Sigma detection rules, expert-reviewed

Suspicious Shadow Vector Persistence via Schtasks OnLogon Highest from AppData (via process_creation)

This rule detects schtasks creating an onlogon task at highest run level pointing at an executable in AppData Roaming, the persistence used by the Shadow Vector campaign delivering AsyncRAT through court-themed SVG decoys to Colombian users. Adversaries register a high-privilege logon task that relaunches their payload from a user-writable path. An onlogon highest task targeting Roaming is a strong persistence indicator.

In-Memory Ramnit Process Injection Target Spawned by WmiPrvSE in drIBAN Fraud Operation (via process_creation)

This rule detects the WMI provider host WmiPrvSE.exe spawning ImagingDevices.exe, Wab.exe, or Wabmig.exe, the seldom-executed signed Windows binaries that Ramnit uses as injection hosts after sLoad delivery in the drIBAN banking-fraud operation. Adversaries launch these low-noise processes from WMI to host injected banking-trojan code under a trusted image, making early detection critical for surfacing the intrusion before man-in-the-browser fraud.

Suspicious DLL Sideloading via NtHandleCallback Loading log.dll for Winos RAT (via image_load)

This rule detects the signed white file NtHandleCallback.exe loading a log.dll from outside trusted system directories, a DLL sideloading chain used by the SwimSnake (Silver Fox) group to decrypt and inject the Winos remote access trojan. Adversaries pair a legitimately signed executable with a malicious companion DLL to run code under a trusted process, making early detection critical for surfacing the loader before RAT injection.

Malicious DBatLoader DLL Sideloading via easinvoker.exe Loading netutils.dll (via image_load)

This rule detects the auto-elevating binary easinvoker.exe loading a netutils.dll from outside System32, the DLL hijacking and UAC bypass chain DBatLoader uses to run malicious code with elevated privileges. Adversaries place the legitimate signed executable alongside a rogue netutils.dll to inherit auto-elevation, making early detection critical for catching privilege escalation before injection into SndVol.exe or iexpress.exe.

Malicious DEVMAN Ransomware Encrypted File and Note Artifacts

This rule detects files encrypted by DEVMAN ransomware, identified by the .DEVMAN extension and the deterministically renamed ransom note e47qfsnz2trbkhnt.devman. DEVMAN is a DragonForce variant that encrypts its own note, producing this fixed filename.

DoT (DNS Over TLS) Activation - PowerShell (via powershell)

This rule detects enable DNS over TLS in order to evade detection for command and control purposes.

Suspicious DLL Load from Public Directory by svchost (via image_load)

This rule detects svchost.exe loading a DLL from the C:\Users\Public staging directory, an abnormal side-loading pattern used by the Ashen Lepus AshTag suite with modules such as netutils.dll and wtsapi32.dll. Legitimate svchost service DLLs load from System32, so a load out of a world-writable staging path indicates side-loaded malware.

In-Memory AMSI Bypass via amsiInitFailed Field Manipulation in PowerShell (via ps_script)

This rule detects a PowerShell script block that sets the amsiInitFailed field to True, the in-memory AMSI bypass used by the agent1.ps1 stage of an Azorult campaign smuggled through Google Sites. Forcing amsiInitFailed disables Antimalware Scan Interface inspection so later stages run unscanned, making this a high-confidence defense-evasion signal.

Suspicious Outbound Firewall Block Rule Added via Netsh Advfirewall

This rule detects netsh advfirewall being used to add a rule that blocks outbound traffic, a technique observed in the ESXi intrusion to sever host communication with external security or management services. Attackers block outbound connections to prevent EDR telemetry and updates from reaching the network. An added block rule targeting outbound direction on a server is an atypical administrative action worth reviewing.

Suspicious CTFMON Masqueraded Binary Execution (via process_creation)

This rule detects execution of CTFM0N.exe, a filename crafted to impersonate the legitimate Windows ctfmon.exe by replacing the letter O with a zero. SugarGh0st deployed this binary as its persistent RAT component.

Malicious Volume Shadow Copy Deletion via Vssadmin

This rule detects vssadmin deleting all volume shadow copies which the actors in the Sliver and PoshC2 toolkit intrusion ran to inhibit recovery ahead of impact and this matters because deleting every shadow copy removes the primary local restore path and is a defining pre encryption ransomware action rarely performed by legitimate administrators.

Suspicious Flax Typhoon System Utility Masquerade Outside System32 via Renamed VPN Client (via process_creation)

This rule detects processes named conhost.exe or dllhost.exe executing from a directory other than the Windows system folders. Flax Typhoon renamed the SoftEther VPN client to these trusted binary names to blend in while tunneling traffic over TCP 443 for covert remote access.

Suspicious dllhost.exe Spawned with CLSID and Anomalous Parent (via process_creation)

This rule detects dllhost.exe running with a GUID/CLSID on its command line while not being parented by svchost.exe. Medusa ransomware leverages a COM elevation moniker so that dllhost hosts a malicious auto-approved COM object, and the abnormal parent process reveals the UAC bypass rather than legitimate COM surrogate activity.

Malicious ms-settings DelegateExecute UAC Bypass Registry Change

This rule detects creation of the ms-settings Shell Open command key together with the DelegateExecute value which is the registry state used to bypass UAC through computerdefaults.exe. The Batavia spyware abuses this technique to elevate silently before stealing data from Russian organizations. Writes to this ms-settings hijack path are almost always malicious.

Malicious KB Document Masqueraded Executable Spawned by Script Interpreter via RoKRAT Loader (via process_creation)

This rule detects execution of an executable named to impersonate a Windows KB update document such as KB400928_doc.exe when launched by cmd.exe or powershell.exe, as seen in the APT37 ToyBox Story cmd to powershell to payload chain delivering RoKRAT. The KB prefix with a _doc.exe suffix masquerades the payload as a benign document while it runs as a program. Catching this masqueraded binary being spawned by a script interpreter exposes the final loader execution stage.