Sigma detection rules, expert-reviewed

Suspicious Mint Sandstorm VBScript Persistence via Run Key (via registry_set)

This rule detects a Run key value referencing a VBScript file used for persistence. Mint Sandstorm registered scripts such as a.vbs and Persistence.vbs under CurrentVersion Run to maintain access on targeted academic and research hosts.

Suspicious Flax Typhoon Network Level Authentication Disabled via Registry (via registry_set)

This rule detects disabling of Network Level Authentication for RDP by setting the UserAuthentication value to 0 under the RDP-Tcp terminal server key. Flax Typhoon disabled NLA to weaken RDP protections and enable the Sticky Keys logon-screen hijack for remote access.

Malicious Flax Typhoon Accessibility Feature IFEO Debugger Hijack via Registry (via registry_set)

This rule detects creation of an Image File Execution Options debugger value on an accessibility binary such as sethc.exe or utilman.exe pointing to taskmgr or cmd. Flax Typhoon abused this Sticky Keys hijack to gain SYSTEM-level command execution from the logon screen without credentials, enabling stealthy persistence and access.

Suspicious Data Exfiltration to webhook.site via PowerShell Invoke-WebRequest (via ps_script)

This rule detects PowerShell piping command output through Out-String into Invoke-WebRequest targeting webhook.site. Threat actors used this technique to exfiltrate host reconnaissance output to an attacker-controlled request-capture endpoint.

Suspicious Scheduled Task Persistence Named Autoupdate

This rule detects creation of a scheduled task named Autoupdate via schtasks, the persistence used to relaunch ACR Stealer components. Naming the task Autoupdate helps the infostealer survive reboots while blending into expected update activity on the host.

Suspicious msiexec Remote Passive Install Loader

This rule detects msiexec installing a package from a remote URL in passive mode, a delivery method used to load StealC and Amadey infostealers. Installing an MSI directly from the internet with a suppressed user interface is a proxy execution technique that evades application controls.

Suspicious PowerShell Download and Execute via iwr Piped to iex

This rule detects PowerShell fetching remote content with Invoke-WebRequest and piping it into Invoke-Expression, a loader pattern used to deliver StealC and Amadey infostealers. Downloading and directly executing script content in memory bypasses file based controls and is a common malware staging technique.

Suspicious npm Postinstall node Execution of setup.cjs with Warnings Suppressed

This rule detects node executing a setup.cjs script with the --no-warnings flag, the postinstall behavior used in the Mastra npm supply chain compromise attributed to Sapphire Sleet. A postinstall script suppressing warnings while running an installer stage is characteristic of malicious package code fetching a second stage payload.

Suspicious Vidar Payload Execution from AI-Themed DeepSeek Lure Path

This rule detects process activity from a Downloads Programs directory named after a fake DeepSeek AI build, the staging path used to deliver the Vidar infostealer in an AI-branded social engineering campaign. The distinctive lure path indicates a user was tricked into running a fraudulent AI tool that deploys credential theft malware.

Suspicious Scheduled Task Persistence Masquerading as Update Tasks

This rule detects creation of scheduled tasks named UpdateSystem or UpdateUser via schtasks, a persistence and propagation mechanism used by The Gentlemen ransomware. Masquerading tasks as benign update jobs helps the encryptor survive reboots and relaunch across compromised hosts.

Suspicious Volume Shadow Copy Deletion via vssadmin or wmic

This rule detects deletion of volume shadow copies using vssadmin or wmic, an inhibit recovery step performed by The Gentlemen ransomware before encryption. Removing shadow copies prevents victims from restoring files and is a strong pre-encryption indicator of a destructive attack.

Malicious The Gentlemen Ransomware Encryptor via Distinctive CLI Flags

This rule detects execution of The Gentlemen ransomware Go encryptor invoked with its signature command line flags controlling self propagation and fast encryption. The presence of these operator flags together indicates active deployment of a self-propagating encryptor and imminent data destruction across the environment.

Suspicious TruffleHog Credential Scanner Execution in Developer Context (via process_creation)

This rule surfaces execution of the TruffleHog secret-scanning tool, which the Shai-Hulud 2.0 worm runs on infected hosts to harvest cloud and repository credentials from local files before exfiltrating them. Because TruffleHog is also a legitimate security tool, this behavior warrants review when it appears on developer or build systems outside sanctioned scanning, where it can indicate active credential theft.

Malicious Shai-Hulud Self-Hosted GitHub Actions Runner Named SHA1HULUD (via process_creation)

This rule detects registration or use of a self-hosted GitHub Actions runner named SHA1HULUD, a distinctive artifact of the Shai-Hulud 2.0 supply chain worm as it establishes persistence in victim GitHub organizations. Adversaries register attacker-controlled runners to execute workflows and exfiltrate secrets from CI pipelines, so the hardcoded runner name is a high-confidence indicator of an active compromise.

Suspicious Remote Monitoring Tool Executing from GoAnywhere Directory

This rule detects remote monitoring and management tools such as SimpleHelp or MeshAgent executing from within a GoAnywhere installation directory. Microsoft observed attackers deploying these RMM tools under GoAnywhere folders following CVE-2025-10035 exploitation to maintain access. RMM binaries running from a file-transfer application path are out of place and indicate attacker-installed remote access.