Sigma detection rules, expert-reviewed

Suspicious GammaLoad VBScript Execution via wscript.exe (via process_creation)

This rule detects Hive0051 GammaLoad activity where wscript.exe launches a VBScript with the batch and engine switches the malware uses to run its loader silently. The combination of the batch flag with an explicit vbscript engine and the additional GammaLoad switches is uncommon in normal scripting. It reveals the scheduled loader execution.

Malicious easinvoker.exe DLL Hijack from Public Libraries (via process_creation)

This rule detects DBatLoader abusing the signed easinvoker.exe binary staged inside the Users Public Libraries folder to side-load a malicious netutils.dll and bypass User Account Control. The legitimate easinvoker.exe resides under System32, so execution from a Public Libraries path is anomalous. This chain launches a dropped batch file with elevated privileges.

Possible WailingCrab MQTT C2 to Public Broker (via network_connection)

This rule detects WailingCrab command-and-control that abuses the MQTT messaging protocol by connecting to the public emqx broker on TCP port 1883. Enterprise endpoints seldom initiate MQTT sessions to this public broker. The connection carries base64-encoded command traffic.

Malicious NsBars.dll Side-Loaded by Textoescritor.exe (via image_load)

This rule detects the Hive0147 Picanha loader abusing the legitimate Textoescritor.exe application to side-load a malicious NsBars.dll from its bin subdirectory. This trusted-binary hijack decrypts and launches the Mekotio banking trojan. The DLL and host pairing is specific to this campaign.

Malicious WindowsCodecs.dll Side-Loaded by calc.exe (via image_load)

This rule detects ITG05 Headlace packaging a renamed calc.exe with a malicious WindowsCodecs.dll so the trusted binary side-loads attacker code. The genuine WindowsCodecs.dll loads only from system directories, so a load from another folder is anomalous. The hijacked DLL executes the hidden Headlace payload.

Malicious version.dll Side-Loaded by explorer.exe (via image_load)

This rule detects WailingCrab hijacking explorer.exe to side-load a malicious version.dll from a user-writable directory instead of the system folder. The genuine version.dll is loaded only from System32 or SysWOW64, so a load from AppData or ProgramData is anomalous. This grants the loader stealthy code execution inside a trusted process.

Suspicious Executable with Double Batch Extension (via file_event)

This rule detects Strela Stealer delivery artifacts written with a deceptive double extension where a batch suffix is followed by an exe suffix to disguise an executable as a script. Files ending this way are almost always an attempt to mislead the user or analyst. Their creation warrants investigation.

Suspicious OCEANMAP EdgeContext.url Startup Persistence (via file_event)

This rule detects the ITG05 OCEANMAP backdoor dropping an EdgeContext.url file into the Windows Startup directory to relaunch itself at logon. A url shortcut named EdgeContext placed in Startup is not created by legitimate software. This establishes persistence for the IMAP-based backdoor.

Suspicious PIF Persistence File in Public Libraries (via file_event)

This rule detects DBatLoader writing its packed payload as a PIF file into the Users Public Libraries directory, which it references from a url shortcut for persistence. Program information files placed in this location are not produced by legitimate software. The file enables the loader to relaunch after reboot.

Suspicious dMSA Membership Modification via msDS-GroupMSAMembership Attribute

This rule detects Active Directory changes to the msDS-GroupMSAMembership attribute on a delegated managed service account, the self-referential membership manipulation at the core of the Huntress dMSA Ouroboros credential-extraction technique. Writing the dMSA object's own SID into this attribute lets it authenticate to itself and unlock credential extraction. Unexpected modification of this attribute is a high-confidence sign of the abuse chain.

Suspicious Modification of msDS-KeyCredentialLink for Shadow Credential Abuse

This rule detects Active Directory directory-service changes writing to the msDS-KeyCredentialLink attribute, the shadow-credential primitive used in the Huntress dMSA Ouroboros technique to obtain PKINIT authentication material on Windows Server 2025. Populating this attribute lets an attacker request Kerberos tickets and extract credentials for the target object. Modification outside device registration or trusted CA workflows is a strong indicator of credential-access abuse.

Suspicious SOAPHound Null Filter LDAP Query via security

This rule detects Directory Service event 1644 recording an LDAP search that combines the SOAPHound style negated false filter with a security-descriptor SDflags value of 0x7. This filter construction is used to return every object with its security descriptor in a single sweep, so its presence indicates automated bulk Active Directory collection over ADWS.

Suspicious SOAPHound Style LDAP Query with SDflags and all_with_list via security

This rule detects Directory Service field engineering event 1644 recording LDAP searches that request all attributes with the SDflags control set to 0x7. SOAPHound and similar ADWS-based collectors issue these broad security-descriptor-inclusive queries to map the domain, so this search-filter signature indicates bulk directory harvesting.

Suspicious Active Directory Web Services Query from Localhost via SOAPHound

This rule detects Directory Service event 1644 activity attributed to a client connecting from the IPv6 loopback address over the Active Directory Web Services path, the local ADWS proxying behavior SOAPHound uses to relay LDAP through port 9389. Running the collector on a domain controller and querying ADWS via localhost obscures the true source of enumeration. A loopback ADWS client issuing bulk directory queries is anomalous and suggests on-host reconnaissance tooling.

Suspicious SharpHound Group Enumeration LDAP Filter

This rule detects the characteristic SharpHound LDAP filter clause querying sAMAccountType 268435456 which enumerates security groups during BloodHound collection, captured in Directory Service event 1644. This account-type value selects global and universal groups and appears in the compound filters SharpHound issues while mapping group membership. Its presence indicates automated Active Directory reconnaissance ahead of privilege-escalation path finding.