Sigma detection rules, expert-reviewed

Suspicious Windows Defender Exclusion Added for ProgramData (via process_creation)

This rule detects command lines that add a Microsoft Defender exclusion path covering C:\ProgramData which the CoralRaider batch script uses to hide staged payloads from antivirus scanning. Adding scan exclusions is a common impairment of defenses that lets malware execute and persist from a trusted allowlisted directory.

Malicious Spoolsv Process Masquerading From Non-System Path (via process_creation)

This rule detects the Windows print spooler binary name spoolsv.exe executing from a directory outside System32 which the CoralRaider RotBot component uses to masquerade as a trusted system service. Running a well-known system image name from a wrong location is a strong masquerading signal used to evade defender and analyst attention.

Possible AnyDesk RMM Silent MSI Installation via Windows Installer (via process_creation)

This rule detects silent unattended installation of the AnyDesk remote access tool through Windows Installer command lines which threat actors and ransomware operators abuse to gain persistent hands-on-keyboard access. Adversaries increasingly deploy legitimate RMM tooling such as AnyDesk to blend malicious remote control with normal administrative traffic and evade endpoint controls.

Malicious svchost Service Creation for TinyTurla Persistence (via process_creation)

This rule detects creation of a service whose binary path runs svchost.exe under a custom sysman service group, the persistence mechanism in the full TinyTurla kill chain. Registering a new svchost group allows the backdoor ServiceDll to load inside a trusted host process at boot.

Malicious Edge Credential Parser Execution via PowerShell (via process_creation)

This rule detects execution of the edgeparser.ps1 script used by Turla in TinyTurla-NG operations to parse and steal Microsoft Edge Login Data. The script harvests saved browser credentials for onward access and lateral movement.

Suspicious Executable Download via bitsadmin Transfer (via process_creation)

This rule detects bitsadmin.exe transferring an executable or DLL from an HTTP source, a payload-staging technique seen in the LATAM Google Cloud Run malware campaigns delivering Astaroth, Mekotio and Ousaban. Abusing the BITS service downloads next-stage tooling while evading direct network monitoring.

Malicious Scheduled Task Masquerade for Zardoor Persistence (via process_creation)

This rule detects scheduled task creation using the Zardoor masquerade names KasperskySecurity or msbuildss.exe. The actor names persistence tasks after security software and build tooling to blend malicious execution into expected system activity.

Malicious Zardoor Backdoor Execution via rundll32 (via process_creation)

This rule detects rundll32.exe invoking the MainEntry export of zar32.dll or zor32.dll, the core execution modules of the Zardoor backdoor. These components provide command-and-control and reverse-proxy capability during long-term espionage operations.

Suspicious DLL Sideloading via msdtc oci.dll Install (via process_creation)

This rule detects msdtc.exe being invoked with the -install argument, the trigger used by the Zardoor backdoor to sideload a malicious oci.dll. Abusing the MSDTC install path loads attacker code under a signed system service for stealthy persistence.

Malicious Service Creation Masquerading as nslookup (via process_creation)

This rule detects creation of a Windows service whose binary is named nsIookup.exe, a homoglyph masquerade of nslookup used by Lazarus for persistence in Operation Blacksmith. Naming the service payload after a trusted networking tool helps it evade casual review.

Windows Firewall Disabled via netsh advfirewall

This rule detects netsh being used to turn off the Windows Firewall through the advfirewall set allprofiles state off command. Phobos ransomware disables the firewall to ease lateral movement and unhindered communication before encryption. Programmatic firewall disabling is a defense-evasion action uncommon outside deliberate administration.

Volume Shadow Copy Deletion via vssadmin or wmic

This rule detects deletion of Volume Shadow Copies through vssadmin or wmic, an anti-recovery step performed by Phobos ransomware deployed by the 8Base group. Removing shadow copies prevents victims from restoring encrypted files without paying. This inhibit-recovery behavior almost always precedes or accompanies ransomware encryption.

Malicious Inhibit System Recovery via Backup and Shadow Copy Deletion (via process_creation)

This rule detects deletion of volume shadow copies and backup catalogs and disabling of recovery via native tools, a destructive precursor observed in Phobos ransomware affiliate activity. Removing recovery options prevents victims from restoring data without paying, increasing the impact of the subsequent encryption.

Explorer WebDAV UNC Download Using At-Port Syntax

This rule detects explorer.exe launched with a UNC path that embeds an HTTP port using the WebDAV at-port syntax such as \\\\host@80\\. Qakbot-affiliated actors distributing Ransom Knight abused LNK files to run explorer against a remote WebDAV share like 89.23.96.203@80 to fetch information.exe. This at-port UNC form is a hallmark of WebDAV-based payload retrieval and rarely appears in legitimate use.

Msiexec Spawning Batch Script Child Process

This rule detects msiexec.exe spawning a command interpreter that runs a batch file. The GPU miner installer abused msiexec with EnforcedRunAsAdmin to launch core.bat and kick off its infection chain. A signed MSI installer invoking cmd to execute a local batch script is an abuse of the trusted installer for proxy execution.