Sigma detection rules, expert-reviewed

Malicious Kernel Driver Load from User AppData Directory

This rule detects loading of known malicious kernel driver file names from a user AppData directory which is an abnormal location for signed drivers. NCC Group attributed netfilter and related drivers to a rootkit that manipulates network traffic and hides malicious activity. Loading a driver from a writable user path indicates rootkit installation and kernel level defense evasion.

Possible Team9 C2 via Emercoin bazar Domain Resolution

This rule detects DNS queries for domains under the Emercoin .bazar top-level domain used by the Team9 malware family for resilient command-and-control. Resolution of a .bazar name from an enterprise host is highly unusual and strongly suggests a blockchain-based C2 channel.

Suspicious Access to IIS machine.config outside the Worker Process Context (via security)

This rule detects object-access auditing events for web.config or machine.config performed by a process other than the IIS worker or expected build tooling, a hunting signal for adversaries harvesting the validationKey and decryptionKey values that enable ViewState code-injection attacks. Stolen or leaked machine keys let attackers forge authenticated ViewState payloads, so unexpected reads of these files can reveal key theft before exploitation.

Malicious Run Key Persistence miasma-monitor from AsyncAPI npm Compromise

This rule detects an autorun Run key value named miasma-monitor, the Windows persistence installed by the AsyncAPI npm supply chain compromise import-time loader. The distinctive miasma named autostart relaunches the malicious payload at logon after a poisoned package is imported.

Malicious Run Key Persistence NvmProtocal Launching NodePackages Payload

This rule detects an autorun Run key named NvmProtocal or one referencing the NodePackages protocal.cjs payload, the Windows persistence dropped by the Mastra npm supply chain compromise. The misspelled Node branding launches PowerShell or Node from ProgramData at logon to maintain access after the malicious package installs.

Suspicious Run Key Persistence Masquerading as Google Update

This rule detects creation of autorun Run key values named GupdateS or GupdateU, persistence entries dropped by The Gentlemen ransomware that impersonate the Google Update service. The false Google branding hides the malicious autostart from casual inspection while ensuring the encryptor relaunches at logon.

Malicious Password Filter Registration via LSA Notification Packages

This rule detects registration of a rogue password filter DLL named passms in the LSA Notification Packages registry value, seen in a stealthy third-party supply chain intrusion. A malicious password filter receives every password change in cleartext, giving the attacker durable credential access across the domain.

Malicious Network Provider Registration via ProviderOrder Registry Key

This rule detects registration of a rogue network provider named mslogon in the NetworkProvider ProviderOrder registry key, observed during a stealthy intrusion staged through a third-party compromise. A malicious network provider intercepts credentials at logon time so the attacker can harvest plaintext passwords and sustain long-term covert access.

Malicious WDigest UseLogonCredential Enabled for Cleartext Credential Theft (via registry_set)

This rule detects the WDigest UseLogonCredential value being set to 1, which forces Windows to cache cleartext credentials in memory. Storm-1175 enables this before dumping credentials during high-tempo Medusa ransomware operations. Adversaries use the change to recover plaintext passwords with tools like Mimikatz, so this registry modification is a strong precursor to credential theft and lateral movement.

Suspicious ClickFix RunMRU Entry Recording LOLBIN Command from Run Dialog

This rule detects RunMRU registry values that capture LOLBIN commands such as powershell, mshta, rundll32, or msbuild pasted into the Windows Run dialog. Microsoft describes this as the core artifact of the ClickFix social engineering technique that tricks users into executing attacker commands. A scripting or proxy binary launched from the Run dialog is rare for legitimate users, so these entries flag the user-driven execution step.

Suspicious Firefox Enterprise Root Certificate Trust Enabled

This rule detects the Firefox preference security.enterprise_roots.enabled being set to true, forcing Firefox to trust certificates from the Windows root store. Microsoft observed Secret Blizzard enabling this so their rogue root certificate would be trusted by Firefox for AiTM interception. Because Firefox normally maintains its own trust store, this change extends the attacker root into the browser and enables traffic decryption.

Suspicious RunMRU Entry Launching LOLBIN via ClickFix Run Dialog

This rule detects RunMRU registry values that record LOLBIN commands such as powershell or mshta typed into the Windows Run dialog. Microsoft observed Lumma Stealer ClickFix campaigns instructing victims to paste these commands, leaving artifacts in the RunMRU key. A scripting LOLBIN executed from the Run dialog is unusual for normal users and reveals the social engineering execution step.

Suspicious Access to Chrome Encrypted Preference MAC Registry Values (via registry_set)

This rule detects registry activity touching Chrome PreferenceMACs values, the integrity-hash store that StilachiRAT reads while harvesting browser credentials and manipulating Chrome state during its cryptocurrency-theft workflow. Adversaries interact with these values to validate or bypass Chrome preference protections when stealing saved logins, so unexpected access to PreferenceMACs is an indicator of browser credential theft.

Suspicious Mint Sandstorm VBScript Persistence via Run Key (via registry_set)

This rule detects a Run key value referencing a VBScript file used for persistence. Mint Sandstorm registered scripts such as a.vbs and Persistence.vbs under CurrentVersion Run to maintain access on targeted academic and research hosts.

Suspicious Flax Typhoon Network Level Authentication Disabled via Registry (via registry_set)

This rule detects disabling of Network Level Authentication for RDP by setting the UserAuthentication value to 0 under the RDP-Tcp terminal server key. Flax Typhoon disabled NLA to weaken RDP protections and enable the Sticky Keys logon-screen hijack for remote access.