrome Credential Files

This rule detects read access to the Google Chrome Local State, Cookies and Login Data files by a process other than Chrome, captured via a SACL file audit and Security event 4663. In the WithSecure Windows Lab 4 tooling such as Chlonium or Mimikatz reads these files to steal the DPAPI master key and decrypt session cookies and stored passwords. Attackers harvest browser credentials and session tokens for account takeover.

Suspicious PowerShell Execution Referencing an AppData Path

This rule detects powershell.exe executing a command that references a user AppData path, a persistence pattern in which scheduled tasks or autoruns launch PowerShell payloads staged in AppData. This behavior helps hunt for script-based persistence that survives reboots.

Suspicious OpenClaw AI Agent Spawning Command Shell via Process Creation

This rule detects the OpenClaw AI agent binaries openclaw, clawdbot, or moltbot spawning a Unix command shell, the execution pattern that follows a poisoned agent skill being loaded. Adversaries plant malicious skills so the agent runs attacker commands with the user privileges, so an AI agent process launching sh, bash, or zsh is a strong sign of skill-based code execution.

Malicious more_eggs LOLBIN Scriptlet Execution via ie4uinit BaseSettings Abuse (via process_creation)

This rule detects the ie4uinit LOLBIN being run with the -basesettings flag from a user-writable location such as AppData, the first-stage technique in the more_eggs TA4557 resume-lure intrusion where a copied ie4uinit loaded a malicious SCT through a planted ieuinit.inf. Adversaries relocate this signed binary to abuse its inf-driven command execution while evading path-based controls, so an out-of-System32 ie4uinit with -basesettings indicates staged code execution.

Malicious LSASS Memory Dump via comsvcs.dll MiniDump (via process_creation)

This rule detects credential theft where rundll32 invokes the MiniDump export of comsvcs.dll to dump the memory of the LSASS process to disk, a technique observed in Akira ransomware intrusions. The resulting dump is later parsed offline to recover plaintext credentials and hashes.