Sigma detection rules, expert-reviewed

Malicious APT29 WINELOADER DLL Side-Load of vcruntime140.dll via SqlDumper (via image_load)

This rule detects the Microsoft SqlDumper.exe binary loading a vcruntime140.dll from a non-standard directory, the side-load chain APT29 used to run the WINELOADER backdoor. The actor paired a legitimate signed executable with a malicious runtime DLL to gain trusted execution. SqlDumper loading vcruntime140.dll outside canonical install paths is a high-fidelity side-loading indicator.

Suspicious Creation of PROMPTFLUX Thinking Robot Log in Temp

This rule detects creation of the thinking_robot_log.txt artifact in the Temp directory written by the PROMPTFLUX VBScript dropper that queries the Gemini API to regenerate itself. Attackers use this AI assisted metamorphic loader to evade static signatures.

Suspicious Thumbs.ini File Written to AppData by UNC2970 MISTPEN (via file_event)

This rule detects creation of a file named Thumbs.ini in a user AppData directory, a working file the UNC2970 MISTPEN backdoor writes while masquerading as the legitimate Thumbs.db thumbnail cache. The anomalous extension in an unexpected location indicates backdoor staging.

Possible Residential Proxyware Beacon to PacketSDK Infrastructure

This rule detects DNS lookups for proxyware SDK command infrastructure such as packetsdk and hexsdk and castarsdk domains used by residential proxy networks. Such beacons indicate a host has been enrolled as a proxy exit node without authorization.

Suspicious Service Creation Loading TSVIPSrv.DLL via DreamLoaders (via service_creation)

This rule detects the creation of a Windows service whose image path references TSVIPSrv.dll, the loader-execution mechanism used by the Lazarus DreamLoaders to run malicious code under a service. Legitimate services do not register this DLL through a newly created service entry.

Suspicious Registry Run Key Persistence for DeedRAT MicRun Loader (via registry_set)

This rule detects a MicRun Run key value pointing to the ProgramData Micro directory, the persistence mechanism used by DeedRAT to relaunch its side-loading binary at logon. Legitimate software does not autostart executables from this path under the name MicRun.

Suspicious Chromium Browser Launch With Covert Media Capture Flags via DRILLAPP (via process_creation)

This rule detects an Edge or Chromium browser started with flags that auto-approve and silently select media and screen capture sources, the covert audio and screen recording setup used by the DRILLAPP backdoor. Legitimate browser sessions do not suppress the media capture prompt in this way.

Suspicious Chromium Browser Launch With Remote Debugging for DRILLAPP (via process_creation)

This rule detects an Edge or Chromium browser started with remote debugging and web security disabled, the automation setup used by the DRILLAPP backdoor to drive the browser through the Chrome DevTools Protocol. Everyday browsing does not combine these flags.

Malicious G DATA Avk.exe Masquerading From Public Folder via PlugX (via process_creation)

This rule detects the legitimately named G DATA Avk.exe binary executing from the Users Public GDatas directory, a masquerading and side-loading technique used to run the PlugX RAT. Genuine G DATA components run from Program Files, not the public user folder.

Suspicious Outlook Process Spawning Network Utilities for NotDoor C2 (via process_creation)

This rule detects the Outlook process spawning nslookup or curl, behavior used by the NotDoor backdoor to exfiltrate the username through DNS lookups and HTTP requests to attacker infrastructure. Outlook does not normally launch these command line network utilities.

Suspicious svchost Execution With Anomalous Arguments via DeedRAT (via process_creation)

This rule detects svchost.exe launched with an underscore-delimited uppercase argument pattern and without the standard service host -k switch, an execution anomaly produced when DeedRAT injects into svchost. Genuine svchost instances are started by services.exe with a -k service group argument.

Suspicious MSBuild Execution Spawned by Command Shell for Process Hollowing (via process_creation)

This rule detects MSBuild.exe launched by a command shell or PowerShell without a project or solution file on the command line, an anomaly consistent with the process hollowing target abused by HijackLoader to run AsyncRAT. Genuine MSBuild builds reference a project, solution, or response file.

Suspicious OfficeUpdate.exe Masquerading Word Binary From ProgramData (via process_creation)

This rule detects an executable named OfficeUpdate.exe running from ProgramData, a masqueraded copy of WinWord.exe used to side-load a Cobalt Strike loader. Microsoft Office updates do not execute from this location under that name.

Malicious DLL Side-Loading of Avk.dll by G DATA Binary via PlugX (via image_load)

This rule detects the G DATA Avk.exe binary loading an Avk.dll from the Users Public GDatas directory, the side-loading step that decrypts and injects the PlugX payload. Genuine G DATA installations load their DLLs from the protected Program Files location.

Malicious DLL Side-Loading via Remote Desktop Binaries for DreamLoaders (via image_load)

This rule detects the wksprt.exe or wkspbroker.exe Remote Desktop binaries loading webservices.dll or radcui.dll from outside the Windows system directories, the side-loading step used by the Lazarus DreamLoaders. These signed binaries normally load such DLLs only from System32 or WinSxS.