Sigma detection rules, expert-reviewed

Suspicious msiexec Spawning Hidden Command Script (via process_creation)

This rule detects msiexec.exe launching cmd.exe to run a minimized .cmd script which was the initial delivery chain for EtherRat and TukTuk C2. The MSI dropped and executed a hidden batch file to stage the loader. Command scripts launched minimized from an installer are a common way to hide first-stage execution.

Malicious PowerShell Download from bullethost.cloud Staging Server

This rule detects PowerShell reaching out to the attacker-controlled staging host upload.bullethost.cloud to fetch a second stage archive into the user temp directory. This behavior was observed in the MUT-4831 campaign where trojanized npm packages ran a postinstall script that downloaded the Vidar infostealer. Blocking this early denies the actor credential and wallet theft capability.

Suspicious Encoded PowerShell Host Reconnaissance via Get-ComputerInfo via ps_script

This rule detects PowerShell script content invoking the Get-ComputerInfo cmdlet to enumerate detailed system information. A threat actor abusing a free Elastic Cloud SIEM trial ran this command to profile compromised hosts before exfiltrating the results, so its appearance in encoded or automated PowerShell is an early indicator of system discovery ahead of data theft.

Malicious Renamed Curl Binary Execution via Original Filename Mismatch

This rule detects execution of a process whose original filename is curl.exe but whose on-disk name has been changed, a masquerade DarkGate uses to fetch payloads while evading name-based detection. The copy-and-rename of curl hides ingress tooling. Detecting the mismatch exposes disguised download activity in the DarkGate to DanaBot chain.

Suspicious Windows Traffic Capture Abuse (via process_creation)

This rule detects use the native Windows sniffer in order to capture sensitive information or credentials.

Suspicious Certutil URLCache Remote Payload Download via process_creation

This rule detects certutil.exe invoked with the urlcache and split flags which downloads a remote file to disk while masquerading as certificate maintenance. Attackers in the SOC web shell case used obfuscated certutil to fetch a 404.aspx web shell onto the server. This living-off-the-land download technique bypasses many application allow lists and is worth alerting on.

Suspicious Onlogon Scheduled Task Pointing to ProgramData Executable

This rule detects creation of an onlogon scheduled task whose action executes a binary staged in ProgramData as used by the NetSupport actor for persistence under a masqueraded task name and this matters because legitimate onlogon tasks rarely launch executables from ProgramData and this pattern reflects malware establishing user triggered persistence.

SparkRAT Service Creation with binPath in C Drivers Directory (via process_creation)

This rule detects sc.exe creating a service whose binary path launches an executable from the C Drivers staging directory used by the Cambodia-focused SparkRAT cluster for SYSTEM persistence. Adversaries register an auto-start service pointing at their sideloading host under C Drivers to run at boot. Service creation referencing that non-standard directory is highly anomalous.

Suspicious Mshta Executed From Non-System Path (via process_creation)

This rule detects the mshta binary running from a location outside System32 which the CarnavalHeist trojan uses after copying mshta to a randomly named file to evade signature and path based detection. A renamed or relocated trusted LOLBin executing user content is a strong masquerading and signed proxy execution signal.

Suspicious LameHug Staging Directory and Info File Creation on Windows

This rule detects command line references to the ProgramData info staging directory and info.txt output file which the LameHug LLM-driven malware creates to collect system reconnaissance and copied documents before exfiltration. This fixed staging path in an unusual location indicates the AI-assisted collection stage of the intrusion.

In-Memory XWorm Injection Target RegAsm Spawned from User AppData (via process_creation)

This rule detects RegAsm.exe launched from a process residing in a user AppData or Temp directory, the PE-hollowing pattern used by the Noodlophile campaign to inject XWorm into a trusted .NET utility. Adversaries leverage RegAsm as a signed developer binary and hollow it in memory so the RAT runs under a Microsoft-signed process, making early detection critical for exposing the injection before remote access is established.

Suspicious Group Policy File System Path Redirection via Directory Service Change

This rule detects Directory Service Changes (Event ID 5136) that modify the gPCFileSysPath attribute of a Group Policy Object. Attackers redirect this path to reference policy files stored outside the trusted SYSVOL share so that domain clients apply attacker-controlled settings. A change to the GPO file system path indicates tampering with group policy storage.

Suspicious PowerShell Hidden Bypass Execution from ProgramData via Command Line

This rule detects PowerShell launched with hidden window, execution-policy bypass and non-interactive flags to run a script staged under C:\ProgramData. This behavior was observed in Operation PhantomControl delivering AsyncRAT, where operators execute obfuscated loader scripts to stay hidden. Detecting it exposes stealthy in-memory execution before RAT deployment.

Suspicious Microsoft Defender Security Components Disabled - PowerShell (via powershell)

This rule detects disable Defender security features in PowerShell.

Suspicious Delphi Runtime DLL Side-Loading by Ahnenblatt Host Process

This rule detects the Ahnenblatt application loading the Borland Delphi runtime DLLs borlndmm.dll or cc32290mt.dll from a user-writable directory. The RenEngine campaign side-loaded these DLL names to execute the HijackLoader stage under a trusted signed process as documented by Kaspersky. Loading these runtime libraries from Temp or AppData indicates DLL search-order hijacking used to run malicious code with a benign parent.