Sigma detection rules, expert-reviewed

Malicious PathWiper Loader Script Execution from Windows Temp via WScript

This rule detects wscript.exe executing uacinstall.vbs from the C:\Windows\Temp directory, the loader stage of the PathWiper wiper used against Ukrainian critical infrastructure. A VBScript with this name running from Windows Temp is the delivery vehicle that drops and launches the destructive wiper payload.

Suspicious Free Space Wipe via cipher.exe

This rule detects cipher.exe invoked with the /w switch to overwrite unallocated disk space, an anti-recovery action used by the fake AI-tool installer ransomware to prevent carving of deleted originals. Wiping free space alongside encryption inhibits data recovery and signals destructive intent on the host.

Malicious IIS Worker Process Spawning Command Shell Reconnaissance

This rule detects the IIS worker process w3wp.exe spawning cmd.exe or powershell.exe to run host reconnaissance such as ipconfig, tasklist or dir. UAT-6382 exploited a Cityworks zero-day to drop web shells and then executed this recon under the web server context, a hallmark of post-exploitation web-shell activity that precedes tooling download and Cobalt Strike deployment.

Suspicious NFe-Themed Brazilian Lure Executable Execution

This rule detects execution of NFe (Nota Fiscal) invoice-themed droppers such as AGENT_NFe, Boleto_NFe or NOTA_FISCAL_NFe executables that carry a random suffix. This Brazil-focused spam campaign delivered these lures via Dropbox to trick recipients into launching them, after which trial-account RMM software is installed to grant the operator remote access.

Malicious Local Account Creation of Support or Whiteninja via net.exe

This rule detects creation of the local accounts support or whiteninja using net user add, the backdoor accounts provisioned by the ToyMaker access broker after gaining a foothold. Attacker-created local accounts give the operator a persistent, credentialed re-entry path that survives reboots and is later reused by the double extortion crews ToyMaker sells access to.

Malicious Scheduled Task Masquerading as GoogleUpdate Launching SSH Reverse Shell

This rule detects creation of a scheduled task named GoogleUpdateTaskMachine whose action invokes OpenSSH to establish a reverse shell. The ToyMaker access broker registers this masqueraded task so an outbound SSH connection provides durable remote access, letting the operator hand off footholds to ransomware affiliates while appearing to be a benign updater.

Suspicious ToyMaker LAGTOY Service Creation Masquerading as WmiPrvSV via sc.exe

This rule detects creation of a Windows service named WmiPrvSV via sc.exe, a name that mimics the legitimate WMI Provider Host (WmiPrvSE) to blend in. The LAGTOY implant used by the ToyMaker initial access broker installs itself under this masqueraded service name for persistence, so this is a strong indicator of that access broker preparing hands-on-keyboard follow-up for double extortion gangs.

Malicious Impacket Wmiexec Remote Command Execution Pattern

This rule detects the command redirection pattern produced by Impacket wmiexec where cmd.exe is spawned by WmiPrvSE.exe to run a command and write output to a local admin share path. This semi interactive execution over WMI is a hallmark of lateral movement using stolen credentials as seen in the UAT-5918 activity.

Malicious Credential Dumping via Mimikatz Sekurlsa Command

This rule detects command line usage of the mimikatz sekurlsa module which the intrusion set used to extract plaintext credentials and hashes from LSASS memory during the attacks on Japanese targets. The sekurlsa keyword in a command line is a high confidence indicator of credential theft tooling even when the binary has been renamed.

Suspicious PowerShell Remote Payload Download via IEX DownloadString

This rule detects PowerShell invoking Invoke-Expression together with a WebClient DownloadString call which the attackers used to fetch and execute in memory payloads during the campaign targeting Japan. Combining remote content download with immediate expression execution is a common fileless delivery technique.

Malicious PowerShell Spawned by PHP CGI Process

This rule detects the php-cgi.exe process spawning PowerShell which indicates exploitation of CVE-2024-4577 argument injection to achieve remote code execution on Windows PHP servers as seen in the persistent attacks against Japanese organizations. A web facing PHP CGI interpreter launching PowerShell is not expected during normal operation and signals server compromise.

Suspicious Executable Running from Public Pictures Directory

This rule detects execution of binaries located under the Users Public Pictures directory which the Lotus Blossom group uses as a staging location for its hacking tools and backdoor components. Executables running from a media folder that normally holds only images are a strong indicator of tool drop and execution.

Suspicious Python Execution via Renamed Synaptics Binary

This rule detects a process named synaptics.exe executing inline interpreter code through a dash c argument which the PXA Stealer campaign achieves by shipping a portable Python interpreter renamed to synaptics.exe to blend in with the legitimate touchpad driver. Running interpreter style command arguments from a synaptics named binary is a masquerading indicator of stealer execution.

Suspicious Remote Admin Share Execution via Conhost

This rule detects the console host process conhost.exe launched with arguments referencing a remote administrative admin share which Interlock ransomware operators abuse for lateral movement and remote command execution. Conhost invoked with a remote drive share path is anomalous because it is normally spawned locally by console applications without any network share argument.

Malicious Scheduled Task Creation TaskSystem via Interlock Ransomware

This rule detects creation of a scheduled task named TaskSystem that runs in the SYSTEM context which Interlock ransomware operators use to establish persistence and execute payloads with elevated privileges. The fixed task name combined with SYSTEM execution distinguishes this from routine administrative task creation.