Sigma detection rules, expert-reviewed

Suspicious Secedit Security Policy Export for Reconnaissance (via process_creation)

This rule detects secedit.exe exporting the local security policy configuration to a temp file as observed during the SoftEther VPN intrusion reconnaissance. Attackers export the policy to understand password and account restrictions before creating backdoor users.

Malicious Shadow Copy Deletion and Recovery Tampering by BabLock Ransomware

This rule detects deletion of volume shadow copies and disabling of Windows recovery, hallmarks of BabLock ransomware pre-encryption activity. The operators run vssadmin Delete Shadows and bcdedit recoveryenabled No to prevent victims restoring their data. This inhibits recovery and maximizes the impact of the encryption stage.

Malicious Payload Decoding via Certutil

This rule detects certutil using its decode function against PDF-named files to reconstruct an executable payload from base64, a defense-evasion and deobfuscation step. This was observed in a Vietnamese threat actor chain delivering PureRAT. Abusing certutil to decode disguised files bypasses download controls and unpacks the next-stage loader.

Suspicious Registry SYSTEM Hive Dump via Reg Save (via process_creation)

This rule detects reg.exe saving the HKLM SYSTEM hive to a local file, a credential access technique used in the MS-SQL intrusion to extract secrets for offline processing. Saving the SYSTEM hive to a user writable path is rarely part of legitimate administration.

Suspicious NetSupport client32 Execution from ProgramData (via process_creation)

This rule detects execution of the NetSupport Manager remote control client client32.exe from a CommunicationLayer directory under ProgramData. The JS#SMUGGLER campaign installed NetSupport RAT to this path.

Suspicious JSP Webshell Written to SAP irj work Directory (via file_event)

This rule detects JSP files being written under the SAP servlet_jsp irj work directory, the deployment location where CVE-2025-31324 exploitation dropped webshells such as forwardsap.jsp and helper.jsp. New JSP files appearing in this runtime path indicate server software component abuse. This is a reliable webshell persistence signal.

Suspicious VBA Runtime Loaded by Process from OneNote Exported Directory

This rule detects a process running from the OneNote exported attachment or temp directory loading the VBE7.dll VBA runtime, indicating macro or script execution from a weaponised OneNote embedded file. Legitimate applications rarely execute from the OneNote Exported path, so loading the VBA engine from there signals malicious code launched via a OneNote phishing lure.

Suspicious Boot Recovery Disabled via bcdedit Before Encryption (via process_creation)

This rule detects bcdedit disabling Windows boot recovery, an inhibit-recovery step performed by Mallox ransomware before file encryption. Adversaries turn off automatic recovery so victims cannot restore systems after encryption, making this a common pre-encryption impact indicator that warrants investigation alongside surrounding activity.

Malicious Turla PNG Dropper Service Masquerading as Windows Error Reporting via Service Creation

This rule detects installation of a Windows service using names that masquerade as legitimate Windows Error Reporting components which the Turla PNG Dropper uses for persistence. Observed in NCC Group research on the returning Turla PNG Dropper which registers services such as WerFaultSvc and RegRunnerSvc to load steganographic payloads. Detecting these masquerading service installations helps catch stealthy persistence by this espionage actor.

Suspicious Long Alphanumeric DNS Subdomain Indicative of DNS Tunneling

This rule detects DNS queries whose leftmost label is an unusually long fixed-width alphanumeric string, matching the 28 to 31 character encoded subdomains used by the Saitama DNS implant to smuggle command-and-control data. Such high-entropy labels are a hallmark of DNS tunneling and warrant review of the querying host for a covert C2 channel.

Malicious BITS Job Notify Command Pointing To ProgramData Payload via BITSLOTH

This rule detects creation of a BITS transfer job named Microsoft Windows configured with a SetNotifyCmdLine that executes a binary staged under C:\ProgramData which is the persistence mechanism used by the BITSLOTH backdoor. Adversaries abuse the Background Intelligent Transfer Service to survive reboots and blend malicious execution into a trusted Windows service.

Suspicious php.exe Backdoor Execution from AppData Roaming

This rule detects the PHP interpreter running from a user AppData Roaming directory while loading extensions and a config file, which matches the Interlock PHP backdoor. The group deployed php.exe with an extension directory and config.cfg to run a resident backdoor from Roaming rather than a normal install path. A scripting interpreter running from a per-user profile path is a strong indicator of malicious code execution and persistence.

Malicious svcagent DLL Load From AssetMon ProgramData Directory via PHANTOMPULSE

This rule detects loading of svcagent.dll from a ProgramData AssetMon directory as used by the PHANTOMPULSE blockchain C2 RAT in Elastic research. A service agent named DLL staged under a fabricated AssetMon folder in ProgramData indicates the implant module being mapped for execution and persistence.

Suspicious UAC Bypass via ComputerDefaults Auto-Elevation (via process_creation)

This rule detects the auto-elevating ComputerDefaults.exe spawning a command interpreter or scripting host, the signature of a registry-hijack UAC bypass. PrivateLoader abuses ComputerDefaults to run elevated code without prompting the user, gaining higher privileges for installation. A trusted auto-elevated binary launching cmd or PowerShell is a well-known UAC-bypass pattern.

Suspicious C2 Connection to AWS Lambda Function URL

This rule detects outbound connections to AWS Lambda function URLs in the ap-southeast-1 region. The backdoor targeting Southeast Asian governments tunnels novel covert C2 through Lambda function URLs to blend with legitimate cloud traffic. Endpoint processes contacting these on.aws endpoints warrant review for web-service C2 abuse.