Sigma detection rules, expert-reviewed

PowerShell Base64 Download Cradle via FromBase64String and Invoke-Expression (via ps_script)

This rule detects PowerShell that decodes a base64 blob with FromBase64String and immediately runs it through Invoke-Expression, the staged download-and-execute cradle used by the LNK phishing chains analyzed by STRT to fetch and launch a second-stage script. Adversaries leverage this pattern to reconstruct and execute obfuscated code in memory, so this behavior warrants review during phishing investigation.

Suspicious Rundll32 Loading DLL from User-Writable Path (via process_creation)

This rule detects rundll32.exe loading a DLL from a user-writable directory such as ProgramData or AppData. AresLoader downloads its DLL into %AllUsersProfile% and invokes it through rundll32 with an exported ordinal to run the loader. Rundll32 executing a DLL from a staging directory is a frequent proxy-execution and defense-evasion pattern.

Suspicious Winlogon AutoAdminLogon Credential Registration

This rule detects enabling of Winlogon automatic logon by writing AutoAdminLogon, DefaultUserName or DefaultPassword under the Winlogon key. The ToyMaker access broker set these values so a reboot into their controlled session authenticates automatically, cementing persistence and easing the handoff of the compromised host to extortion affiliates.

Possible Andariel Keylogger Output Archive Staged in Temp (via file_event)

This rule detects creation of the password-protected keylog archive and its embedded log file staged in the Temp directory by a keylogger attributed to the North Korean group Andariel. Adversaries write captured keystrokes and clipboard data to a compressed archive on disk before exfiltration, so these named artifacts indicate active credential capture.

Suspicious Active Directory Enumeration via AD Explorer Snapshot Process Creation

This rule detects the Sysinternals AD Explorer tool being run with the snapshot argument to capture an offline copy of Active Directory, a discovery technique used by Peach Sandstorm to enumerate accounts and objects. An AD snapshot pulls the full directory for later analysis and is rarely part of routine endpoint activity.

Malicious Secretdump Password Dumping via SMB Admin Share (via security)

This rule detects execute Secretdump in order to remotely dump credentials over SMB.

Suspicious Base64 Decoding via Certutil

This rule detects certutil used with its decode flag to deobfuscate Base64-encoded content on disk. The KimJongRAT variant chains certutil and findstr to decode staged payloads before execution. Certutil-based decoding is a living-off-the-land deobfuscation technique that bypasses many controls.

Malicious LSASS Process Dump by a Non System Account (via security)

This rule detects will dump the LSASS memory content using tools like Mimikatz, ProcDump, TaskMgr, ...

Malicious LSB Steganography Image Decoding via PowerShell (via ps_script)

This rule detects PowerShell loading an image as a bitmap and iterating pixel values to extract an embedded payload. The Caminho loader used a GetPixel loop over a downloaded image to decode a hidden .NET assembly for fileless execution.

Malicious Payload Assembly via MZ Header Prepend and copy Concatenation (via process_creation)

This rule detects the technique of writing an MZ header and concatenating it with a downloaded blob using copy to reconstruct an executable, used by Bitter APT against PTCL to rebuild the WmRAT payload. The disguised binary is downloaded as a PNG then reassembled on disk. This MZ-prepend and copy pattern is a distinctive evasion behavior.

Suspicious VBScript Execution From ProgramData Microsoft Subfolder

This rule detects wscript or cscript executing a .vbs file from a subfolder under C:\ProgramData\Microsoft, a persistence and staging path used by Banana RAT. Legitimate scripts rarely run from these attacker-created directories.

Malicious Exchange Group Membership Change to Perform DCsync Attack (via security)

This rule detects adds its account into a sensitive Exchange group to obtain "Replicating Directory Changes /all" and perform DCsync attack.

Suspicious Rundll32 Execution of WebDAV-Hosted DLL via Entry Export (via process_creation)

This rule detects rundll32.exe loading a DLL from a WebDAV UNC path and calling the exported function named Entry. Strela Stealer uses this technique to execute a fileless DLL payload delivered over WebDAV.

Suspicious Windows Defender Tamper Protection Disabled via Registry by Nova Ransomware

This rule detects the Windows Defender TamperProtection value being set to zero under the Defender Features key, disabling tamper protection so security tooling can be altered. Nova ransomware performs this change as part of multi-layered Defender evasion.

Suspicious Attrib Hiding of Stealer Artifacts (via process_creation)

This rule detects attrib.exe applying hidden and system attributes to Maranhao Stealer artifacts such as infoprocess.exe, crypto.key, or the Microsoft Updater directory. This hides malicious files from the user.