Sigma detection rules, expert-reviewed

Malicious WSUS Service Spawning Command Shell via Remote Code Execution

This rule detects the WSUS service or its IIS worker process spawning cmd or PowerShell, matching in-the-wild exploitation of the Windows Server Update Services remote code execution vulnerability. Successful exploitation grants command execution as the WSUS service account for reconnaissance and exfiltration. WSUS components have no legitimate reason to launch interactive interpreters.

Suspicious msimg32 DLL Hijack in AppData Templates

This rule detects msimg32.dll being loaded from the AppData Roaming Templates directory. AdaptixC2 plants a malicious msimg32.dll in this user path to hijack the DLL search order and gain execution. A system DLL name resolving from a user profile Templates folder is a clear DLL hijack indicator.

Suspicious PowerShell AES Decryption and Reflective Method Invocation in SolarMarker

This rule detects PowerShell that combines AES decryption primitives with reflective type loading and method invocation, the in memory staging used by SolarMarker to decrypt and run its second stage. Chaining cryptographic decryption with reflection lets the loader keep the real payload encrypted on disk and only expose it at runtime.

Suspicious Chafer Backdoor Registry Configuration under Microsoft DRM Key

This rule detects creation or modification of a Log value under the Microsoft DRM registry key which the Chafer backdoor uses as an execution gate and configuration store. Observed in NCC Group research analyzing the Chafer backdoor. Abuse of the DRM key as a covert configuration location is an uncommon behavior worth surfacing.

Malicious ZharkBot Execution via Explert Masquerade in Temp via process_creation

This rule detects the ZharkBot payload running as explert.exe from a Temp directory, a name chosen to mimic the legitimate Windows explorer process. Execution of an explorer look alike out of a user Temp folder is highly abnormal and reflects the loader staging its main module. The combined misspelled name and untrusted path make this a strong indicator of ZharkBot activity.

Malicious Inhibit System Recovery via Shadow Copy Deletion and Boot Configuration

This rule detects deletion of volume shadow copies and disabling of Windows recovery via bcdedit which active ransomware families execute before encryption. Observed in NCC Group research into active ransomware families including a BlackCat incident response engagement. Removing recovery options maximizes ransomware impact which makes this a high-confidence pre-encryption indicator.

Suspicious Directory Junction Creation via mklink for Masquerading

This rule detects cmd.exe creating a directory junction with mklink /D, the filesystem redirection RONINGLOADER uses to stage a fake roming directory during its PPL abuse chain. Directory junctions created by a command shell can trick trusted binaries into loading attacker-controlled content.

Suspicious Remote Scheduled Task Creation Running As SYSTEM

This rule detects schtasks.exe creating a task on a remote host that runs as SYSTEM at startup. In the WithSecure Catching Lazarus Part Two research the actor uses schtasks Create with a remote server, ONSTART schedule and the SYSTEM account for lateral movement and persistence. Attackers use remote task creation to execute code with high privilege on other machines.

Suspicious NPM Install Hook Executing Setup Script via Node

This rule detects an npm lifecycle process spawning node to run a setup.mjs script, the install-hook pattern used by malicious npm packages to execute code the moment a dependency is installed. This vector drives the npm supply chain attacks tracked by Unit 42. Detecting the hook-driven script run exposes attacker code executing during package installation before any application runs.

Malicious Scheduled Task Masquerading as Windows Update by Screening Serpens (via process_creation)

This rule detects creation of scheduled tasks named WindowsSecurityUpdate or Synchronize OS via schtasks, a persistence technique used by the Iranian APT Screening Serpens. The tasks masquerade as legitimate system maintenance to relaunch the group's implants on a daily schedule.

Suspicious User Shell Folders Startup Path Modification (via registry_set)

This rule detects modification of the Startup entry under the Explorer User Shell Folders registry key. Adversaries redirect the Startup path to an attacker-controlled directory so that arbitrary programs launch at logon without touching the visible Startup folder. Changing this shell folder mapping is rare in normal operation and is a stealthy persistence technique.

CHCP CodePage Locale Lookup

Detects use of chcp to look up the system locale value as part of host discovery

Possible DLL Side-Loading via printui.exe Outside System32

This rule detects execution of printui.exe from a directory outside the legitimate System32 path which enables side-loading of a rogue printui.dll. The Tangerine Turkey campaign copies printui.exe next to a malicious printui.dll to load cryptomining code. Detecting execution from unexpected paths surfaces DLL search order hijacking used for evasion and code execution.

Suspicious Self-Deletion via Ping Loopback and Del (via process_creation)

This rule detects a cmd command that pings the loopback address as a delay before deleting a file which the HiddenGh0st malware uses to remove its dropper. This ping and delete pattern is a common self cleanup indicator following execution.

Suspicious PIKABOT Command and Control Connection on Non-Standard Ports via Network Connection

This rule detects outbound connections to the uncommon high ports 2967 2223 and 5938 that PIKABOT uses for its HTTPS command and control while spoofing an Outlook user agent. These ports are atypical for normal web traffic so outbound sessions to them warrant review though some remote access software may reuse similar ranges.