Sigma detection rules, expert-reviewed

Malicious Marbled Dust OMServerService VBScript Dropped to Startup Folder

This rule detects the creation of OMServerService.vbs inside the Start Menu Startup folder. Microsoft observed the Marbled Dust actor abusing an Output Messenger zero-day to drop this file via path traversal for persistence. Placing a VBScript in the Startup folder guarantees execution at logon, so this file event strongly indicates the espionage intrusion.

Suspicious Web Shell ASPX File Created in Exchange OWA Auth or SharePoint LAYOUTS Path (via file_event)

This rule detects creation of web-shell ASPX files named getidtoken.aspx or signout.aspx within Exchange OWA authentication, aspnet_client, or SharePoint LAYOUTS directories, the persistence artifacts dropped in attacks against on-premises Exchange and SharePoint servers. Adversaries place shells with authentication-themed names in trusted server paths to blend in and retain access, so these files appearing in those locations indicate web-shell installation.

Suspicious CLFS Base Log File Created in SkyPDF ProgramData Path during Zero-Day Exploitation (via file_event)

This rule detects creation of the CLFS base log file PDUDrv.blf under a SkyPDF ProgramData directory, the on-disk artifact of the Common Log File System zero-day exploitation that precedes privilege escalation and ransomware deployment. Adversaries craft a malicious .blf to trigger the CLFS vulnerability, so this specific file path appearing on a host is a strong indicator of exploitation.

Malicious ESX Admins Group Added to Privileged Directory Group

This rule detects an Active Directory security event adding an ESX Admins group or member, matching the UNC3944 method of creating that specific group name to inherit administrative access to vSphere through its default AD integration. The distinctive group name indicates targeting of the virtualization estate rather than routine administration.

Malicious STOCKSTAY Registry Run Key Persistence via MARKETMAKER Binaries (via registry_set)

This rule detects Registry Run key persistence whose value points to the StockMarketView, SMNet, or SMEditor executables used by Turla's MARKETMAKER loader in the STOCKSTAY intelligence gathering activity. Adversaries register these binaries under benign-looking run values to relaunch their toolset at logon, so this persistence entry is a reliable indicator of the campaign.

Suspicious Registry Run Key Persistence Masquerading as CanonPrinter

This rule detects creation of a Run key value named CanonPrinter, matching SOGU.SEC persistence that hides behind a Canon printer software name to relaunch the backdoor at logon. This trusted-name autorun entry maintains PRC-Nexus access to targeted diplomatic hosts across reboots.

Suspicious Registry Run Key Persistence Masquerading as Dropbox

This rule detects creation of an HKCU Run key value named Dropbox that points to an executable outside the legitimate Dropbox installation directory, matching STARKVEIL and FROSTRIFT persistence that hides behind a trusted application name. This false-context autorun entry survives reboot and relaunches the backdoor at logon.

Suspicious Windows Service Masquerading as Windows Defend by APT41 (via registry_set)

This rule detects creation of a Windows service registry key named Windows Defend, a deliberate misspelling of Windows Defender used by APT41 to blend malicious persistence with legitimate security tooling. Services impersonating security products are a defense evasion technique that grants persistent SYSTEM execution.

Malicious UNC1549 OneDrive-Masquerading Run Key Persistence (via registry_set)

This rule detects Run key values named to impersonate OneDrive components such as OneDriveFileCoAuth or OneDriveCoUpdate. UNC1549 planted these autorun entries to relaunch MINIBIKE side-loading at logon while blending with genuine OneDrive tasks. A Run value borrowing the OneDrive brand for a non-standard executable path is a persistence and masquerading indicator.

Suspicious Rundll32 Persistence via Registry Run Key (via registry_set)

This rule detects a Run key value being set to launch rundll32 at logon. The malvertising backdoor established persistence by writing a Run key that invokes rundll32 against a dropped DLL. Autorun entries that proxy execution through rundll32 are a well-known persistence and defense-evasion combination.

Suspicious Firewall Rule Allowing SSH via New-NetFirewallRule During Ransomware

This rule detects a PowerShell New-NetFirewallRule command that opens the host for sshd inbound access as observed when ransomware operators enable SSH for lateral movement and persistence. Attackers create this rule to establish a resilient remote access path across the environment.

Suspicious PowerShell Compress-Archive of Signal Configuration by Turla (via ps_script)

This rule detects PowerShell using Compress-Archive to package Signal configuration and database files, the collection step Turla performed to stage Signal data for exfiltration. Archiving a specific messaging application data directory indicates targeted collection of private communications.

Suspicious APT42 Remote Payload Download via PowerShell Web Client (via ps_script)

This rule detects PowerShell using wget, curl, or Invoke-WebRequest aliases to retrieve a remote configuration or payload file such as nconf.txt. APT42 pulled staged text-based payloads over PowerShell during post-compromise tooling deployment. Scripted retrieval of remote text payloads is a common ingress-tool-transfer behavior worth correlating with follow-on execution.

Suspicious APT42 SMB Share Discovery via Invoke-HuntSMBShares (via ps_script)

This rule detects execution of the Invoke-HuntSMBShares PowerShell cmdlet used to enumerate accessible network shares and their permissions. APT42 ran this PowerHuntShares tooling to map file shares for data collection during their operations. Broad SMB share hunting from PowerShell is a strong network discovery indicator in interactive intrusions.

Suspicious Rclone Data Transfer to Cloud Storage (via process_creation)

This rule detects execution of rclone with a copy, sync, or move operation, matching the bulk exfiltration to Google Drive observed in the targeted campaign against US law firms. Adversaries use rclone to stage and transfer large volumes of harvested documents to attacker-controlled cloud storage, so its presence on endpoints should be reviewed for unauthorized data movement.