Sigma detection rules, expert-reviewed

Suspicious AutoIt3 Execution With Compiled Script Argument via Process Creation

This rule detects AutoIt3.exe invoked with a compiled .au3 script passed on the command line. DarkGate loader campaigns abuse the signed AutoIt3 interpreter to execute an obfuscated script.au3 payload, blending malicious execution into legitimate scripting activity to evade detection.

Suspicious W32TIME Named Pipe Activity Linked to RPC Privilege Escalation (via pipe_created)

This rule detects creation of the W32TIME named pipe, an observable associated with the PhantomRPC Windows RPC privilege escalation technique that coerces service actions to run at high privilege. The pipe activity accompanies impersonation of a privileged token through the Terminal Services RPC interface. Detecting this pipe alongside unexpected service triggers can surface RPC based escalation attempts.

Suspicious UUID Named Pipe Created Consistent with Mythic SMB Agent

This rule detects the creation of named pipes whose name is a bare UUID which matches the SMB peer to peer profile used by Mythic agents as described by Kaspersky. Mythic uses UUID formatted named pipes to relay tasking between implants over SMB. This pattern can indicate command and control tunneling although some legitimate software also uses GUID named pipes.

Suspicious PipeMagic Named Pipe Creation (via pipe_created)

This rule detects creation of the named pipes used by the PipeMagic backdoor including the magic3301 pipe and the structured pipe\1. prefix followed by a hex identifier. PipeMagic uses these pipes for internal module communication and command routing. The distinctive pipe naming scheme is a reliable host indicator of the modular backdoor.

Malicious Named Pipe Creation by CloudSorcerer (via pipe_created)

This rule detects creation of the distinctive named pipe [1428] which the CloudSorcerer APT uses for inter-process communication between its injected modules while targeting Russian government entities.

Suspicious Named Pipe TyphoonPWN Local Privilege Escalation Marker (via pipe_created)

This rule detects creation of the named pipe \\.\Pipe\TyphoonPWN. The analyzed Windows local privilege-escalation technique uses this specific named pipe during its exploitation flow, so its appearance indicates the presence of the exploit tooling on the host.

Suspicious RuntimeBroker Network Connection via Loki Mythic Agent

This rule detects RuntimeBroker.exe initiating outbound network connections to non-local addresses, an anomaly produced when the Loki Mythic agent injects its gTunnel or ngrok tunneling code into runtimebroker and svchost host processes. RuntimeBroker is a local COM broker that should not talk to remote hosts, so external traffic from it points to injected C2 tunneling.

Suspicious Network Connection from mspaint or msiexec (via network_connection)

This rule detects mspaint.exe or msiexec.exe initiating outbound network connections which is anomalous for these utilities and matches CloudSorcerer APT tradecraft of injecting shellcode into them to proxy cloud command-and-control traffic.

Suspicious Project CAV3RN AzureCommunication.dll Load (via image_load)

This rule detects the loading of AzureCommunication.dll from outside the Windows directory, a masquerading module name used by the Project CAV3RN espionage framework that abuses Outlook calendar events and Graph API for command-and-control. A cloud-themed module name loaded from an unexpected path is indicative of an attacker blending malicious code into legitimate-looking Azure components.

Suspicious HelloNet wtsapi32.dll Sideload via itcsrvup64.exe (via image_load)

This rule detects the loading of wtsapi32.dll by itcsrvup64.exe from outside System32, a DLL search-order hijack used by the HelloNet campaign to run malicious code through the ViPNet update system. The attacker abuses a trusted updater binary to sideload a payload and inject into svchost, enabling stealthy code execution and persistence.

Suspicious DLL Sideloading of libpython by evteng

This rule detects the evteng.exe process loading libpython2.4.dll which indicates DLL search order sideloading. Evasive Panda used evteng.exe to sideload a malicious libpython2.4.dll that loads the MgBot backdoor as reported by Kaspersky. This host binary loading an attacker supplied library is a strong sideloading and execution indicator.

Malicious Phantom DLL Hijacking of oci.dll Loaded by msdtc

This rule detects msdtc.exe loading oci.dll, a well-known phantom DLL hijacking technique used by the PassiveNeuron campaign to run an implant under a trusted system service. The oci.dll is not present by default so msdtc will load an attacker-supplied version placed in its search path. This grants stealthy code execution under a signed Windows service process for persistence and evasion.

Malicious Phantom DLL Hijacking of wlbsctrl or TSMSISrv Loaded by svchost

This rule detects svchost.exe loading wlbsctrl.dll or TSMSISrv.dll, which are non-present phantom DLLs abused for hijacking. In the PassiveNeuron campaign attackers placed malicious copies of these DLLs so that svchost would load their implant during service startup. Because these libraries are not shipped by default Windows in the search path svchost uses, their presence indicates phantom DLL hijacking for stealthy persistence and privilege escalation.

Suspicious DLL Hijack via BugSplatRc64 Sideloading (via image_load)

This rule detects loading of BugSplatRc64.dll from a signed loader named nau.exe used to sideload a Cobalt Strike beacon in the GitHub and social-media delivery campaign. The attacker abuses the search-order of a legitimate application to run their DLL under a trusted process name. Pairing the loader name with the hijacked module distinguishes this from benign crash-reporting usage.

Suspicious Exchange IIS Worker Loading GhostContainer Module (via image_load)

This rule detects the Exchange IIS worker process loading the App_Web_Container_1.dll module associated with the GhostContainer backdoor. GhostContainer registers itself as an Exchange component and patches AMSI and ETW in the w3wp process to disable in-memory inspection. Loading this named module in the Exchange worker indicates in-process backdoor persistence on a mail server.