Sigma detection rules, expert-reviewed

Malicious LSASS Memory Dump via comsvcs.dll MiniDump (via process_creation)

This rule detects credential theft where rundll32 invokes the MiniDump export of comsvcs.dll to dump the memory of the LSASS process to disk, a technique observed in Akira ransomware intrusions. The resulting dump is later parsed offline to recover plaintext credentials and hashes.

Malicious Windows Defender Service Disable via sc.exe by Nova Ransomware

This rule detects sc.exe being used to disable the WinDefend service by setting its start type to disabled, a defense evasion step performed by Nova ransomware before encryption. Disabling the Defender service removes real-time protection from the host.

Coin Miner Masquerading as Misspelled svchost Process

This rule detects execution of processes named svhost.exe or svshost.exe, misspelled variants of the legitimate Windows svchost.exe. The GPU miner campaign ran its cryptomining payload under these typosquatted names to masquerade as a trusted system process. Any process using these near-identical names is almost certainly a masquerade attempt.

Malicious Shai-Hulud Data Exfiltration Script Execution via Process Creation

This rule detects execution of the .dev-env/config.sh helper script through bash, the staging and exfiltration routine dropped by the Shai-Hulud worm. The script bundles harvested secrets and pushes them to attacker infrastructure, so its execution indicates active collection and exfiltration on a compromised developer or build host.

Malicious BitLocker Encryption With Shadow Copy Removal via manage-bde (via process_creation)

This rule detects manage-bde being used to turn on BitLocker encryption while removing volume shadow copies in a single operation. This tradecraft is used to weaponise the built-in BitLocker feature for ransomware encryption while destroying recovery data. Encrypting volumes and deleting shadow copies denies access to systems and inhibits restoration to extort the victim.

Suspicious Lock Screen Image Path Modification via Registry

This rule detects modification of the Windows lock screen image path registry value, a personalization change Qilin ransomware applied to display its ransom messaging. While policy tooling can set this value, an unexpected change alongside other intrusion signals indicates ransomware defacement.

Malicious Vulnerable Driver Load for BYOVD Defense Evasion (via image_load)

This rule detects loading of the rwdrv.sys, hlpdrv.sys and churchill_driver.sys kernel drivers abused in bring-your-own-vulnerable-driver attacks. Akira ransomware operators loaded these drivers to disable endpoint protection and tamper with security product access controls prior to encryption.

Malicious Vulnerable Driver Deployment for EDR Termination via file_event

This rule detects deployment of the vulnerable drivers aswArPots.sys and IObitUnlockers.sys that GHOSTENGINE abuses to terminate endpoint security processes and delete their binaries. These bring-your-own-vulnerable-driver components provide kernel-level primitives to disable defenses. Their presence indicates an active attempt to blind security tooling.

Suspicious Service Reconfiguration of SessionEnv or IKEEXT for DLL Injection by EAGERBEE

This rule detects reconfiguration of the SessionEnv or IKEEXT services via sc config, a technique the EAGERBEE backdoor uses to load a malicious service DLL such as tsvipsrv.dll. These services are known targets for phantom-DLL loading under svchost. Modifying their binary path or service DLL indicates service hijacking for persistence.

Suspicious Active Directory Enumeration via ADWS PowerShell Cmdlets via ps_script

This rule detects PowerShell script content invoking bulk Active Directory enumeration cmdlets such as Get-ADComputer or Get-ADObject that query the directory over Active Directory Web Services. Threat actors route enumeration through ADWS on port 9389 to avoid classic LDAP monitoring, so wide directory queries via these cmdlets indicate reconnaissance of domain assets and delegation.

Malicious PowerShell In-Memory Download Cradle via IEX DownloadString

This rule detects PowerShell invoking IEX together with a Net.WebClient DownloadString call to fetch and execute code directly in memory. This tradecraft was used by APT41 to stage ShadowPad and Cobalt Strike against a Taiwanese government-affiliated research institute. In-memory download cradles let attackers run remote payloads without writing them to disk which frustrates file-based detection.

Suspicious LucidRook DLL Side-Loading via Renamed msedge.exe

This rule detects msedge.exe executing from a WindowsApps directory under the user profile, matching the LucidRook loader that renames the DISM index.exe binary to msedge.exe to side-load a malicious DismCore.dll. Legitimate Microsoft Edge runs from Program Files, so an msedge.exe launched from AppData WindowsApps is an impostor used for search-order hijacking. This behavior indicates initial execution of the Lua-based LucidRook malware.

Possible Telegram Bot API Command and Control Channel

This rule detects DNS resolution of the Telegram bot API host api.telegram.org. QwixxRAT and similar stealers abuse the Telegram Bot API as a command-and-control and exfiltration channel to receive commands and upload stolen data. Because legitimate Telegram clients also resolve this host this signal should be correlated with unexpected processes making the query.

Office Persistence via WLL Add-in Dropped to Word STARTUP Folder

This rule detects a .wll Word add-in written to the Microsoft Word STARTUP folder, the persistence mechanism used by the PortDoor backdoor against the Russian defense sector. Word automatically loads WLL add-ins from this folder at launch, giving attackers stealthy code execution on every Word start.

SPN Added to an Account by Command Line (via process_creation)

This rule detects adds a SPN to an account in order to perform different type of abuse (Kerberoast, delegation abuse, ...).