Sigma detection rules, expert-reviewed

Suspicious Keylogger Output File in Windows Themes Folder (via file_event)

This rule detects creation of a version.xml file under the Windows Themes directory. The DEEP#GOSU campaign wrote captured keystrokes and clipboard data to this path, disguising keylog output as a theme resource.

Suspicious In-Memory Runspace Execution via PowerShell Script Block

This rule detects PowerShell script content that creates a new runspace and passes deobfuscated code to Invoke-Expression. A profile resident backdoor uses a dedicated runspace and script block to run its command and control loop in memory without touching disk.

Suspicious PowerShell Payload Extraction from PNG Polyglot via findstr

This rule detects use of the findstr utility to extract an appended PowerShell payload from a PNG image and pipe it into PowerShell for execution. This polyglot steganography technique conceals script code after the PNG end marker so it can be recovered with a native search utility and run in memory.

Suspicious Python Inline Deobfuscation and Execution One-Liner

This rule detects a Python process executing an inline one liner that base64 decodes and zlib decompresses a blob and passes it to exec. Stealer payloads wrap their real logic in dozens of nested decode and decompress layers invoked through this pattern to defeat static analysis.

Suspicious Hidden PowerShell WebClient DownloadFile Cradle

This rule detects a hidden PowerShell process using the WebClient DownloadFile method to retrieve a remote file. A crypto stealer campaign uses this cradle with a hidden window to pull a decoy document and a bundled Python runtime from cloud file hosting.

Possible DarkGate Process Injection via iTunesHelper Spawning vbc.exe

This rule detects the Apple iTunesHelper binary spawning the Visual Basic command line compiler vbc.exe. DarkGate hollows out vbc.exe as a benign looking host process to execute its final shellcode after DLL sideloading, a parent child relationship that does not occur in normal iTunes operation.

Suspicious PowerShell Download Cradle with Spoofed User-Agent via MSIX

This rule detects a PowerShell download cradle that fetches and executes remote content while presenting a spoofed browser User-Agent string. A malicious MSIX package runs an obfuscated startup script that combines Invoke-WebRequest and Invoke-Expression to pull a next stage from an attacker server.

Suspicious .NET LOLBin Execution via CasPol or RegAsm

This rule detects execution of the .NET Framework utilities CasPol.exe or RegAsm.exe spawned by a script interpreter. Batch and PowerShell loaders abuse these signed developer tools to load and run reflectively decrypted assemblies while bypassing application control.

Suspicious Renamed PowerShell Copied from System32 via Batch Loader

This rule detects a command that copies the legitimate PowerShell executable from System32 to a new filename ending in exe. A multi payload batch loader clones powershell.exe under an attacker chosen name so its hidden execution of embedded base64 payloads evades name based detection.

Suspicious Python Process Establishing PostgreSQL Command and Control Channel

This rule detects a Python interpreter initiating outbound connections to the PostgreSQL service port. A commodity stealer abuses a PostgreSQL database as its command-and-control transport, storing victim registration and retrieving tasking through SQL queries instead of HTTP.

Possible DarkGate DLL Sideloading via iTunesHelper Loading CoreFoundation

This rule detects the signed Apple iTunesHelper binary loading a CoreFoundation DLL from a non standard directory. DarkGate abuses DLL search order hijacking by placing a malicious CoreFoundation.dll next to a legitimate Apple executable to proxy execution of its packed payload.

Suspicious Disabling of Chromium App-Bound Encryption via Policy Registry Key (via registry_set)

This rule detects modification of the ApplicationBoundEncryptionEnabled policy value under the Google Chrome or Microsoft Edge policy keys, the registry-based bypass Red Canary documented stealers using to weaken app-bound cookie encryption. Disabling this protection removes a key defense against cookie theft, so changes to this policy value warrant review for stealer activity.

Malicious Registry Run Key Persistence Using Scarlet Goldfinch OFFICE and DIVXX Values (via registry_set)

This rule detects creation of HKCU Run key values named OFFICE or DIVXX, the specific autorun entries Red Canary attributed to Scarlet Goldfinch for persisting its NetSupport Manager deployment. These named values are non-standard for legitimate software, so their appearance under the CurrentVersion Run path indicates adversary persistence.

Malicious PowerShell In-Memory Download Cradle via Script Block (via ps_script)

This rule detects a PowerShell download cradle that pulls a remote payload with Net.WebClient DownloadString and pipes it directly to IEX for in-memory execution, the tmp.48 stager observed in the Confluence exploit ransomware campaign by Red Canary. This pattern fetches and runs code without touching disk and is a common loader technique across intrusions.

Suspicious PowerShell Reflective Assembly Load With Registry Property Read via Script Block (via ps_script)

This rule detects PowerShell that reads data from a registry value and reflectively loads a .NET assembly in memory, the obfuscated in-memory loading behavior Gootloader uses per Red Canary. Reflective assembly loading combined with registry-stored payloads avoids writing an executable to disk, so this combination is a strong indicator of fileless second-stage execution.