Sigma detection rules, expert-reviewed

Suspicious Kernel Mode Service Creation via SC

This rule detects creation of a kernel-mode service using sc with a kernel type flag, the mechanism used to load a driver during the ReadText34 ransomware incident as part of a bring-your-own-vulnerable-driver attack. Registering a kernel service outside of software installation is anomalous. Attackers exploit this to load vulnerable drivers that disable endpoint protection.

Suspicious Execution of PIF File as AutoIt Loader

This rule detects execution of a process image with the .pif extension, an abuse observed in a Lumma infostealer campaign where a renamed AutoIt3 interpreter named Riding.pif performed process hollowing to inject the stealer. It captures the use of an uncommon executable extension to disguise a script interpreter. Detecting this is important because .pif files launching as active processes are almost never legitimate on modern systems and frequently indicate masqueraded loader activity.

Suspicious PowerShell Download of updserc Archive to AppData via ClickFix

This rule detects PowerShell downloading an archive named updserc.zip into the local AppData directory. This activity is part of a ClickFix phishing chain abusing Booking.com themed lures to stage the PureRAT loader. Pulling a named archive into AppData through PowerShell is an early loader step that precedes DLL side-loading and in-memory execution.

ClickFix Paste-Jacking Command Written to RunMRU History (via registry_set)

This rule detects download or script-execution commands recorded in the Explorer RunMRU history, the forensic residue left when a user pastes a clipboard-injected command into the Run dialog during a paste-jacking or ClickFix attack. Adversaries rely on this manual execution path to bypass download controls, making mshta or PowerShell cradle strings in RunMRU a useful post-execution indicator.

Malicious Data Exfiltration to Restic REST Server over HTTP (via process_creation)

This rule detects the restic backup utility being pointed at a remote REST endpoint over HTTP to back up file-share directories, the exfiltration channel used in the Nitrogen BlackCat intrusion to stage stolen data before ransomware. Adversaries repurpose restic as a fast deduplicating uploader to attacker-controlled REST servers, so restic writing to a rest http repository is a strong pre-encryption data-theft signal.

Suspicious Vulnerable Driver googleapiutil64.sys Loaded for BYOVD

This rule detects loading of a driver named googleapiutil64.sys, a renamed vulnerable Baidu antivirus driver deployed by Warlock ransomware operators to disable security tooling via Bring Your Own Vulnerable Driver. The filename masquerades as a legitimate Google component.

Obfuscated Encoded PowerShell Payload Deployed via Service (via security)

This rule detects deployed a service pointing to a hidden and encoded PowerShell payload. Some parameters are commented in case you would like to reduce false positives or make the rule more precise.

Malicious Axios NPM RAT Renamed PowerShell Execution via wt.exe

This rule detects a PowerShell binary copied to wt.exe under ProgramData and executed with a hidden window and execution policy bypass, matching the Axios NPM supply chain incident where a post-install hook drops a RAT. Renaming powershell.exe to wt.exe masquerades the interpreter as Windows Terminal to evade name-based detection. Execution of a masqueraded interpreter from ProgramData with bypass flags is a strong compromise indicator.

Suspicious Fileless PowerShell Execution via Invoke-RestMethod Piped to IEX (via process_creation)

This rule detects PowerShell fetching remote content with Invoke-RestMethod and piping it straight into Invoke-Expression, the fileless delivery used by the SEO poisoning campaign impersonating Gemini and Claude Code installers. This pattern executes attacker-hosted script without touching disk. Some tooling uses irm iex legitimately, so review the target domain.

Microsoft Defender SpyNet Reporting Disabled via Registry

This rule detects the Microsoft Defender SpyNetReporting registry value being set to 0, disabling cloud-delivered protection telemetry so malware runs with reduced detection. Huntress observed BlackCat affiliates degrading Defender before payload deployment. Turning off SpyNet reporting is a deliberate defense-evasion action rarely performed by legitimate administration.

Suspicious New Rights Granted to an Account for Privilege Escalation (via security)

This rule detects grants new rights to an account in order to escalate privileges.

Malicious Mimikatz Driver Deployed via Service (via security)

This rule detects installs the Mimikatz driver to bypass the LSA protected mode (RunAsPPL) and dump LSASS process content.

Malicious Impacket WMIexec Execution via SMB Admin Share (via security)

This rule detects remotely execute WMIexec via SMB admin share in order to escalate privileges.

Malicious Microsoft Defender Threat Exclusion Added - PowerShell (via powershell)

This rule detects scenarios where a threat exclusion is added to the antivirus in order to bypass its detection capacities.

Suspicious Windows Service ImagePath Pointing to AppData Directory

This rule detects creation or modification of a Windows service whose ImagePath references a user AppData directory. Legitimate services rarely execute from per-user AppData paths, so this pattern commonly indicates malware establishing persistence as a service. Reviewing such services helps surface service-based persistence.