Sigma detection rules, expert-reviewed

Malicious PDF Editor Update Script Execution via PowerShell (via process_creation)

This rule detects PowerShell executing the named update scripts used by the trojanized PDF editor cluster (ConvertMate and PDFClick) that infiltrated environments through malicious ads. Adversaries run these scripts to register scheduled tasks and pull further payloads, making execution of the specific update script names a direct campaign indicator.

Suspicious ADNotificationManager Execution for netutils.dll Side-Loading (via process_creation)

This rule detects the Adobe ADNotificationManager.exe binary running from a user writable directory rather than its installed Adobe program path, where the RedCurl EarthKapre APT side-loads a malicious netutils.dll. Relocating the signed executable lets the attacker force loading of an attacker controlled library beside it. Execution of this Adobe component from a temporary or profile path is a strong side-loading indicator.

Suspicious Active Directory Forest PowerShell Class Called from a Non Administrative Host (via powershell)

This rule detects call the Active Directory Forest PowerShell class on a non administrative host in order to enumerate trusts, forests, domains, sites and subnet information.

Suspicious Python Site Hook or PTH File Written to Site-Packages via File Event

This rule detects the creation of Python site-initialization hooks sitecustomize.py and usercustomize.py or a .pth file inside site-packages, the persistence mechanism used by the malicious Python packages reported by Cisco Talos. These files execute automatically every time the interpreter starts, giving attackers durable code execution. Detecting writes of these hooks reveals stealthy persistence planted through the packaging ecosystem.

Suspicious Windows Event Log Cleared during StilachiRAT Anti-Forensics (via security)

This rule detects the clearing of the Windows Security event log, an anti-forensic action performed by StilachiRAT which monitors event IDs and wipes logs to erase traces of its reconnaissance and cryptocurrency-theft activity. Adversaries clear logs to frustrate incident response after credential and wallet theft, so a 1102 log-clear event outside sanctioned maintenance is a strong tampering indicator.

WebDAV Remote Payload Retrieval via Rundll32 DavSetCookie

This rule detects rundll32.exe calling davclnt.dll with the DavSetCookie export followed by a remote host, a WebDAV based download and execution technique used by the Andromeda Gamarue cluster. This pattern pulls a remote payload over WebDAV while hiding behind a signed Windows binary.

Malicious Scheduled Task Named CorelDefrag Under Windows Defrag Path

This rule detects the creation of a scheduled task named CorelDefrag placed inside the legitimate Windows Defrag task folder. The eScan supply chain attack persisted its implant with a task under Microsoft Windows Defrag CorelDefrag as reported by Kaspersky. Placing a rogue task inside a trusted system task path indicates masquerading persistence.

Suspicious Detection of Default a Windows Host Name in Login Attempts (via security)

This rule detects scenarios where a default Windows host name pattern (WIN-...) is detected during a login attempt. Having a host with a default name may be an indicator of a fresh machine deployed by an attacker to evade detection and perform malicious activities.

Malicious Disabling of Carbon Black EDR Service via sc config

This rule detects the sc command reconfiguring the Carbon Black cbdefense service start type to disabled. Sinobi actors disabled the endpoint protection service before deploying ransomware to blind defenders. Disabling a named EDR service through sc config is a deliberate defense-evasion step that precedes encryption and should be treated as a critical event.

Ngrok Tunneling Utility Execution for Command and Control

This rule detects execution of the ngrok tunneling utility, which adversaries use to expose internal services and establish covert command-and-control through a trusted relay. Huntress observed ngrok deployed on compromised servers to tunnel access past perimeter controls. While developers use ngrok legitimately, its presence on servers alongside exploitation activity indicates malicious tunneling.

Malicious JanelaRAT DLL Side-Loading via nevasca.exe (via image_load)

This rule detects the host binary nevasca.exe loading the malicious PixelPaint.dll used by JanelaRAT to hijack execution flow through DLL side-loading. JanelaRAT is a financial remote access trojan targeting users in Latin America. Detecting this loader pair exposes the in-memory execution of the RAT before command-and-control is established.

Suspicious ScreenConnect Client Download via PowerShell (via process_creation)

This rule detects PowerShell using Invoke-WebRequest to download a ScreenConnect client setup installer. The FROZEN#SHADOW campaign deployed ScreenConnect as remote access tooling for persistence and hands-on-keyboard activity.

Malicious SAM and SYSTEM Hive Dump via reg save

This rule detects reg.exe saving the SAM or SYSTEM registry hives to disk which the Librarian Ghouls APT exports to a staging folder to harvest local credentials offline. Dumping these hives enables offline password and secret extraction after gaining local admin. Reg save of security hives is rarely part of legitimate administration.

Malicious Service Creation for DcRAT Persistence via sc.exe (via process_creation)

This rule detects use of sc.exe to create the MixedSvc service pointing at a masqueraded Mixed Reality.exe binary under the Windows Media Player folder, the persistence mechanism used by Operation DragonReturn to survive reboots. The actor abused Windows service control to auto-start its DcRAT loader with SYSTEM privileges, making this a high-value chokepoint for catching the intrusion before code injection into svchost.

Malicious Eldorado Ransomware Ransom Note Creation

This rule detects the creation of the HOW_RETURN_YOUR_DATA.TXT ransom note dropped by Eldorado ransomware across encrypted directories. The note appears once encryption completes and delivers the extortion demand. It matters because its widespread creation confirms an active Eldorado impact event on the host or shares.