Sigma detection rules, expert-reviewed

Suspicious OneDrive Masquerading TLB Marker File in ProgramData

This rule detects the creation of a file named MicrosoftOneDrive.tlb directly in the ProgramData root. HoneyMyte used this file as an infection marker while masquerading as a legitimate OneDrive component as reported by Kaspersky. A type library file impersonating OneDrive at this location indicates implant staging and masquerading.

Suspicious MgBot Marker Files Created in ProgramData Microsoft Folders

This rule detects the creation of status.dat or perf.dat files inside the ProgramData Microsoft MF or eHome directories. Evasive Panda stored MgBot configuration and marker files at these paths as documented by Kaspersky. These specific file and folder combinations indicate MgBot implant activity and staging.

Suspicious HealthApp Batch File Persistence in Start Menu Startup Folder

This rule detects creation of a batch file named after the HealthApp masquerade inside the Start Menu Programs startup folder. The Maverick banking Trojan established persistence by dropping a HealthApp-[GUID].bat file into the user startup location so it re-executes at logon. A batch script placed in the startup folder is a classic autostart persistence mechanism abused to survive reboots.

Suspicious Shai-Hulud GitHub Workflow File Drop (via file_event)

This rule detects creation of a shai-hulud-workflow.yml GitHub Actions workflow file planted by the Shai-Hulud npm worm. The malicious workflow is written into infected repositories to persist and to exfiltrate secrets to attacker infrastructure. The distinctive workflow filename is a reliable artifact of this supply-chain compromise.

Suspicious adhapl Service DLL Dropped in System32 by BellaCPP

This rule detects creation of adhapl.dll in the Windows System32 directory, the service DLL used by the BellaCPP backdoor exporting ServiceMain. BellaCPP, a C++ variant of BellaCiao, installs this DLL to run as a persistent service. Presence of this specific DLL in System32 indicates BellaCPP deployment.

Suspicious MDaemon WorldClient CgiBase6 Extension Registration by Careto

This rule detects modification of the MDaemon WorldClient.ini configuration to add CgiBase6 or CgiFile6 CGI extension entries. The Careto APT abuses this legitimate mail server extension mechanism to load a server-side implant that executes attacker CGI code. Injection of these CGI keys into the WorldClient configuration indicates a persistent web-facing backdoor.

Suspicious Dell DBUtilDrv2 Vulnerable Driver Load via driver_load

This rule detects loading of the Dell DBUtilDrv2.sys driver which is a known vulnerable driver abused in bring your own vulnerable driver attacks. ToddyCat installed DBUtilDrv2.sys through a crafted INF to disable kernel notification routines and blind security products. The presence of this signed but vulnerable driver on non Dell maintenance systems is a strong indicator of kernel level tampering.

Suspicious DGA Subdomain Resolution of systemupdate.info by BellaCPP

This rule detects DNS queries for subdomains under the systemupdate.info domain used as command-and-control by the BellaCPP backdoor. The malware builds DGA-style hostnames of a short letter string plus an identifier and country code under this parent domain. Resolution of this C2 domain indicates active BellaCPP beaconing.

Possible Victim Geolocation Lookup via ip-api.com

This rule detects DNS queries to ip-api.com which returns geolocation for the host public IP. The Grandoreiro banking trojan queried this service to geolocate victims and select targets, though the service is also used by some legitimate software so context is required.

Malicious FortiGateUpdate Service DLL Registration by Cyber Partisans (via registry_set)

This rule detects registration of a ServiceDll under the FortiGateUpdate service Parameters key, a masqueraded service used to load a DNSCat2 tunneling DLL. This behavior was observed in Cyber Partisans activity aimed at espionage and disruption against industrial targets. The security-product masquerade combined with a ServiceDll load is a strong persistence and C2 indicator.

Suspicious FatalRAT Run Key Persistence to ProgramData Loader (via registry_set)

This rule detects FatalRAT persistence via the SVP7 Run key value or a Run value pointing at the C\ProgramData\KnGoe loader path. This behavior was observed in Operation SalmonSlalom where the backdoor established autostart persistence for its 0user.exe loader. Detecting the registry autostart entry exposes the persistence foothold of the campaign.

Suspicious Service Creation Hosting Binary via Svchost (via process_creation)

This rule detects sc.exe creating a service whose binary path launches svchost.exe with the -k grouping switch. This behavior was observed in the updated MATA framework attacking industrial companies to register a malicious service DLL under a svchost service group for persistence. Detecting the service registration exposes the persistence and privilege-context stage.

Suspicious Masqueraded Exfiltration Utility AuditSvc Execution (via process_creation)

This rule detects execution of AuditSvc.exe, a name used to masquerade a data-upload tool that transfers staged archives to file-sharing services. This behavior was observed in attacks against industrial organizations that renamed transfer utilities to blend in as legitimate services. Flagging the masqueraded binary surfaces the exfiltration stage of the intrusion.

Suspicious Command Output Redirection to Windows Debug Out File (via process_creation)

This rule detects command execution that redirects output to the hardcoded C\Windows\debug\out.txt file. This behavior was observed in attacks against industrial organizations where second-stage commands capture their results to a fixed file under the Windows debug directory for later collection. Detecting this reveals hands-on-keyboard reconnaissance and output staging.

Suspicious Archive Staging to ProgramData NetWorks Path via RAR (via process_creation)

This rule detects RAR being used to archive collected files into the hardcoded C\ProgramData\NetWorks\ZZ staging directory. This behavior was observed in attacks against industrial organizations that deploy data-upload implants and archive victim data before exfiltration. Catching the local staging stage exposes collection before data leaves the network.