Sigma detection rules, expert-reviewed

NitrogenLoader Sideloading via Renamed Setup Binary Loading python312.dll (via image_load)

This rule detects a setup.exe process loading python312.dll, the DLL sideloading pair used by the Nitrogen campaign where a renamed python.exe host loads a malicious NitrogenLoader DLL mirroring the exports of a genuine Python runtime. Adversaries leverage this trojanized installer bundle delivered through malvertising to stage Cobalt Strike, making detection valuable for catching the loader before beacon injection.

Suspicious Python or uv Execution Spawned by AI CLI Assistant

This rule detects the python or uv interpreter launched as a child of an AI command line assistant such as the Claude or Gemini CLI which reflects adversaries directing these agents to run local code during hands on abuse. Because AI CLI tools can execute arbitrary commands on behalf of a user they can be steered into running attacker supplied scripts. Detecting unexpected interpreter children of AI assistants supports hunting for this emerging abuse.

Suspicious RegSvcs Reflective .NET Load from Fake Update Chain

This rule detects PowerShell spawning RegSvcs.exe which is abused as an injection target for reflectively loaded .NET payloads decoded from disguised png files. This behavior was seen in fake browser update campaigns delivering BitRAT and Lumma Stealer. Attackers pick RegSvcs as a signed host to execute malicious code under a trusted image name.

Suspicious HelloNet SSH Reverse Tunnel via frontpage.exe (via process_creation)

This rule detects execution of frontpage.exe with an SSH reverse port-forwarding argument, a renamed SSH client used by the HelloNet campaign to establish an outbound reverse tunnel on port 8443. Attackers use such tunnels to expose internal services and maintain covert remote access to compromised hosts.

Malicious Credential Harvesting via LaZagne (via process_creation)

This rule detects command lines invoking the LaZagne credential-recovery tool, which extracts passwords from browsers, mail clients, Wi-Fi and dozens of other stores in one pass. LaZagne is a credential-access tool observed in intrusions profiled in the Red Canary Threat Detection Report. Detecting its execution surfaces bulk credential theft on the host.

Malicious Shadow Copy and Backup Deletion for Ransomware Recovery Inhibition

This rule detects deletion of volume shadow copies and backup catalogs through vssadmin wmic and wbadmin which Phobos ransomware runs before encryption to prevent victims from restoring their files. Inhibiting system recovery is a common precursor to file encryption and warrants immediate response.

Suspicious mshta Execution of Remote HTA Payload

This rule detects mshta fetching and executing an HTA from a remote URL, a proxy execution step in ACR Stealer intrusion chains that leads to PowerShell staging. Running a remote HTML application through a trusted Windows binary evades application controls and initiates the infostealer delivery chain.

Suspicious Startup Folder Redirection via User Shell Folders by MuddyWater (via registry_set)

This rule detects modification of the Startup value under the Explorer User Shell Folders registry key, a persistence technique MuddyWater uses to redirect the startup directory so its payload autoruns at logon. Tampering with this key silently changes where Windows looks for startup items. Detecting the change exposes stealthy persistence.

Malicious Octo Tempest Credential Theft Tooling (via process_creation)

This rule detects execution of credential theft tools including LaZagne gosecretsdump and ADFSDump. Octo Tempest used these utilities to harvest local secrets and AD FS token-signing material for federation abuse.

Malicious LitterDrifter VBScript Execution via wscript trash.dll

This rule detects wscript.exe running a file named trash.dll through the VBScript engine with LitterDrifter specific arguments. This behavior belongs to the Gamaredon LitterDrifter USB worm which uses the Windows script host to launch its orchestrator module. Detecting it exposes initial execution of the worm on the host.

Suspicious msiexec Remote Package Installation over HTTP

This rule detects msiexec.exe installing a package directly from an http or https URL in quiet mode, a NetSupport RAT delivery vector in the ClickFix campaign. The loaders invoked msiexec with a remote URL and the /qn switch to silently install the RAT from attacker infrastructure. Remote quiet MSI installation is a LOLBin abuse pattern used to bypass download controls.

Suspicious notepad Outbound Network Connection after Early Bird Injection

This rule detects the Windows notepad process initiating outbound internet connections which it never does legitimately. The TryCloudflare delivered XWorm and AsyncRAT chain used Early Bird APC injection into notepad to run C2 from a benign host. Network activity from notepad reliably indicates injected code beaconing out.

Suspicious Firewall Rule Masquerading As Windows Update (via process_creation)

This rule detects netsh adding an advfirewall rule named Windows Update, a masquerade used in Rhysida intrusions to open remote access ports while hiding behind a trusted name. Attacker-created firewall rules with system-service names often enable inbound RDP or C2 channels and merit investigation.

LeakyStealer Persistence via EdgeUpdateCore Run Key Masquerade (via registry_set)

This rule detects a Run key named EdgeUpdateCore that points to a MicrosoftEdgeUpdateCore executable staged under the user AppData directory, the persistence mechanism used by the LeakyInjector and LeakyStealer duo to survive reboot while masquerading as a Microsoft Edge update component. Adversaries mimic trusted update tooling so the autorun entry blends into normal software update activity.

Suspicious Encoded PowerShell with Hidden Window via Process Creation

This rule detects PowerShell invoked with a base64-encoded command while suppressing its window, the launcher behavior of the UAC-0099 LonePage VBS chain that decodes and runs a hidden beacon. Combining encoded payloads with a hidden window is a strong indicator of covert script execution rather than administrative use.