Sigma detection rules, expert-reviewed

Suspicious MSBuild Execution Spawned by Command Shell for Process Hollowing (via process_creation)

This rule detects MSBuild.exe launched by a command shell or PowerShell without a project or solution file on the command line, an anomaly consistent with the process hollowing target abused by HijackLoader to run AsyncRAT. Genuine MSBuild builds reference a project, solution, or response file.

Suspicious OfficeUpdate.exe Masquerading Word Binary From ProgramData (via process_creation)

This rule detects an executable named OfficeUpdate.exe running from ProgramData, a masqueraded copy of WinWord.exe used to side-load a Cobalt Strike loader. Microsoft Office updates do not execute from this location under that name.

Malicious DLL Side-Loading of Avk.dll by G DATA Binary via PlugX (via image_load)

This rule detects the G DATA Avk.exe binary loading an Avk.dll from the Users Public GDatas directory, the side-loading step that decrypts and injects the PlugX payload. Genuine G DATA installations load their DLLs from the protected Program Files location.

Malicious DLL Side-Loading via Remote Desktop Binaries for DreamLoaders (via image_load)

This rule detects the wksprt.exe or wkspbroker.exe Remote Desktop binaries loading webservices.dll or radcui.dll from outside the Windows system directories, the side-loading step used by the Lazarus DreamLoaders. These signed binaries normally load such DLLs only from System32 or WinSxS.

Malicious DLL Side-Loading of appvisvsubsystems64.dll via Cobalt Strike Loader (via image_load)

This rule detects the AppV appvisvsubsystems64.dll being loaded from the ProgramData directory by a renamed Word binary, the side-loading step that launches a Cobalt Strike beacon. The genuine appvisvsubsystems64.dll ships only inside System32.

Suspicious Group Policy Client-Side Extension Attribute Modification via Directory Service Change

This rule detects Directory Service Changes (Event ID 5136) that add values to the gPCMachineExtensionNames or gPCUserExtensionNames attributes of a Group Policy Object. Attackers modify these client-side extension lists to attach malicious CSE GUIDs that push scheduled tasks or logon scripts domain-wide. Unexpected changes to GPO extension attributes indicate group policy abuse for mass code execution.

Malicious HelloNet AppMgmt ServiceDll Persistence via Registry (via registry_set)

This rule detects modification of the AppMgmt service Parameters ServiceDll or ServiceMain registry values, a persistence mechanism used by the HelloNet campaign to load a malicious service DLL into svchost netsvcs. Hijacking a legitimate service DLL grants the attacker persistent SYSTEM-level execution while blending into normal service host activity.

Suspicious Service Masquerading as Thumbcache Loader via registry_set

This rule detects a Windows service registered as ThumbcacheService or backed by a TmcLoader binary, the persistence mechanism of the GoSerpent backdoor that injects into svchost. The thumbnail cache service name is a masquerade for the loader. A service with this benign sounding identity from an untrusted binary indicates backdoor persistence.

Suspicious UAC Bypass by Disabling Admin Consent Prompt via registry_set

This rule detects ConsentPromptBehaviorAdmin being set to zero, which disables the UAC elevation prompt for administrators. The WhatsApp VBScript campaign changes this to silently gain elevated execution before deploying RMM tooling. Lowering the admin consent behavior is a well-known privilege-escalation and defense-evasion move.

Suspicious Modification of CloudFiles BlockedApps Policy via registry_set

This rule detects writes to the CloudFiles BlockedApps policy key under the default user hive, abused during MiniPlasma privilege escalation through a registry symlink to Volatile Environment. This key is not a normal target for user or application configuration. Tampering here supports the exploit primitive used to elevate privileges.

Suspicious COM Hijack via InprocServer32 Pointing to AppData DLL via registry_set

This rule detects a CLSID InprocServer32 default value being redirected to a DLL located under the user AppData directory. The Argamal RAT distributed through hentai games uses this COM hijack for persistence and stealthy code execution. A COM server pointing into a user-writable path is a classic hijack pattern and rarely legitimate.

Suspicious Disabling of Malicious Software Removal Tool via registry_set

This rule detects the DontOfferThroughWUAU value being set under the MRT policy key to stop Windows from offering the Malicious Software Removal Tool. The pirated-media miner campaign sets this to weaken host defenses. Suppressing built-in cleanup tooling is a defense-evasion tactic that precedes long-term persistence.

Suspicious Service Masquerading as Google Update in ProgramData via registry_set

This rule detects a service ImagePath pointing to a Google Update named binary located under ProgramData\Google\Chrome instead of the legitimate Program Files Google Update directory. The pirated-media miner campaign installs a GoogleUpdateTaskMachineQC service from this wrong location to blend in. A signed-looking name in the wrong path is a strong persistence and masquerading signal.

Suspicious Cloud Atlas Run Key Persistence via YandexBrowser Masquerade (via registry_set)

This rule detects creation of a Run key value named YandexBrowser_setup, an autostart name Cloud Atlas uses to disguise persistence as a legitimate browser installer. The value relaunches attacker tooling at logon while masquerading as benign software. Detecting this value name surfaces registry persistence tied to the campaign.

Malicious COM TypeLib Hijack via Persistence CLSID Registration

This rule detects registration of the TypeLib COM object CLSID {EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B} which corresponds to the Internet Explorer browser control abused for stealthy persistence. The CPU-Z watering-hole campaign hijacked this TypeLib to reload attacker code whenever the component is instantiated as reported by Kaspersky. Writing to this TypeLib registry path is a known COM hijacking persistence and defense-evasion technique.