Sigma detection rules, expert-reviewed

Suspicious Windows Event Log Clearing via wevtutil on EC2 Host

This rule detects the wevtutil utility being used to clear Windows event logs which destroys host forensic evidence. In the Wiz hybrid cloud response the attacker deleted local operating system logs on compromised EC2 Windows instances to frustrate investigation. This is important because clearing event logs is a deliberate anti-forensic action that almost never occurs during normal administration and hides earlier attacker activity.

Malicious Axios npm Compromise Windows Payload Artifacts wt.exe and 6202033 (via process_creation)

This rule detects execution of the wt.exe payload dropped in ProgramData and the numbered staging scripts 6202033.vbs 6202033.ps1 and system.bat used by the compromised axios npm package to deploy its RAT on Windows. These fixed artifact names run during or shortly after npm install and indicate an active infection beaconing every 60 seconds.

Malicious Windows Defender Exclusion of System32 via Registry (via registry_set)

This rule detects a Windows Defender path exclusion being registered for the System32 directory, a defense-evasion step in the full TinyTurla kill chain. Excluding System32 lets Turla stage and run its service DLL from a trusted location without antivirus inspection.

Malicious Print Spooler Privilege Escalation via Printer Added - CVE-2020-1048 (via powershell)

This rule detects abuse the printer spooler features to load a DLL. The attack is composed by 4 steps > 1) create a printer that points to a missing DLL 2) print to that port 3) crash the printer spool 4) have his original DLL registered for privilege escalation.

Malicious WARMCOOKIE DLL Execution from RtlUpd Path via rundll32

This rule detects rundll32.exe executing a DLL from the C:\ProgramData\RtlUpd directory, the fixed drop path and loader behavior of the WARMCOOKIE backdoor. The malware writes RtlUpd.dll to this ProgramData location and runs it via rundll32 to establish its foothold.

Malicious DLL Sideloading of BrMod104.dll by Stately Taurus (via image_load)

This rule detects the loading of BrMod104.dll, a malicious module sideloaded by the Stately Taurus (Mustang Panda) group to deploy the Bookworm and PubLoad malware families. DLL sideloading via a signed host executable lets the actor execute code while evading application controls and blending with legitimate processes.

Malicious SesameOp Netapi64 Artifact Files Written to Windows Temp (via file_event)

This rule detects creation of SesameOp working files such as Netapi64.start and Netapi64.Exception in Windows Temp along with files carrying the .Netapi64 extension. These artifacts are dropped by the SesameOp backdoor while it decrypts payloads and stores state for its OpenAI Assistants API C2 relay. Surfacing these distinctive on-disk markers reveals an active backdoor foothold that hides its traffic inside a legitimate cloud API.

Suspicious fontdrvhost Execution with Config Argument

This rule detects a process named fontdrvhost.exe executed with a config file argument, a masquerading pattern from the REF7707 campaign where a renamed tool was staged via a scheduled task named EPolicyManager. The genuine Windows font driver host takes no such command line arguments so this indicates an impostor binary. Combined with scheduled task execution this reveals attacker persistence and execution.

Suspicious Scheduled Task Persistence Masquerading as TeamViewer (Qilin)

This rule detects creation of a scheduled task named TVInstallRestore configured to run at user logon. The Qilin ransomware group creates this task, masquerading as a TeamViewer component, to persist and restore access. Logon-triggered scheduled tasks with deceptive names are a common persistence technique.

Reported BINDCLOAK Encrypted Payload File Event

Detects file telemetry for the exact encrypted payload filename shown in the attack-flow image. It covers the file IOC, not the decryption or reflective loading behavior.

Suspicious Encoded PowerShell Execution Following SharePoint Exploitation (via ps_script)

This rule detects PowerShell invoked with a base64 encoded command, used in ToolShell post-exploitation to stage payloads while obscuring intent. Encoded command execution on SharePoint servers exploiting CVE-2025-53770 indicates hands-on-keyboard activity following initial access.

Malicious SesameOp Netapi64 Loader DLL Load via Masqueraded Netapi Module (via image_load)

This rule detects loading of Netapi64.dll, a loader module used by the SesameOp backdoor that masquerades as a legitimate Windows networking library while relaying commands through the OpenAI Assistants API for command and control. Adversaries use this .NET loader to decrypt and execute payloads under a trusted-looking name, so catching the module load exposes the implant before its covert C2 channel activates.

Malicious APT-C-60 SpyGlace Masqueraded Artifact Files (via process_creation)

This rule detects command lines referencing the iconcache.dat, Cached2014.tmp, sdll.tmp, or sDll_jj.dll artifacts dropped by APT-C-60 in its 2026 SpyGlace intrusions. These deliberately mundane cache and temp filenames masquerade loader and backdoor components to blend with legitimate system files.

DCOM Lateral Movement - Via MMC20 (via powershell)

This rule detects execute the Impacket DCOMexec tool in order to abuse DCOM services.

Malicious mshta.exe Spawning bitsadmin via ClickFix Phantom Meet

This rule detects mshta.exe spawning bitsadmin.exe, the process chain produced by the ClickFix Phantom Meet campaign where a pasted clipboard command runs a remote HTA that then uses bitsadmin to download follow on executables. Neither mshta launching bitsadmin nor this fake meeting lure is normal user behavior. The parent child relationship is a high confidence detection of the ClickFix delivery chain.