Sigma detection rules, expert-reviewed

Suspicious Microsoft Defender Security Components Disabled - Command (via process_creation)

This rule detects disable Defender security features.

Suspicious UAC Bypass via Fodhelper Child Process

This rule detects fodhelper.exe spawning a child process, the hallmark of the ms-settings protocol handler UAC bypass used by BQTLock to elevate before injecting Remcos into explorer.exe. Fodhelper does not normally launch child processes outside of Settings interactions.

ArmouryLoader Persistence via Scheduled Task AsusUpdateServiceUA (via process_creation)

This rule detects creation of a scheduled task named AsusUpdateServiceUA, the persistence artifact ArmouryLoader registers to relaunch its shellcode payload at logon or on a short recurring interval while masquerading as an Asus update service. Adversaries use a plausible vendor task name to survive reboots and blend into legitimate software, making early detection critical for exposing the loader before CoffeeLoader delivery.

Suspicious WindowsCodecs DLL Sideload from Non System Path by Fighting Ursa

This rule detects WindowsCodecs.dll being loaded from a location outside the Windows system directories, the DLL search order hijack Fighting Ursa uses when a renamed calc.exe sideloads a malicious copy to run its batch payload. Loading a system DLL name from a user path indicates sideloading rather than legitimate use. Detecting this exposes the sideload stage of the infection.

Malicious Citrix WFShell Spawning Command Interpreter via Command Line

This rule detects the Citrix wfshell.exe or cmstart.exe process spawning a command interpreter, a post-exploitation chain observed after abuse of the Citrix Bleed vulnerability CVE-2023-4966 leading to LockBit ransomware. These Citrix components should not launch shells. Detecting the chain exposes hands-on-keyboard activity following gateway compromise.

Malicious Office Application Spawning a Command Shell or Script Interpreter (via process_creation)

This rule detects a Microsoft Office application such as Word, Excel, PowerPoint or Outlook launching a command shell or script interpreter, the classic child-process signature of a malicious macro or exploited document. Phishing-driven Windows Command Shell and script execution rank among the most prevalent techniques in the Red Canary Threat Detection Report, marking the transition from initial access to code execution. Detecting interpreter children of Office processes surfaces the intrusion at that hand-off.

Malicious Bring-Your-Own-Vulnerable-Driver Load By BlackByte

This rule detects loading of vulnerable kernel drivers abused by BlackByte to disable endpoint protection. BlackByte deployed the RtCore64 DBUtil_2_3 zamguard64 and gdrv vulnerable drivers to gain kernel-level code execution. Loading a known-vulnerable signed driver is a BYOVD technique that lets attackers terminate security products and tamper with the kernel.

Suspicious Microsoft Defender Exclusion Added via PowerShell

This rule detects PowerShell adding a Microsoft Defender exclusion path, a defense-evasion step performed by Pure Crypter before deploying its payload. Attackers exclude their staging directories from antivirus scanning so subsequent malicious files execute undetected, making unexpected Add-MpPreference exclusions a reliable evasion indicator.

Cleo File Transfer Software Spawning Command Interpreter

This rule detects a Cleo managed file transfer process spawning a command interpreter such as cmd, PowerShell or Bash, the post-exploitation behavior of CVE-2024-55956 autorun abuse leading to Cobalt Strike by CL0P. A Cleo product launching a shell indicates exploitation of the Cleo Harmony VLTrader or LexiCom software.

Suspicious Subprocess Spawned by LiteLLM Proxy Process (via process_creation)

This rule detects a LiteLLM proxy Python process spawning a shell or network utility. Such a child process is consistent with the subprocess execution abused in CVE-2026-42271. A LiteLLM proxy does not normally launch shells or download tools.

Malicious AppDomainManager Injection via MyAppDomainManager DLL Load

This rule detects a .NET process loading a module named MyAppDomainManager.dll, the hijack DLL used by CL-STA-1062 to abuse the AppDomainManager configuration in chrome_setup.exe.config and run the TinyRCT backdoor inside a trusted process. Catching this load reveals CLR AppDomainManager injection used for defense evasion and stealthy code execution.

Malicious File Encryption via Kraken Ransomware Encryptor Binary

This rule detects execution of the Kraken ransomware encryptor with its characteristic key, path, timeout and directory command-line switches. The binary encrypts victim files and appends the .zpsc extension while dropping a ransom note. Detecting the encryptor invocation provides a late-stage indicator of active ransomware deployment.

Suspicious Active Directory Enumeration via ADFind (via process_creation)

This rule detects execution of ADFind or a binary carrying ADFind's characteristic query switches used to enumerate domain accounts, computers and trusts. Emotet operators run ADFind during staging to map the Active Directory environment before lateral movement. Broad directory reconnaissance from an interactive host is rarely legitimate outside of sanctioned administration.

Malicious WSH Script Execution from WebDAV Share (via process_creation)

This rule detects wscript.exe or cscript.exe executing a script hosted on a remote WebDAV share as shown by the DavWWWRoot path token, a delivery method abused through malicious URL and LNK files pointing at Cloudflare tunnel WebDAV servers. Script execution directly from a WebDAV UNC path is rarely legitimate.

Malicious DLL Sideloading via LOLBins from ProgramData by Dohdoor

This rule detects trusted Windows utilities loading propsys or batmeter DLLs from ProgramData or the Public directory. The Dohdoor campaign sideloads its payload through living-off-the-land binaries such as OpenWith and mblctr running from unusual paths. A signed utility loading a system-named DLL from a writable directory is a strong sideloading indicator.