Sigma detection rules, expert-reviewed

Suspicious C2 Connection to AWS Lambda Function URL

This rule detects outbound connections to AWS Lambda function URLs in the ap-southeast-1 region. The backdoor targeting Southeast Asian governments tunnels novel covert C2 through Lambda function URLs to blend with legitimate cloud traffic. Endpoint processes contacting these on.aws endpoints warrant review for web-service C2 abuse.

Possible Process Injection into Notepad via PythonRatLoader (via process_creation)

This rule detects notepad.exe being spawned by a Python interpreter, which corresponds to the PythonRatLoader chain that creates suspended notepad processes as hosts for Early Bird APC shellcode injection delivering DCRat, VenomRAT and XWorm. A Python process launching Notepad is highly abnormal on endpoints.

Suspicious Virtual Machine Detection via Get-MpComputerStatus and Win32_VideoController (via ps_script)

This rule detects PowerShell anti-analysis checks used by MintsLoader that read the IsVirtualMachine property from Get-MpComputerStatus or query the Win32_VideoController AdapterDACType to fingerprint virtual display adapters. The loader aborts when it believes it runs inside a sandbox. Scripted inspection of these virtualization indicators is characteristic of evasive malware rather than administration.

DSRM Password Changed - Reg via Command (via security)

This rule detects reset or synchronize with another domain account the DSRM (Directory Services Restore Mode) password in order to escalate privileges.

DLL Side-Loading of WebUI.dll via Iscrpaint Host Binary

This rule detects the iscrpaint.exe binary loading WebUI.dll, the DLL side-loading pair used to run LummaStealer under a signed host process. Loading this companion DLL from the malware staging directory indicates search-order hijacking rather than legitimate application behavior.

Suspicious AdInsight Execution from ProgramData via Scheduled Task by WikiLoader

This rule detects a renamed AdInsight executable running from the ProgramData directory, the persistence payload a scheduled task launches in the spoofed GlobalProtect WikiLoader campaign. A signed utility executed from a non-standard writable path indicates masquerading and sideloading rather than legitimate use. Detecting this exposes the persistence and execution stage of the loader.

Suspicious File Download via Certutil URLCache [Huntress] #2

This rule detects certutil.exe downloading a remote file using the urlcache option, a LOLBIN download technique Huntress observed after Wing FTP CVE-2025-47812 exploitation. Attackers use certutil to retrieve payloads over HTTP while blending in with a trusted signed binary. Certutil retrieving content from a URL is a common ingress tool transfer indicator that warrants review of the fetched resource.

Suspicious Command Processor AutoRun Persistence via Registry Set

This rule detects writes to the Command Processor AutoRun registry value, which forces a command to run whenever cmd.exe starts and was used for persistence in the Uncorking Old Wine Cobalt Strike loader. This value is rarely set by legitimate software and is a well-known event-triggered execution vector.

Malicious Domain Admin Account Escalation via net group (via process_creation)

This rule detects a net group command adding an account to the Domain Admins or Enterprise Admins group over the domain. Operators exploiting BeyondTrust Remote Support via CVE-2026-1731 created a domain account and escalated it into these privileged groups.

Suspicious WinSvcUpd Scheduled Task Persistence via schtasks (via process_creation)

This rule detects creation of a scheduled task named WinSvcUpd that runs PowerShell with a bypassed execution policy at logon with highest privileges. The GPUGate malware registered this task masquerading as a Windows update service for persistence.

Suspicious RDP Wds StartupPrograms Persistence Modification (via registry_set)

This rule detects modification of the Terminal Server rdpwd StartupPrograms value which lists programs launched when a Remote Desktop session starts. Adversaries append their payload to this value to persist and execute code on incoming RDP logons.

Suspicious Scheduled Task TPMProfiler Executing QEMU Emulator

This rule detects creation of a scheduled task named TPMProfiler or a task configured to run qemu-system-x86_64, the persistence and execution mechanism observed after SolarWinds Web Help Desk exploitation where a QEMU emulator was launched to evade host-level inspection. Masquerading a task as a benign TPM profiler while it starts a full system emulator is a deliberate concealment tactic. This pairing of task name and QEMU binary is a reliable compromise indicator.

Suspicious Kimsuky Run Key Persistence via Masqueraded Value (via registry_set)

This rule detects creation of a Run key value named Everything, install or tdll, autostart names Kimsuky used to persist its PebbleDash based tools under benign looking labels. The autostart relaunches the implant at logon while masquerading as ordinary software. Detecting these value names surfaces registry persistence tied to the campaign.

Suspicious Privileged Docker Container Mounting Host Filesystem

This rule detects a privileged Docker container being started with the host root filesystem bind-mounted into it, a configuration used to break container isolation and read host secrets. It is associated with software supply chain attacks that abuse developer and CI Docker access to reach host credentials. Detecting privileged host-mount launches flags container escape and credential access attempts.

Suspicious Azure CLI Disk Snapshot and Copy for Data Theft

This rule detects Azure CLI commands that create a managed disk snapshot or clone a disk from an existing source. It maps to cloud data theft where an attacker snapshots a target VM disk and attaches a copy to an unmonitored instance to read its contents. Detecting it exposes disk exfiltration through the cloud control plane.