Sigma detection rules, expert-reviewed

Suspicious Service or Task Named windowsinspectionupdate (via process_creation)

This rule detects creation of a service or scheduled task using the distinctive name windowsinspectionupdate. The SLOW#TEMPEST campaign used this name to persist a shellcode loader executed from the Windows Temp directory.

Suspicious Guest Account Privilege Escalation (via process_creation)

This rule detects the built-in guest account being added to the local Administrators group. The SLOW#TEMPEST campaign re-enabled the guest account and elevated it to maintain covert privileged access.

Suspicious File Hidden via attrib in Public Documents (via process_creation)

This rule detects attrib.exe setting the system and hidden attributes on a file. The PHANTOM#SPIKE campaign copied its backdoor to the Public Documents folder and hid it with these attributes to evade casual inspection.

Suspicious Domain Admin Account Creation via net (via process_creation)

This rule detects net.exe adding an account to the Domain Admins group over the domain. The FROZEN#SHADOW campaign created a rogue svc_mail account and elevated it into Domain Admins for persistence and takeover.

Suspicious Active Directory Reconnaissance Commands (via process_creation)

This rule detects command shell execution of domain trust and privileged group enumeration commands run in rapid succession. The FROZEN#SHADOW campaign used these commands for post-compromise Active Directory discovery.

Suspicious rundll32 Executing DLL from ProgramData (via process_creation)

This rule detects rundll32.exe executing a DLL located in the ProgramData directory with an exported function name. The FROZEN#SHADOW campaign used this technique to launch its Cobalt Strike beacon staged as msedge.dll.

Suspicious Remote MSI Installation over WebDAV (via process_creation)

This rule detects msiexec.exe installing an MSI package from a remote WebDAV share addressed with an explicit port suffix. The FROZEN#SHADOW campaign delivered SSLoad via a remote slack.msi over a WebDAV UNC path.

Suspicious Rename of Double-Extension PowerShell Script (via process_creation)

This rule detects a command shell renaming a file with a ps12x extension to a ps1 script. The DEEP#GOSU campaign linked to Kimsuky staged its PowerShell payload with this uncommon double extension before renaming and executing it.

Possible UAC Bypass via easinvoker Spawning Batch Script (via process_creation)

This rule detects the trusted Windows binary easinvoker.exe spawning a command shell running a batch script. This mock-trusted-directory DLL hijack UAC bypass was observed in the MULTI#STORM campaign to elevate and execute KDECO.bat.

Suspicious Payload Staging in ProgramData IntelDriver Folder (via file_event)

This rule detects creation of an encrypted shellcode container named boot64x.w inside an IntelDriver directory under ProgramData. The Dead#Vax campaign staged its AsyncRAT shellcode at this path before process injection.

Suspicious Fake ACPIx86 Driver File Creation (via file_event)

This rule detects creation of a driver file named ACPIx86.sys in the system drivers directory. The OBSCURE#BAT campaign dropped this fake driver, whose name imitates a legitimate Windows component, as part of its rootkit deployment.

Suspicious Keylogger Output File in Windows Themes Folder (via file_event)

This rule detects creation of a version.xml file under the Windows Themes directory. The DEEP#GOSU campaign wrote captured keystrokes and clipboard data to this path, disguising keylog output as a theme resource.

Suspicious In-Memory Runspace Execution via PowerShell Script Block

This rule detects PowerShell script content that creates a new runspace and passes deobfuscated code to Invoke-Expression. A profile resident backdoor uses a dedicated runspace and script block to run its command and control loop in memory without touching disk.

Suspicious PowerShell Payload Extraction from PNG Polyglot via findstr

This rule detects use of the findstr utility to extract an appended PowerShell payload from a PNG image and pipe it into PowerShell for execution. This polyglot steganography technique conceals script code after the PNG end marker so it can be recovered with a native search utility and run in memory.

Suspicious Python Inline Deobfuscation and Execution One-Liner

This rule detects a Python process executing an inline one liner that base64 decodes and zlib decompresses a blob and passes it to exec. Stealer payloads wrap their real logic in dozens of nested decode and decompress layers invoked through this pattern to defeat static analysis.