Sigma detection rules, expert-reviewed

Malicious SSH Reverse Tunnel with Hidden Key Path (via process_creation)

This rule detects ssh.exe establishing a reverse port-forward tunnel while referencing key files staged under C:\Windows\AppReadiness which ToddyCat uses to build covert traffic-tunneling channels into victim infrastructure for data extraction.

Suspicious Remote Service Execution via PsExec (via process_creation)

This rule detects PsExec being used to execute commands on remote hosts which LockBit builder-based ransomware leverages through its psexec_netspread option to propagate the payload across the domain before mass encryption.

Suspicious Execution or Load from Fake System32 Directory Imprint (via process_creation)

This rule detects a process image path that contains a fake system directory of the form \Imprint\Windows\system32. The examined privilege-escalation technique builds a counterfeit system drive directory such as C:\Imprint\Windows\system32 to trick trusted loaders into resolving files from an attacker-controlled path, so an image running from this structure indicates path-based deception during exploitation.

Suspicious obs-browser-page.exe Executing Outside OBS Installation Path (via process_creation)

This rule detects the signed obs-browser-page.exe running from a location other than a legitimate OBS Studio installation directory. The Coyote banking trojan copies this signed OBS binary to a user folder to side-load a malicious libcef.dll, so execution of obs-browser-page.exe from an unexpected path indicates DLL side-loading through a trusted host process.

Malicious Akira Shadow Copy Deletion via PowerShell WMI (via process_creation)

This rule detects PowerShell enumerating and deleting Volume Shadow Copies through WMI. Akira ransomware runs a PowerShell one-liner that queries Win32_Shadowcopy and calls Delete to remove backups before encryption, so this command indicates inhibition of system recovery during a ransomware attack.

Suspicious Executable Execution From Users Public Directory via Process Creation

This rule detects execution of View.exe or IntelSvc.exe from the C:\Users\Public directory. In the B2B miner and backdoor campaign these binaries are dropped to the world-writable Public folder to stage a keylogger and a beaconing backdoor, an atypical execution location.

Malicious Defender Real-Time Monitoring Disabled via Process Creation

This rule detects command lines that disable Microsoft Defender real-time or behavior monitoring. The miner, keylogger and backdoor campaign against B2B organizations uses start.cmd and runxm1.cmd scripts to turn off Defender protections before deploying its payloads.

Suspicious Hidden Local Account Creation SqlDbAdmin via Process Creation

This rule detects creation of a local account named SqlDbAdmin via net.exe. Cuba ransomware adds this hidden administrative user for persistence and lateral movement, disguising it as a database service account.

Malicious BYOVD Driver Service Creation aswSP_ArPot2 via Process Creation

This rule detects creation of a service loading the vulnerable Avast aswarpot.sys driver under the name aswSP_ArPot2. Cuba ransomware operators bring the signed driver into C:\windows\temp and register it as a service to abuse it via DeviceIoControl for terminating security products, a bring-your-own-vulnerable-driver technique.

Suspicious Executable Execution From AppData Roaming msgui via Process Creation

This rule detects execution of msgui.exe from the roaming AppData directory. In attacks on industrial organizations this binary is dropped to %APPDATA% and used as an injector into msiexec.exe or svchost.exe, staging further malicious activity from a user-writable location.

Suspicious Service Persistence WinSystemHost via Process Creation

This rule detects creation of a Windows service named WinSystemHost via sc.exe. Threat actors attacking industrial organizations register this service to persist a malicious loader across reboots, masquerading as a benign system host process.

Suspicious McAfee DLL Sideload via mcods Process Creation

This rule detects the legitimate McAfee mcods.exe binary running from outside its standard installation directory. Attackers targeting industrial organizations plant mcods.exe alongside a malicious McVsoCfg.dll to sideload their loader via the McVsoCfgGetObject export, abusing a trusted signed process for execution and persistence.

Suspicious Equation Editor Child Process via Process Creation

This rule detects Microsoft Equation Editor (EQNEDT32.EXE) spawning a child process. LokiBot delivery chains weaponize CVE-2017-11882 and CVE-2017-0199 in RTF documents so that the outdated equation editor executes attacker code, an event with no legitimate cause on modern systems.

Malicious Windows Defender Exclusion Added via Command Line

This rule detects the creation of Windows Defender scan exclusions through PowerShell MpPreference cmdlets. DarkGate and related crimeware loaders add exclusion paths for their staging directories so subsequently dropped payloads are not scanned, weakening endpoint defenses before further execution.

Suspicious AutoIt3 Execution With Compiled Script Argument via Process Creation

This rule detects AutoIt3.exe invoked with a compiled .au3 script passed on the command line. DarkGate loader campaigns abuse the signed AutoIt3 interpreter to execute an obfuscated script.au3 payload, blending malicious execution into legitimate scripting activity to evade detection.