Sigma detection rules, expert-reviewed

Suspicious cmd.exe Launching Encoded PowerShell From Shortcut File

This rule detects cmd.exe spawning PowerShell with an encoded command, a chain used by the Maverick banking Trojan distributed through WhatsApp. The malicious LNK launches cmd.exe which decodes and passes an obfuscated command to PowerShell. This layered command interpreter abuse is a common initial-access execution pattern designed to hide the real payload from casual inspection.

Suspicious Malicious MCP Package devtools-assistant Execution (via process_creation)

This rule detects installation or execution of the devtools-assistant package a trojanized MCP server used in a supply-chain attack against AI development tooling. Once run it enumerates and exfiltrates developer credentials from files such as .env .aws and .ssh. Catching the pip install or python module invocation flags the compromise at the point of execution.

Malicious LSASS Memory Dump via dllhost ProcDump Masquerade (via process_creation)

This rule detects a process named dllhost.exe running with ProcDump style arguments to create a full memory dump of lsass.exe as observed with the PipeMagic backdoor. The genuine dllhost COM surrogate never accepts these switches so this is a renamed ProcDump used to steal credentials from LSASS. Capturing LSASS memory yields hashes and tickets for further compromise.

Suspicious MSBuild Execution of MSHI Metafile via cmd (via process_creation)

This rule detects cmd.exe launching msbuild with a metafile that has an mshi extension a loader pattern used by the PipeMagic backdoor. PipeMagic was seen in RansomExx activity and in exploitation of the CVE-2025-29824 privilege escalation. Abusing the trusted MSBuild binary to compile and run an inline task lets the operator execute code while evading application controls.

Suspicious Chrome Masquerade Running from ProgramData Google Path (via process_creation)

This rule detects a process named chrome.exe executing from a google folder under ProgramData as used by the GodRAT browser-credential stealer. The genuine Chrome browser installs under Program Files or the user AppData not ProgramData so this path is a masquerade. Running a fake chrome from ALLUSERSPROFILE indicates the stealer harvesting saved browser secrets.

Suspicious GodRAT Shellcode Injection via Puppet Argument (via process_creation)

This rule detects execution of curl.exe or cmd.exe with a -Puppet argument which GodRAT abuses as an injection target and marker to run its shellcode inside a benign process. GodRAT is a remote access tool targeting financial institutions and delivered through Skype using script and screensaver files. The unusual -Puppet switch on these system binaries is a distinctive sign of the loader.

Suspicious wscript Executing Single-Letter VBS Loader

This rule detects wscript or cscript running one of the single-letter helper scripts a.vbs b.vbs or m.vbs dropped by the malicious Cursor extension chain. These VBScripts stage the ScreenConnect installer and downstream Quasar and PureLogs payloads. The specific script names invoked by the Windows Script Host are a reliable campaign artifact.

Suspicious Cursor Editor Process Spawning PowerShell

This rule detects the Cursor AI editor spawning PowerShell which a malicious open-source extension abuses to run its payload through the trusted editor process. This supply-chain compromise turned a Cursor package into a crypto heist that deployed Quasar and PureLogs via ScreenConnect. A code editor launching PowerShell is an uncommon and high-value execution path to monitor.

Suspicious computerdefaults.exe Spawning Child Process

This rule detects computerdefaults.exe launching a child process which indicates the auto-elevating binary is being abused for a ms-settings UAC bypass. The Batavia spyware chains this to run its payload with elevated privileges without a consent prompt. A child process under computerdefaults.exe is unusual since the tool normally opens a settings UI only.

Malicious Root Certificate Installation via certutil

This rule detects certutil adding a certificate to the LocalMachine Root store which BrowserVenom performs so its proxy can transparently intercept TLS traffic. Installing an attacker certificate into the trusted root store undermines HTTPS validation across the whole system. Root store additions by certutil outside managed deployments deserve scrutiny.

Suspicious Browser Launched With Injected Proxy Server Argument

This rule detects a web browser process started with a --proxy-server argument which BrowserVenom injects through a malicious shortcut to route all victim traffic through an attacker-controlled proxy. This lets the operator intercept and manipulate browsing including credential and cryptocurrency theft. A browser forced onto an external proxy via its command line is a strong tampering signal.

Suspicious blat Utility Used for SMTP Data Exfiltration

This rule detects use of the blat command-line mailer with server and attachment arguments which the Librarian Ghouls APT abuses to email stolen data out over SMTP. Blat is a legitimate but uncommon utility that provides a simple exfiltration channel over an alternate protocol. Its presence sending attachments to an external server on endpoints is suspicious.

Suspicious Scheduled Task for Nightly Wake and Shutdown Automation

This rule detects schtasks creating tasks that wake the machine and launch a browser or shut it down at fixed early-morning hours which the Librarian Ghouls APT uses to operate while victims are away. This nocturnal scheduling hides data theft and mining activity from users. Task names combining wake or shutdown with power configuration are characteristic of the campaign.

Suspicious PIF AutoIt Interpreter Executing a3x Compiled Script

This rule detects a renamed AutoIt interpreter with a .pif extension executing a compiled .a3x script. This packaging is used in Lumma Stealer delivery to run obfuscated AutoIt payloads while hiding the interpreter behind an unusual extension. The .pif image plus .a3x argument is a strong behavioral indicator of AutoIt-based loaders.

Suspicious ping Loopback Delay Chained With Payload Execution

This rule detects ping.exe issuing a high count of echo requests to localhost which malware uses as a sleep timer to evade sandbox analysis. Lumma Stealer distribution chains use a ping delay to loopback before launching subsequent stages. The large repeat count against localhost is uncommon in legitimate automation.