Sigma detection rules, expert-reviewed

Suspicious WMIC Remote Process Creation Installing MSI via Command Line

This rule detects wmic invoking process call create to launch msiexec, a WMI-based execution technique used after Citrix Bleed exploitation to deploy the LockBit loader. Combined use of process call create with msiexec is rarely legitimate on endpoints. Detecting it exposes remote or local code execution via WMI.

Suspicious New Member Added to an Exchange Administration Group - High Risk (via security)

This rule detects scenarios where a new member is added to a sensitive group related to Exchange server.

Suspicious Medium Risk Active Directory Group Membership Change (via security)

This rule detects scenarios where a suspicious group membership is changed.

Suspicious Data Exfiltration to Webhook.site via Command Line (via process_creation)

This rule detects PowerShell or curl reaching webhook.site, the exfiltration channel used by attackers after exploiting WSUS via CVE-2025-59287 to send reconnaissance output offsite. The free request-capture service receives whoami and network discovery results. Detecting this outbound call exposes staged data theft following server exploitation.

FalseFont Backdoor Persistence via Registry Run Key Pointing to User-Directory Binaries (via registry_set)

This rule detects a registry Run key value whose data points to the host.exe, broker.exe, or System.exe binaries dropped into user-profile directories by the FalseFont backdoor used by the Peach Sandstorm threat actor. Adversaries register these autostart entries to survive reboot, making detection useful for catching persistence of the espionage implant.

Suspicious Extexport DLL Side-Loading Execution

This rule detects execution of the Internet Explorer Extexport.exe utility which loads mozcrt19, mozsqlite3 or sqlite3 DLLs from its working directory. In the WithSecure Code Execution and Persistence Lab 1 the Astaroth chain drops malicious DLLs of these names next to Extexport.exe to achieve DLL side-loading. Attackers proxy code execution through this signed LOLBin to run their payload under a trusted process.

Suspicious Service Persistence via InstallUtil with Masqueraded Service Name

This rule detects InstallUtil.exe referencing the nhdService or WinDefUpd service names used by the ShellClient RAT in Operation GhostShell for persistence. Attackers install these masqueraded services so the RAT survives reboots and blends in with legitimate update services. The pairing of the InstallUtil proxy binary with these specific service names is a strong GhostShell indicator.

Malicious Stickey Key IFEO - Reg via Command (via process_creation)

This rule detects enable the Image File Execution Options (IFEO) debugger for sethc.

Suspicious Ngrok Tunnel Using svchost Masqueraded Config

This rule detects execution referencing an ngrok configuration file named svchost.yml. The Twelve group ran ngrok with a config masqueraded as a system component to tunnel internal services out to attacker infrastructure while evading casual inspection.

Malicious UAC Bypass via DllHost ICMLuaUtil Elevated COM Interface in ValleyRat Campaign (via process_creation)

This rule detects DllHost.exe launched with the ICMLuaUtil elevated COM CLSID 3E5FC7F9-9A51-4367-9063-A120244FBEC7, the auto-elevation interface abused by the Silver Fox ValleyRat loader to bypass User Account Control. Adversaries leverage this elevated COM object to obtain administrator rights without a prompt, making detection valuable for catching privilege escalation during the intrusion.

Suspicious DenoGate Run Key Persistence Launching Headless Deno Backdoor

This rule detects a Run key value named Deno_AutoRun created for persistence by the DenoGate backdoor delivered through Microsoft Teams IT impersonation. The value silently relaunches the Deno runtime under a headless conhost wrapper at logon. This fixed autostart name reestablishes the backdoor and its WebSocket command and control after reboot.

Malicious Web Browser Spawning Command or Script Interpreter

This rule detects a web browser process such as chrome.exe, msedge.exe or iexplore.exe spawning a command shell or scripting interpreter, the core signal of the FileFix social-engineering technique that tricks users into pasting an obfuscated PowerShell command into the File Explorer address bar. A browser has no legitimate reason to launch cmd, PowerShell, wscript or python. This parent-child chain indicates code execution from the KongTuke web-inject cluster.

Malicious User Browser Credentials Dump via Network Share - DonPapi, Lazagne (via security)

This rule detects attempt to dump browser credentials (Firefox, Google Chrome, ...) via network share.

Malicious AutoHotkey Script Execution From ProgramData (via process_creation)

This rule detects AutoHotkey.exe running an .ahk script from a subdirectory of C:\ProgramData which the DarkGate loader uses to execute its interpreted payload after a template injection chain. Abusing the legitimate AutoHotkey interpreter to run scripts from a staging directory evades script host controls and hides malicious logic.

Suspicious Unattended RMM Installer Execution via Msiexec

This rule detects installation of the LogMeInResolve_Unattended.msi package, an unattended remote-access tool installer distributed by the RMM phishing campaign to gain hands-on-keyboard access. Unattended RMM installs delivered through phishing lures are a common precursor to remote control abuse.