Sigma detection rules, expert-reviewed

Suspicious calc.exe Execution From Non-System Directory via DLL Side-Loading

This rule detects the Windows Calculator binary calc.exe running from a directory other than System32 or SysWOW64. The revived Qbot banking trojan copies a legitimate calc.exe alongside a malicious WindowsCodecs.dll so the trusted binary side-loads attacker code. Running a signed system binary from an unexpected path is a common evasion that lets malware execute under a benign process name.

Malicious Remote Desktop Enablement via Registry

This rule detects the fDenyTSConnections value being set to 0, enabling inbound Remote Desktop connections on a host. During KawaLocker deployment this was combined with firewall disabling to open interactive access for lateral movement. Enabling RDP on servers or endpoints that normally block it expands the attacker foothold.

Suspicious Proxy Execution of rundll32 Control_RunDLL via pcalua.exe (via process_creation)

This rule detects the Program Compatibility Assistant launcher pcalua.exe being used to run rundll32 with shell32.dll Control_RunDLL, a living off the land chain that the RedCurl EarthKapre APT uses to proxy execution of its payload. The pcalua binary masks the parent-child lineage of the launched code. This nested launcher and control panel invocation is not a normal user or administrator workflow.

Malicious Massive Services Deletion Burst (via process_creation)

This rule detects delete multiples services on a host. Attacker may target services related to databases, security products or backups (Veeam, Symantec, Acronis ...).

Malicious Command Output Written to SMB Named Pipe

This rule detects a command shell echoing data into a local named pipe object which the Dagon Locker actor used as a Cobalt Strike SMB beacon communication channel and this matters because writing to a raw named pipe from a shell is characteristic of beacon linking and post exploitation tasking rather than any legitimate scripting.

Malicious Mamona Ransomware Note and Encrypted File Extension

This rule detects creation of the Mamona ransomware note README.HAes.txt or files bearing the .HAes encrypted extension. These artifacts are written recursively across directories once Mamona completes its offline encryption.

Suspicious Computer Account Password Reset via net user by UNC1549

This rule detects the net command resetting the password of a machine account whose name ends with a dollar sign as observed in UNC1549 intrusions. Attackers reset computer account credentials to enable silver ticket abuse or DCSync style credential theft against domain controllers.

Suspicious Qilin EDR Killer BYOVD Service Installation via sc

This rule detects sc.exe creating a service that references the Qilin EDR killer drivers rwdrv or hlpdrv, matching the installation step that registers the bring-your-own-vulnerable-driver components as kernel services. Registering these drivers as services is how the tool loads them to terminate protected processes and suppress ETW. Service creation for these drivers indicates an imminent attempt to blind endpoint defenses.

AutoIt Payload Reassembly via copy /b File Concatenation

This rule detects the use of copy /b to concatenate multiple file fragments together with a bundled AutoIt3 interpreter. CastleLoader uses this evasion technique to rebuild its compiled a3x script on disk from scattered parts.

Malicious Web Shell Written to a Web Server Root by a Server Worker Process (via file_event)

This rule detects a web-server worker process such as the IIS w3wp.exe or a PHP/Java handler writing a server-side script file into a web root, the classic signature of a web shell being planted after exploitation of an internet-facing application. Web shells provide persistent remote access and are a recurring initial-access and persistence technique in the Red Canary Threat Detection Report. Detecting server processes dropping executable web content surfaces the compromise.

Malicious Registry Hive Dump of SAM and SYSTEM via Reg Save (via process_creation)

This rule detects use of reg save to export the SAM, SYSTEM, or SECURITY registry hives, a credential access technique used by CL-UNK-1068 to obtain local account hashes and LSA secrets. The exported hives allow offline extraction of credentials, so this command outside of sanctioned backup routines indicates active credential theft.

Suspicious Regsvr32 Execution From Non-Standard Datop Directory

This rule detects regsvr32.exe registering a payload located under the non-standard C\Datop directory used by the DatopLoader campaign that exploited ProxyShell to deliver QBot and Cobalt Strike. Attackers abuse regsvr32 to proxy execution of a malicious DLL and evade application controls, so execution from this staging path is a strong loader indicator.

EtherRAT Persistence via WindowsHost Run Key (via registry_set)

This rule detects EtherRAT establishing autostart persistence through a WindowsHost value under the CurrentVersion Run key that points to conhost or node executing the backdoor, a persistence behavior seen in The Gentlemen intrusions. Adversaries leverage Run key entries so the Node.js backdoor relaunches at every user logon.

StealC Persistence via LNK Dropped to Startup Folder by Non-Shell Process (via file_event)

This rule detects creation of a shortcut in the user Startup folder by a process other than the Windows shell or Office click-to-run, the persistence behavior used by the StealC V2 Blender campaign to auto-run its LNK payloads at logon. Adversaries leverage Startup-folder shortcuts for simple logon persistence, making early detection critical for surfacing the foothold before the stealer runs on every session.

Suspicious Browser History Wipe via RunDll32 ClearMyTracksByProcess

This rule detects rundll32 invoking InetCpl ClearMyTracksByProcess to clear browsing and cache artifacts. The Gh0stGambit dropper used this to erase indicators after deploying Gh0st RAT. Programmatic history wiping through this control panel handler is a cleanup step rarely performed by normal user activity.