Sigma detection rules, expert-reviewed

Suspicious javaw.exe Network Connection to Pastebin by D3F@CK Loader (via network_connection)

This rule detects the Java runtime javaw.exe establishing a network connection to Pastebin, the payload-retrieval behavior Red Canary observed from the signed D3F@CK loader that masqueraded as a Microsoft Teams installer. Java processes reaching out to paste sites are uncommon in enterprise environments, so this pairing indicates second-stage payload download from attacker-hosted text.

Malicious Silver Fox Run Key Persistence via AppClient (via registry_set)

This rule detects creation of a Run key value named AppClient, a registry autostart used by the Silver Fox ABCDoor backdoor to persist across reboots. The value launches the implant at user logon following a tax themed phishing intrusion. Detecting this autostart entry surfaces backdoor persistence in the registry.

Malicious APT29 Certutil Decode of Disguised Text File to Archive (via process_creation)

This rule detects certutil decoding a .txt file into a .zip archive, the staging step APT29 used to reconstruct a WINELOADER payload from a disguised invite. Delivering the archive as Base64 text and decoding it locally with certutil evades transfer-time inspection. Certutil decoding text into an archive is a deobfuscation behavior tied to this intrusion set.

Suspicious PXA Stealer Payload Decoding via certutil (via process_creation)

This rule detects the use of certutil to decode a disguised document into an archive during PXA Stealer infections. The actors named the decoded output with a pdf extension while it actually contained a password-protected archive for later extraction. Living-off-the-land decoding of pdf-named blobs is uncommon in benign use.

Suspicious Masqueraded Rundll32 with Mismatched Original Filename (via process_creation)

This rule detects a process whose embedded original filename is RUNDLL32.EXE but whose on-disk name is something else. Nokoyawa intrusions run IcedID by copying rundll32 to a decoy name such as Calc.exe to blend into normal activity. A binary lying about its identity through a renamed copy is a reliable masquerading indicator.

Suspicious Parallax RAT Keylogger Output File Creation via File System (via file_event)

This rule detects creation of keylogger output files under the Roaming Data directory using the Keylog_ filename prefix employed by the Parallax RAT. It is associated with the Parallax RAT campaign against cryptocurrency entities reported by Uptycs. These files hold captured keystrokes staged for exfiltration, and their creation signals active credential and input harvesting.

Malicious Recovery Environment Tampering via Bcdedit

This rule detects bcdedit being used to disable Windows automatic recovery, a boot-configuration change ransomware performs to block system restoration after encryption. It is associated with REvil ransomware-as-a-service affiliate operations that pair this step with shadow copy deletion. Detecting recovery tampering flags impending or in-progress impact activity.

Suspicious AutoIt3 Script Execution from User Directory (via process_creation)

This rule detects AutoIt3.exe executing a script from a user-writable directory, the loader behavior used in the LATAM Google Cloud Run campaigns where a Startup LNK launches PowerShell and AutoIt. AutoIt is abused to run compiled loader logic that injects the final banking trojan payload.

Suspicious Kerberoasting via setspn Service Principal Query

This rule detects setspn.exe querying all service principal names in a domain, a reconnaissance step for Kerberoasting used by China-linked actors to identify service accounts for credential extraction.

JanaWare Ransomware Ransom Note _ONEMLI_NOT_ Written to Disk (via file_event)

This rule detects the JanaWare ransomware writing its _ONEMLI_NOT_ ransom note across folders as it completes encryption in attacks against Turkish organizations. Adversaries drop this hardcoded Turkish-language note filename in every encrypted directory. The fixed prefix is a reliable post-impact detection anchor.

Suspicious Execution of Temporary dfae Command Script by Careto

This rule detects cmd.exe executing a temporary batch file matching the ~dfae naming pattern used by the Careto APT. The malware drops a short-lived command script alongside its scheduled task to stage subsequent payloads. Execution of a hidden temporary command file with this prefix indicates malicious staging activity.

Suspicious LNK Launch of WebDAV Batch via TryCloudflare Tunnel

This rule detects command lines referencing a trycloudflare tunnel host serving a batch script over WebDAV. The Quartet campaign shipped a zipped lnk that pulled new or startup batch files from a TryCloudflare share to stage Python payloads. Fetching executables from an ephemeral trycloudflare tunnel is a delivery pattern used to bypass domain reputation controls.

Malicious rundll32 Loading dat Payload via afunix Export

This rule detects rundll32.exe loading a file with a .dat extension and invoking the afunix export with a key argument. This loader pattern is used by the Lazarus group during Operation SyncHole watering-hole attacks to execute the ThreatNeedle and related malware via a trusted signed binary. The non-DLL extension plus specific export name distinguishes it from normal rundll32 usage.

Suspicious WMIC Execution from Anomalous Parent Process (via process_creation)

This rule detects wmic being spawned by an anomalous parent such as an Office application, browser or scripting host. Legitimate WMIC use rarely originates from these processes, so this parent-child relationship points to WMI being abused for execution or discovery following initial access.

Possible Process Injection into Attrib via Mispadu AutoIt Loader (via process_creation)

This rule detects attrib.exe being spawned by the AutoIt3 interpreter, which corresponds to the Mispadu loader injecting its payload into an attrib.exe process. A legitimate AutoIt application launching attrib in this way is not expected.