Sigma detection rules, expert-reviewed

Suspicious Microsoft Edge Headless Launch with Unpacked Extension via SNOWBELT (via process_creation)

This rule detects Microsoft Edge started in headless mode while side-loading an unpacked extension from disk, the technique UNC6692 used to run the SNOWBELT browser extension during the Snow Flurries social engineering campaign. Adversaries abuse headless browser automation with loaded extensions to access and proxy data while blending into normal browser activity, so this launch pattern warrants investigation.

Suspicious Scheduled Task Launching rundll32 DLL via Ransomware

This rule detects schtasks creating a task that periodically executes rundll32 against a DLL as observed in ransomware persistence and re execution routines. Attackers schedule loader DLLs to survive reboots and re trigger their payload on a recurring interval.

Malicious Defender Tampering via Registry DisableRealtimeMonitoring

This rule detects reg.exe writing the DisableRealtimeMonitoring or DisableAntiSpyware values to disable Microsoft Defender protections as commonly seen in ransomware pre encryption staging. Attackers turn off real time scanning so their tooling and payloads can run undetected.

Suspicious msdt Execution of Audio Diagnostic via UNC1069 ClickFix

This rule detects msdt.exe launching the AudioPlaybackDiagnostic troubleshooter which UNC1069 abuses in ClickFix lures alongside mshta to execute payloads. Attackers use the Microsoft diagnostic tool as a living off the land execution proxy after socially engineering the victim.

Windows Registry: AuthorizedApplications List Enabled Firewall Exceptions

Flags registry updates that enable per-application Microsoft Defender Firewall exceptions via AuthorizedApplications\List.

Windows Registry Modification: Re-enable Microsoft Defender Firewall Exceptions (DoNotAllowExceptions=0)

Alerts when DoNotAllowExceptions is set to 0 in the Defender Firewall policy registry path, re-enabling firewall exceptions.

Suspicious Deletion of Terminal Server Client History via reg by UNC1549

This rule detects reg.exe deleting the Terminal Server Client history keys that store previously connected RDP hosts as observed in UNC1549 anti forensic activity. Attackers remove these keys to hide lateral movement targets from responders.

Suspicious Child Process Spawned by Triofox GladinetCloudMonitor

This rule detects the Triofox GladinetCloudMonitor process spawning a command interpreter which follows exploitation of CVE-2025-12480. Attackers abuse the built in anti virus feature to execute attacker controlled batch and PowerShell commands as SYSTEM.

Suspicious bitsadmin Download of Python Payload via COLDRIVER

This rule detects bitsadmin transferring a Python script such as libsystemhealthcheck.py as used by COLDRIVER to stage its backdoor. Attackers abuse the BITS service as a living off the land download channel that blends with normal update traffic.

Suspicious Registry Class Key Creation for COLDRIVER Persistence

This rule detects reg.exe adding an unusual file extension class key named pietas under HKCU Software Classes with binary data as observed in COLDRIVER intrusions. Attackers abuse custom class associations to hide configuration or trigger loader execution.

Suspicious Scheduled Task Running pythonw From AppData via COLDRIVER

This rule detects creation of a scheduled task that launches pythonw.exe from a Python38-64 directory under AppData as used by COLDRIVER to persist a health check backdoor. Attackers use this to maintain a stealthy Python based foothold masquerading as a system maintenance job.

Suspicious PowerShell Loader Spawned by mshta via UNC5142 ClickFix

This rule detects mshta.exe spawning powershell.exe as observed in UNC5142 EtherHiding campaigns where an HTA disguised as an XLL launches an in-memory VIDAR or LUMMAC.V2 loader. Attackers abuse this chain to execute stager code from a fake browser update lure while evading disk based detection.

Malicious ESX Admins Group Creation via WinRM Host

This rule detects the WinRM provider host wsmprovhost.exe launching net.exe to create or modify a group named ESX Admins, matching the UNC3944 technique that abuses a default vSphere Active Directory integration to grant full administrative rights over the ESXi estate. This privilege escalation precedes VM theft and hypervisor-level ransomware.

Suspicious Rundll32 Loading Non-DLL Image Extension File

This rule detects rundll32.exe executing an export from a file carrying an image or media extension rather than a DLL, a defense-evasion pattern used by APT41 PLUSDROP to conceal its loader payload. Running exported code from a masqueraded file lets the actor stage process injection into svchost.exe.

Malicious Rundll32 Execution of Image File Export via PLUSDROP

This rule detects rundll32.exe invoking an export from a file with an image extension staged in an image subfolder, matching the APT41 PLUSDROP loader launched from a malicious LNK to run the TOUGHPROGRESS chain. Attackers disguise the payload as a JPG to bypass extension-based inspection while executing an exported function.