Sigma detection rules, expert-reviewed

Malicious Rundll32 Execution of Image File Export via PLUSDROP

This rule detects rundll32.exe invoking an export from a file with an image extension staged in an image subfolder, matching the APT41 PLUSDROP loader launched from a malicious LNK to run the TOUGHPROGRESS chain. Attackers disguise the payload as a JPG to bypass extension-based inspection while executing an exported function.

Suspicious ClickFix Clipboard PowerShell Execution from Run Dialog

This rule detects PowerShell launched directly by explorer.exe while fetching and executing remote content inline, matching the ClickFix fake-CAPTCHA lure that tricks users into pasting an attacker command into the Windows Run prompt to stage the LOSTKEYS downloader. This user-driven execution grants COLDRIVER an initial foothold without dropping a file to disk.

Suspicious System Reconnaissance via Windows Script Host

This rule detects a Windows Script Host process (wscript or cscript) spawning built-in reconnaissance utilities such as systeminfo, ipconfig, net view and tasklist, matching the LOSTKEYS VBS payload used by COLDRIVER to profile compromised hosts. This host-profiling burst precedes credential and document theft against Western government and NGO targets.

Suspicious Robocopy of Signal Directory to Public Staging Path by UNC1151 (via process_creation)

This rule detects robocopy copying a Signal application directory into a Users Public staging location, the collection and staging technique UNC1151 used to gather Signal data before exfiltration. Copying messaging data to a shared public path is a common pre-exfiltration staging behavior.

Suspicious sqlcipher Decryption of Signal Database by WAVESIGN (via process_creation)

This rule detects sqlcipher.exe being run against a Signal SQLite database, the decryption step in the WAVESIGN batch tooling used by Russia-aligned actors to read Signal message stores before rclone exfiltration. Command line decryption of a messaging database indicates targeted communications theft.

Malicious CivilDefense Loader Spawning civildefensestarter Payload (via process_creation)

This rule detects the CivilDefense lure executable spawning civildefensestarter.exe, the Pronsis Loader chain used in a Russia-aligned campaign to stage PURESTEALER against Ukrainian military recruits. The parent-child masquerade using civil defense themed filenames indicates second-stage loader execution.

Suspicious Scheduled Task Named Sumatra Launcher by UNC2970 (via process_creation)

This rule detects creation of a scheduled task named Sumatra Launcher, the persistence mechanism UNC2970 registered to run the BURNBOOK loader daily at logon after delivering a trojanized SumatraPDF reader. A logon-triggered task masquerading as a PDF viewer helper indicates backdoor persistence.

Suspicious PEAKLIGHT Memory-Only PowerShell Downloader Flags (via process_creation)

This rule detects PowerShell launched with the hidden window, unrestricted execution policy and no-profile flag combination used by the PEAKLIGHT downloader to fetch and AES-decrypt a memory-resident payload. This flag stacking is characteristic of obfuscated fileless staging.

Malicious IIS Worker Process Spawning conn.exe Web Shell Child by APT41 (via process_creation)

This rule detects the IIS worker process w3wp.exe spawning a masqueraded conn.exe child process, a pattern consistent with APT41 web shell command execution on compromised web servers. A web server process launching arbitrary tooling is a strong indicator of an installed web shell.

Suspicious Oracle Data Export via sqluldr Utility by APT41 (via process_creation)

This rule detects execution of the sqluldr Oracle bulk unload utility, which APT41 used to export data from Oracle databases prior to exfiltration. This uncommon administrative tool is rarely seen in most environments and its presence often indicates staged database theft.

Malicious CrowdStrike Falcon RTR Abuse Downloading From fleetdeck.io by UNC3944 (via process_creation)

This rule detects curl commands reaching the remote management tooling endpoints fleetdeck.io or the external IP echo service icanhazip.com, which UNC3944 executed through abused CrowdStrike Falcon Real Time Response runscript access to stage remote access software. Attacker abuse of a trusted EDR RTR channel to deploy tooling is a strong indicator of hands-on-keyboard intrusion.

Suspicious APT42 Command Obfuscation via Environment Variable Substitution and Call (via process_creation)

This rule detects cmd.exe defining an environment variable and then re-invoking it through call with a character-removal substitution to reconstruct a hidden command such as curl. APT42 used this set and call pattern with variable substitution to obscure download commands from simple string inspection. Building commands from variable substitution at runtime is a deliberate obfuscation technique.

Suspicious Silent MSI Installation of Non-Standard BIN Payload via Msiexec (via process_creation)

This rule detects msiexec silently installing a package that carries a non-standard .bin extension. A malvertising campaign distributing backdoors abused msiexec with a renamed .bin installer and the /qn quiet switch to deploy payloads without user interaction. Silent installation of an unusually named installer via a trusted system binary is a proxy-execution evasion technique.

Suspicious Domain Admins Group Enumeration via Net Command (via process_creation)

This rule detects the net command enumerating the Domain Admins group across the domain. After hijacking Citrix sessions via CVE-2023-4966, the actor performed privileged-group reconnaissance to identify high-value accounts for lateral movement. Querying Domain Admins membership is a classic early post-compromise discovery action.

Suspicious CANONSTAGER DLL Side-Loading via cnmpaui Executable

This rule detects the legitimate Canon utility cnmpaui.exe loading a DLL from a user-writable directory outside its normal Program Files location, matching the PRC-Nexus CANONSTAGER side-loading that launches the SOGU.SEC backdoor. Abusing a signed printer binary lets the actor execute malicious code under a trusted process during espionage against diplomats.