Sigma detection rules, expert-reviewed

WSL InstallLocation Registry Key Modification on Windows

Alerts on suspicious registry modifications to the WSL InstallLocation key while excluding known legitimate MSI/WSL locations.

Windows Process Creation: Masqueraded wsl.exe Execution

Flags process launches masquerading as wsl.exe by matching Image path suffix while excluding legitimate OriginalFileName values.

Windows Process Creation: Suspicious reg.exe or PowerShell Editing of WSL InstallLocation Registry

Flags reg.exe or PowerShell command lines editing the WSL InstallLocation registry value under Lxss MSI.

Windows Process Creation: wsl.exe Child Execution Outside Legitimate WSL Paths

Alert on System32 wsl.exe spawning a wsl.exe child process when the child path isn’t in known legitimate WSL locations.

Windows File Event: Possible Modification of wsl.exe from Installed Location

Alerts on attempts to modify wsl.exe in installed WSL/WindowsApps locations, indicating potential binary replacement for proxy execution.

Suspicious SimpleHelp Remote Access Client Spawning Discovery Commands (via process_creation)

This rule detects the SimpleHelp Remote Access client spawning a command shell that runs account and domain enumeration utilities. Following exploitation of SimpleHelp RMM for initial access, operators used the persisted client to run net and nltest reconnaissance.

Suspicious Headless Browser Automation with Anti-Detection Flags via Astaroth (via process_creation)

This rule detects a browser launched in headless automation mode with flags that suppress automation indicators. The Astaroth spambot drives Chrome or Edge with headless, disable-infobars, and excludeSwitches settings to abuse authenticated web sessions without user awareness. This flag combination is unusual on endpoint hosts.

Suspicious Permissions Changed on a Group Policy - GPO (via security)

This rule detects will attempt to take control over a group policy.

Suspicious Browser Launch With Remote Debugging for Cookie Theft (via process_creation)

This rule detects a Chromium-based browser launched with both a remote debugging port and a custom user data directory. Phantom Goblin abuses this to extract cookies and session data directly from the browser.

Suspicious Service DLL Registration via regsvr32 Silent

This rule detects regsvr32.exe silently registering a DLL as part of the RONINGLOADER service installation chain that loads goldendays.dll. Adversaries use the silent flag to register malicious DLLs without user-visible prompts while establishing service-based persistence.

Suspicious COLDRIVER Logon Script Persistence via UserInitMprLogonScript (via process_creation)

This rule detects a reg add command creating the UserInitMprLogonScript value under HKCU Environment to run a hidden PowerShell stager at logon as performed by the COLDRIVER SIMPLEFIX chain. This logon script value is a well known but rarely legitimate persistence location.

Uncommon Print Spooler Exploitation Spawning a Child Process (via process_creation)

This rule detects the print spooler service (spoolsv.exe) spawning a command shell, script interpreter or a process from a user-writable path, behavior consistent with PrintNightmare-style spooler exploitation for code execution or privilege escalation. Print spooler abuse is a privilege-escalation technique noted in the Red Canary Threat Detection Report. Detecting anomalous spooler children surfaces exploitation of the service.

Suspicious SystemSettings DLL Sideload from Non-System Path via image_load

This rule detects SystemSettings.exe loading a SystemSettings.dll from a path outside the System32 directory, the DLL sideloading technique used to launch SharkLoader in the StrikeShark campaign. The genuine binary only loads its companion DLL from System32. A matching name loaded from elsewhere indicates a sideloading proxy execution.

Malicious Zhong Stealer Loader and Log Artifacts

This rule detects creation of TASLoginBase.dll or TASLogin.log, host artifacts written by the Zhong Stealer during execution and inventory logging. These filenames are unique to the Zhong Stealer toolkit targeting fintech support channels.

Suspicious PowerShell Download to AppData Intel Path

This rule detects PowerShell using DownloadFile to stage a payload into an AppData Intel directory as seen in the Foxit PDF exploitation chain. The attacker hides downloaded miner and RAT payloads under an Intel named folder in the user profile. Detecting the download cradle exposes remote payload retrieval.