Sigma detection rules, expert-reviewed

Suspicious NetSupport Manager Remote Client Execution (via process_creation)

This rule detects execution of the NetSupport Manager remote-control client32.exe, the remote access tool dropped as the final payload of the GitHub-hosted info stealer chain in this malvertising campaign. Adversaries repurpose the legitimate NetSupport client as a covert RAT for hands-on-keyboard control, so client32.exe running in an environment without a sanctioned NetSupport deployment indicates remote-access compromise.

Suspicious Security Software Discovery via findstr Filtering of AV Process Names (via process_creation)

This rule detects findstr filtering a running process list for security-vendor process names such as wrsa, opssvc, AvastUI, AVGUI, and bdservicehost, the environment-fingerprinting step used by the GitHub-hosted info stealers delivered through this malvertising campaign. Adversaries enumerate installed defenses to decide whether to proceed or evade before deploying NetSupport and stealer payloads, making this tasklist-and-findstr pattern an early execution indicator.

Suspicious ScreenConnect Remote Access Client Spawning PowerShell (via process_creation)

This rule detects a ScreenConnect remote-access client process spawning PowerShell or cmd, an abuse of legitimate remote-management software used by the Seashell Blizzard subgroup to run commands on compromised hosts during the BadPilot campaign. Because adversaries co-opt installed RMM tooling to blend into normal administration, scripting children of ScreenConnect warrant scrutiny in environments where such automation is not expected.

Malicious IIS Worker Process Spawning Command Shell after ASP.NET ViewState Injection (via process_creation)

This rule detects the IIS worker process w3wp.exe spawning command interpreters or reconnaissance utilities, the post-exploitation behavior seen when adversaries inject code through publicly disclosed ASP.NET machine keys to execute the Godzilla framework on an IIS server. Attackers use forged ViewState payloads validated by leaked machineKey values to run arbitrary commands in the web server context, making this parent-child pattern a strong indicator of server compromise before further lateral movement.

Suspicious Windows Defender Support Directory Enumeration via Process Creation

This rule detects a directory listing command targeting the Windows Defender Support folder under ProgramData, a reconnaissance action embedded in the RC4 batch script used by Secret Blizzard during its Amadey and Tavdig deployment chain. Enumerating this Defender path helps the actor assess the environment before staging further payloads.

Suspicious RDP Connection File Opened From Download or Mail Directory via Process Creation

This rule detects the Remote Desktop client opening an .rdp configuration file launched from a downloads, temp or Outlook attachment directory, the delivery vector in the Midnight Blizzard spear-phishing campaign. The malicious signed RDP files enable bidirectional resource mapping of drives, clipboard and printers to attacker servers, exposing local data on connection.

Suspicious Scheduled Task Creation Named SysUpdate via Process Creation

This rule detects creation of a scheduled task named SysUpdate via schtasks, the mechanism Storm-0501 used to deploy Embargo ransomware across hosts through Group Policy. A masquerading update-themed task name pushed to many endpoints can indicate staged ransomware execution.

Suspicious Rclone Exfiltration via Masqueraded svchost Process Creation

This rule detects a process masquerading as svchost through typosquatted names running Rclone-style transfer arguments, a data exfiltration technique used by Storm-0501 to move stolen files to attacker cloud storage. Renaming Rclone to svhost.exe or scvhost.exe is an attempt to hide exfiltration behind a trusted-looking Windows binary name.

Suspicious npm Package Spawning cURL Download via Process Creation

This rule detects an npm or node process spawning curl to fetch a remote payload, a supply chain execution technique in which Moonstone Sleet distributed malicious npm packages that pulled the SplitLoader malware during install. A package manager launching a download utility is unusual and can indicate a trojanized dependency.

Suspicious LSASS Memory Dump via Procdump Process Creation

This rule detects Procdump being run against the LSASS process to capture a memory dump for offline credential extraction, a technique used by the North Korean actor Moonstone Sleet during intrusions. Dumping LSASS yields plaintext and hashed credentials that enable lateral movement and privilege escalation.

Suspicious OpenSSH Reverse Tunnel Creation via Process Creation

This rule detects the Windows OpenSSH client creating a reverse port-forwarding tunnel, a technique used after Quick Assist abuse to establish covert remote access into compromised environments. Operators tunnel traffic to maintain access and move laterally, so an interactive ssh reverse tunnel from an endpoint is worth reviewing.

Malicious Forest Blizzard GooseEgg Persistence via WinSrv Scheduled Task as SYSTEM (via process_creation)

This rule detects creation of a scheduled task under the Microsoft Windows WinSrv path running as SYSTEM. Forest Blizzard registered this task with schtasks to persist and run its GooseEgg exploitation tool with elevated privileges.

Suspicious curl Download Launched from PDF Shortcut Lure (via process_creation)

This rule detects curl.exe fetching remote content when spawned from a shortcut with a double pdf.lnk extension. Mint Sandstorm delivered fake PDF shortcuts that invoked curl to download follow-on payloads.

Malicious MSIX Package Execution via App Installer ms-appinstaller Protocol (via process_creation)

This rule detects the Windows App Installer binary launching a remote MSIX package through the ms-appinstaller protocol handler and ServerName argument. Financially motivated actors abused this vector to deliver BATLOADER and Cobalt Strike while bypassing SmartScreen.

Malicious TeamCity Persistence via Scheduled Task Masquerading as Settings UI (via process_creation)

This rule detects creation of a scheduled task named Windows TeamCity Settings User Interface. North Korean actors registered this deceptively named task after exploiting TeamCity CVE-2023-42793 to persist their implant on the server.