Sigma detection rules, expert-reviewed

Suspicious RegAsm or RegSvcs Spawned by Script Host (via process_creation)

This rule detects RegAsm.exe or RegSvcs.exe launched by a script host such as PowerShell, wscript, or cscript, the injection target abused in the Cascading Shadows phishing chain. The actor hollows these signed .NET utilities to run Agent Tesla, Remcos, or XLoader while evading defenses through trusted binary proxy execution.

Suspicious Scheduled Task Masquerading as Edge Update Running as SYSTEM via schtasks

This rule detects creation of a scheduled task that masquerades as a Microsoft Edge update while running as SYSTEM. This technique was observed in a DLL hijacking campaign analyzed by Kaspersky where attackers created a task named \Microsoft\Windows\Edge\Edgeupdates to gain persistent SYSTEM-level execution. Abusing a legitimate-looking task name in the wrong namespace lets an adversary blend malicious persistence with benign updater activity.

Suspicious DNS Query for TryCloudflare Tunnel Abused for Malware Delivery (via dns_query)

This rule detects DNS resolution of trycloudflare.com subdomains, which threat actors abused as disposable tunnels to host WebDAV shares delivering AsyncRAT and XWorm. TryCloudflare is a legitimate developer service so correlate with script or LNK activity.

Suspicious Windows Security Spoofing via pin Executable Writing output.txt via process_creation

This rule detects execution of pin.exe with an output.txt argument. In the rogue RMM campaign this binary spoofs the Windows Security interface while writing harvested data to output.txt, so its presence indicates a fake security prompt used to capture credentials or user input in support of the intrusion.

Suspicious Autorun Persistence Masquerading as VMware NAT Service

This rule detects a Run key value named VMware NAT Service being created under the current user hive, a persistence method used by Gh0stBins RAT to masquerade as the legitimate VMware NAT service. The genuine VMware service does not register user-level Run key persistence.

Malicious PowerShell Exfiltration to webhook.site Following WSUS Exploitation

This rule detects PowerShell using Invoke-WebRequest to PUT data to the webhook.site service, the exfiltration channel observed after Windows Server Update Services remote code execution. Attackers stage discovery output and upload it to a disposable webhook endpoint for collection. Outbound PUT requests to webhook.site from PowerShell are a strong exfiltration indicator.

Malicious Scheduled Task Deploying DYNOWIPER Payload (via process_creation)

This rule detects scheduled task creation referencing the DYNOWIPER wiper payload filenames used against Poland's energy sector. Observed in Elastic Security Labs telemetry where schtask.exe creates tasks running dynacom_update.exe or Source.exe to launch destructive file-corruption routines, enabling persistence and destructive execution.

ValleyRAT DLL Sideloading via Douyin Loading Non-Standard DLL (via image_load)

This rule detects the legitimate Douyin (TikTok) binary loading a tier0.dll or sscronet.dll, the DLL sideloading behavior used by ValleyRAT to run its loader from the Common Files System directory under a signed application. Adversaries leverage sideloading against a trusted binary to execute shellcode that injects into svchost.exe, making early detection critical for surfacing the intrusion before keylogging and remote-control commands begin.

Suspicious Scheduled Task Creation for HijackLoader Persistence (via process_creation)

This rule detects the creation of a scheduled task named mlt_Archive through schtasks, the persistence mechanism observed in the IObit side-loading intrusion delivering AsyncRAT. This task name is not associated with legitimate software.

Malicious Stopping of Security or Backup Services Before Impact (via process_creation)

This rule detects service-control commands (net stop, sc stop or Stop-Service) targeting antivirus, EDR, SQL or backup services, a defense-impairment step ransomware operators run to disable protection and free locked files before encryption. Stopping security and backup services is an impact-precursor technique in the Red Canary Threat Detection Report. Detecting these commands surfaces the final staging move before data is encrypted.

Malicious SCMBanker ClickFix Payload Fetch via Curl Piped to Cmd

This rule detects a curl download of a remote resource piped directly into a cmd.exe interpreter which is the ClickFix delivery step of the SCMBanker Mexican banking-fraud toolkit. Adversaries trick victims into pasting a clipboard command that fetches and runs a staged validation script. Catching this pipe-to-interpreter pattern exposes the initial foothold before the wider toolkit is pulled.

Suspicious BadIIS Service Persistence Masquerading as System Services

This rule detects creation of Windows services under the BadIIS masquerading names Winlogin, FaxService or AudiosService, which imitate legitimate system service names through subtle misspellings. The commodity BadIIS ecosystem installs services under these deceptive names to persist and blend into service inventories. Creation of a service with these typo-squatted names indicates BadIIS persistence.

Malicious regsvr32 Scriptlet Execution via scrobj.dll

This rule detects regsvr32.exe executing a remote or local scriptlet through scrobj.dll, the Squiblydoo signed-binary proxy execution technique. The CPU-Z watering-hole intrusion used regsvr32 with a .sct scriptlet to run attacker code while bypassing application controls as documented by Kaspersky. This combination of regsvr32 with the scriptlet handler is rarely legitimate and indicates evasive code execution.

Malicious ESX Admins Domain Group Creation via Process Creation

This rule detects creation of or membership changes to a domain group named ESX Admins using net.exe, the core exploitation step for CVE-2024-37085 in which ESXi hypervisors grant full administrative access to any member of that group. Multiple ransomware operators created this group to obtain hypervisor admin rights and mass-encrypt virtual machines.

Suspicious Script Host Spawning PowerShell via BlindEagle Chain

This rule detects a Windows Script Host process (wscript or cscript) spawning PowerShell, the execution chain used by BlindEagle after its VBS downloader retrieves remote payloads. This VBS-to-PowerShell handoff drives multi-stage RAT delivery such as njRAT and AsyncRAT, so the pattern is a strong early indicator of the infection.