Sigma detection rules, expert-reviewed

Suspicious Kernel Service Creation for BYOVD Driver Loading (Qilin)

This rule detects creation of a kernel-type Windows service via sc create with a kernel service type, used by the Qilin group to load a vulnerable driver for bring-your-own-vulnerable-driver attacks. Loading a kernel driver through a newly created service enables disabling security products from kernel space. Unexpected kernel service creation is a strong defense-evasion signal.

Malicious PlugX Run Key Persistence via AvastSvcpCP Path

This rule detects a Run key value pointing at the AvastSvcpCP directory under the user profile used by the PlugX USB worm for persistence. PlugX copies its sideloading set into this folder and registers it for autostart, masquerading as Avast to survive reboots.

Malicious Cactus Ransomware Ransom Note Creation (via file_event)

This rule detects creation of Cactus ransomware ransom notes, which embed the fixed C.A.c_T.U-S-R.e-a_D.m-e marker between randomized prefixes and postfixes in the note filename. Adversaries leverage mass note deployment during the encryption stage, making detection of this distinctive embedded string a reliable late-stage indicator of a Cactus impact event.

Suspicious Scheduled Task Masquerading as MicrosoftEdgeUpdate with Minute Interval (via process_creation)

This rule detects creation of a scheduled task that impersonates the Microsoft Edge updater while triggering on a very short minute-based interval. The AsyncRAT phishing campaign registers a task named MicrosoftEdgeUpdate500 that runs every two minutes for persistence. Legitimate updaters do not run on such aggressive schedules, so this pairing of a trusted name with an abnormal trigger reveals the persistence mechanism.

Suspicious Scheduled Task Launching svczHost Masquerading Binary via schtasks

This rule detects schtasks creating a task that runs svczHost.exe, a masquerading binary imitating the legitimate svchost service name used for persistence in the Ducktail campaign. Attackers pick a lookalike host name so the scheduled task and running process blend into normal system activity.

AteraAgent malicious installations

Detects potentially malicious AteraAgent installations when the IntegratorLogin parameter is used to register a non-business email.

Malicious svchost Masquerading Binary scvhost Executed from Common Files

This rule detects execution of scvhost.exe, a typosquatted masquerade of the legitimate svchost.exe, deployed as a fake SQLlite service under Program Files Common Files by the Nezha threat actor. The misspelled name and non-system path reveal a persistence and masquerading attempt. Genuine svchost only runs from System32, so any scvhost binary is malicious.

Suspicious Service Creation for APT41 Loader via sc create (via process_creation)

This rule detects creation of a Windows service named server power via sc.exe as seen in the APT41 Africa campaign. The group used this service to gain SYSTEM level persistence for a sideloaded payload. A service with this whitespace-separated cover name combined with sc create points to hands-on-keyboard persistence rather than legitimate software installation.

Malicious Exchange or SharePoint Worker Process Spawning Command Shell from Web Shell (via process_creation)

This rule detects the IIS worker process w3wp.exe spawning command shells or the net utility on on-premises Exchange or SharePoint servers, the web-shell execution behavior these attacks use after deploying pages such as getidtoken.aspx or signout.aspx. Adversaries drop web shells into OWA auth and LAYOUTS directories to run commands in the server context, so command interpreters descending from w3wp indicate server-side compromise.

Suspicious Service Creation With Auto Start via process_creation

This rule detects use of sc.exe to create a new auto-start service which is a common persistence mechanism for miners and loaders. SilentCryptoMiner registered a service named to mimic the Windows Image Acquisition driver with an automatic start binary path. Alerting on service creation from sc.exe surfaces persistence attempts that survive reboots.

Suspicious Minimized Command Shell Launching Decoy PDF (via process_creation)

This rule detects a command shell started in a minimized window that echoes and opens a decoy NotaFiscal PDF which the CarnavalHeist banking trojan LNK uses to distract the victim while it stages its loader. Minimized window execution with an invoice-themed decoy is a social engineering and defense evasion pattern in Brazilian banking malware.

Malicious BLOODALCHEMY DLL Side-Loading via BrDifxapi Executable

This rule detects DLL side-loading where the BrDifxapi executable loads a BrLogAPI DLL which is the loading chain the BLOODALCHEMY backdoor abuses to execute its payload. Pairing this specific host binary with this specific module name reflects a known malicious side-loading combination rather than legitimate Brother software behavior.

BitLocker Feature Configuration - Reg via Command (via process_creation)

This rule detects configures BitLocker for ransomware purposes.

Suspicious File Upload via curl Multipart Form

This rule detects curl.exe uploading a local file using a multipart form field. In the Notepad++ supply chain attack the operators used curl with a form file argument to exfiltrate collected reconnaissance output as reported by Kaspersky. Command line file upload via curl can indicate staged data exfiltration although some administrative scripts also use this pattern.

Malicious Bring-Your-Own-Vulnerable-Driver Load for EDR Killing

This rule detects loading of vulnerable signed drivers abused by EDR-killer tooling including BdApiUtil.sys, TfSysMon.sys, K7RKScan.sys, ThrottleStop.sys and HwRwDrv.sys. Attackers load these drivers to gain kernel primitives for terminating security processes via DeviceIoControl, so their presence signals an imminent defense-disabling attempt.