Sigma detection rules, expert-reviewed

Suspicious pythonw.exe Executing LICENSE.txt Downloader from AppData

This rule detects a hidden pythonw.exe process launched from the AppData Local directory with a LICENSE.txt argument, matching an AI-themed lure that drops a Python downloader loading shellcode. Running a Python interpreter over a text file disguised as a license from a user writable path is a strong sign of staged malware execution.

Suspicious UAC Bypass via CMSTP INF Auto-Install

This rule detects execution of cmstp.exe with the auto-install switch pointing to an INF file, a technique used to bypass User Account Control and execute arbitrary commands at high integrity. The Sliver C2 framework and multiple threat actors abuse this living-off-the-land binary to elevate privileges while evading defenses. Detecting it early helps stop attacker privilege escalation before further post-exploitation activity.

Malicious DLL Sideloading of wke.dll via DriverAssistant acvb (via image_load)

This rule detects the signed DriverAssistant binary acvb.exe loading a wke.dll located alongside it, a DLL side-loading chain used to bypass UAC and launch FatalRAT. This behavior was observed in Operation SalmonSlalom against Chinese-speaking targets in APAC. Detecting the abnormal module load exposes the defense-evasion and execution stage of the loader.

Malicious Windows Defender Disable via Policy Registry Keys

This rule detects modification of the Windows Defender policy registry values that switch off antispyware antivirus and real time monitoring as performed in the SystemBC intrusion described by WithSecure. Disabling Defender through policy keys is a defense evasion step attackers take to clear the path for credential theft and ransomware staging.

Malicious Shai-Hulud npm Payload Execution via bun_environment Script (via process_creation)

This rule detects execution of the Shai-Hulud worm install-hook payloads setup_bun.js and bun_environment.js, dropped and run via npm pre/post-install scripts during the supply-chain compromise. These scripts scan for cloud and SSH credentials and self-propagate, so their execution signals active infection of the npm ecosystem.

Malicious Volgmer Payload Storage in WMI Security Registry Key

This rule detects creation of specific named values under the WMI Security registry key used by the Hidden Cobra Volgmer backdoor to hide its encoded configuration and payload. Writing data to this rarely used registry location under these hardcoded GUID value names is a high-confidence indicator of a Volgmer infection.

Suspicious rundll32 shell32.dll Ordinal 61 Execution

This rule detects rundll32.exe calling shell32.dll by ordinal number 61, a proxy-execution trick observed in the NightshadeC2 loader chain. Invoking shell32 functions by ordinal avoids readable export names and is used to launch further stages while blending into normal rundll32 usage. Ordinal-based shell32 execution rarely appears in legitimate activity.

Suspicious Execution of Microsoft.Http.Api.exe from AppData

This rule detects execution of a binary named Microsoft.Http.Api.exe from a user AppData path, used by the SHELBY backdoor to masquerade as a legitimate Microsoft component. A Microsoft-branded executable running from AppData rather than a system directory indicates masquerading and side-loading staging used to blend malicious execution with trusted software.

Suspicious GoGRPC Persistence via Realtek HD Audio Run Key (via process_creation)

This rule detects a PowerShell command that sets a CurrentVersion Run value named Realtek HD Audio pointing to an executable in the roaming AppData folder as used by the GoGRPC backdoor. Legitimate Realtek audio software does not persist from AppData.

Suspicious VMware Tools Binary Executing from Non-Standard Path

This rule detects a process named vmtools.exe or vmwared.exe running from a directory outside the legitimate VMware installation tree. CL-STA-1062 masquerades its loader as VMware guest tooling to evade analyst scrutiny on virtualized targets. Spotting the trusted filename in the wrong path exposes a masqueraded implant rather than genuine VMware software.

Suspicious Batch Execution From Hidden __MACOSX Archive Path (via process_creation)

This rule detects a command shell executing a batch file from a hidden __MACOSX directory extracted from a delivery archive, the initial execution step of this Cobalt Strike infection chain. Legitimate workflows do not run scripts from __MACOSX archive residue.

Suspicious Excel Outbound Network Connection

This rule detects Excel.exe initiating an outbound network connection, which is unusual for a spreadsheet application that has no child process. In the WithSecure Initial Access Lab 4 an Excel 4.0 SLK macro injects meterpreter shellcode into Excel itself which then beacons over HTTPS to a non-Microsoft address. Attackers keep the malicious code inside the Office host to avoid spawning a suspicious child process.

Suspicious Windows Event Log Clearing via wevtutil (via process_creation)

This rule detects wevtutil being used to clear Windows event logs. This behavior was observed in Cyber Partisans activity aimed at espionage and disruption to destroy forensic evidence after intrusion. Because administrators occasionally clear logs during maintenance, matches should be correlated with the surrounding activity and account context.

Suspicious Microsoft Defender Security Components Disabled - Command (via process_creation)

This rule detects disable Defender security features.

Suspicious UAC Bypass via Fodhelper Child Process

This rule detects fodhelper.exe spawning a child process, the hallmark of the ms-settings protocol handler UAC bypass used by BQTLock to elevate before injecting Remcos into explorer.exe. Fodhelper does not normally launch child processes outside of Settings interactions.