Sigma detection rules, expert-reviewed

Malicious ClickFix Execution Chain Spawning MSHTA via Pcalua on EtherRAT Infection

This rule detects the Program Compatibility Assistant launcher pcalua.exe being abused to proxy execution of mshta.exe against an HTML application. This living-off-the-land chain is a ClickFix step in the EtherRAT SYS_INFO campaign that fetches command and control from an Ethereum contract. Using pcalua to break the parent-child chain evades detections keyed on direct mshta launches.

Suspicious PowerShell With Reversed HTTP String (via process_creation)

This rule detects PowerShell command lines containing the reversed HTTP string used to hide C2 URLs. This steganography spam campaign reverses download URLs before reconstructing them at runtime.

Malicious ShadowPad DLL Sideloading via TosBtKbd by Knife Framework

This rule detects the legitimate Toshiba TosBtKbd executable loading the TosBtKbdLayer DLL used to sideload ShadowPad. The China-nexus Knife framework abuses this signed binary to execute its ShadowPad implant through search-order hijacking. Sideloading through a trusted executable lets the implant run under the cover of a legitimate process.

Suspicious Bruteforce via Password Reset (via security)

This rule detects if a attacker attempts to reset multiple times a user password to perform a bruteforce attack.

Suspicious Curl Download to Public User Directory

This rule detects curl being used to download a file into the C:\\Users\\Public directory, the staging behavior of the Snake Python infostealer delivered through messaging services. Attackers stage a ZIP payload in this world-writable location before unpacking and executing it. The combination of a download utility writing to Public is a strong sign of malware staging.

Suspicious Microsoft Edge Unpacked Extension Load via UNC6692 Edgecution

This rule detects Microsoft Edge being launched with the load-extension flag pointing at an unpacked extension directory. UNC6692 abuses this Edgecution technique to sideload a malicious browser extension for persistence and data access after Quick Assist intrusion. Command-line loading of unpacked extensions is rare outside development and warrants review.

Suspicious Child Process Spawned by IIS Worker w3wp

This rule detects the IIS worker process w3wp.exe spawning PowerShell, cmd, or certutil, the webshell execution pattern seen in WS_FTP exploitation. The IIS worker should serve web content, not launch interactive shells or download tools, so these children indicate server-side code execution through a web application compromise.

Suspicious Application Shim Database Installation via sdbinst

This rule detects sdbinst.exe installing a custom application-compatibility shim database (.sdb) file, a technique used to inject code and persist by intercepting API calls to a target application. Legitimate shim installs are rare on endpoints, making a non-standard .sdb install worth review.

Suspicious fsutil Symlink Evaluation Enablement (via process_creation)

This rule detects fsutil enabling remote-to-local and remote-to-remote symbolic link evaluation, a step Repellent Scorpius performs before encryption so the Cicada3301 locker can traverse symlinks to reach additional data. Loosening symlink policy expands the ransomware blast radius and is rarely done outside of an attack.

Suspicious RegAsm MSBuild or AutoIt Accessing Browser Credential Stores

This rule detects RegAsm, MSBuild, RegSvcs, or AutoIt3 processes referencing browser credential and cookie stores such as Login Data, key4.db, and cookies.sqlite. Microsoft observed injected Lumma Stealer code inside these hosts harvesting DPAPI-protected browser secrets. These .NET and scripting hosts have no legitimate reason to read browser credential databases, making the combination a strong credential theft indicator.

Malicious Shadow Copy Deletion via Vssadmin (via process_creation)

This rule detects vssadmin deleting all volume shadow copies quietly. DarkWatchMan RAT removes shadow copies to inhibit recovery and hide its activity on the host.

Suspicious FL Studio Executable Side-Loading flengine DLL From Non-Standard Path

This rule detects the legitimate FL Studio binary fl.exe loading flengine.dll from a directory outside its normal installation path which is the DLL side-loading technique used to launch the BITSLOTH backdoor. Adversaries abuse this trusted signed executable to proxy execution of malicious code and evade defenses.

Malicious Cobalt Strike Post Exploitation Named Pipe

This rule detects creation of Cobalt Strike post exploitation named pipes following the postex prefix convention observed during the IcedID intrusion where the beacon spawned post exploitation jobs over SMB named pipes and this matters because the postex pipe pattern is a high fidelity signal of an active Cobalt Strike beacon performing credential and command tasks.

Suspicious Firewall Logging Disable via netsh (via process_creation)

This rule detects netsh disabling Windows firewall logging for dropped and allowed connections across all profiles. The DEEP#DOOR campaign disabled firewall logging to hide its command and control traffic.

Malicious Konni PowerShell Loader Reading Script from ProgramData via Invoke-Expression (via process_creation)

This rule detects PowerShell launched with an execution policy bypass that reads a script from the ProgramData directory and runs it through Invoke-Expression, the loader behavior of a Konni AsyncRAT LNK infection that drops d.ps1 into ProgramData. Adversaries leverage Get-Content piped into Invoke-Expression to execute a staged script while hiding the payload from the command line, making early detection critical for catching the loader before AsyncRAT deploys.