Sigma detection rules, expert-reviewed

Malicious Windows Defender Antispyware Disable via Registry (via registry_set)

This rule detects modification of the DisableAntiSpyware registry value to enable it and turn off Microsoft Defender. Black Basta operators disable Defender via this policy value to evade detection before deploying ransomware, so a set of this value to one indicates active defense evasion.

Suspicious Scheduled Task ApphostRagistreationVerifier Creation by FishMonger

This rule detects creation of a scheduled task named ApphostRagistreationVerifier, a misspelled masquerade used by the FishMonger group to run SprySOCKS as SYSTEM. The activity is tied to the FishMonger arsenal upgrade that establishes persistence through a task impersonating a legitimate host registration verifier. Detecting this unique task name is important because it reveals privileged persistence for a stealthy backdoor.

Suspicious Wscript Execution of JavaScript From AppData Local Temp via Process Creation (via process_creation)

This rule detects Windows script host launching a JavaScript file from the user AppData Local Temp directory, the initial execution stage of Gootloader as emulated by Red Canary with Atomic Red Team. Gootloader delivers malicious .js payloads via SEO-poisoned downloads, and script host running such files from a temporary path is a reliable entry point for the infection chain.

Malicious LATRODECTUS Loader DLL Execution via rundll32 via process_creation

This rule detects rundll32.exe executing a DLL from the LATRODECTUS Custom_update staging directory using its Update-prefixed filename. The loader drops its payload as an Update DLL and invokes it through rundll32 to initialize the ICEDID-successor implant. This execution pattern is characteristic of LATRODECTUS post-installation activity.

In-Memory Rundll32 Execution Without a Command Line (via process_creation)

This rule detects rundll32.exe running with no export or arguments on its command line, an anomalous state that legitimate use rarely produces and that commonly indicates code injection into a hollowed rundll32 process. Both System Binary Proxy Execution and Process Injection rank among the top techniques in the Red Canary Threat Detection Report, and an argument-less rundll32 is a strong heuristic for the latter. Detecting this pattern surfaces stealthy in-memory execution under a trusted binary.

Suspicious External IP Discovery via curl to ifconfig.me via process_creation

This rule detects curl invocations that query the public IP lookup service ifconfig.me. MuddyWater used this command to determine the victim host external address for situational awareness prior to establishing tunnels, and while such lookups occur in some admin scripts they are unusual on endpoints and warrant review alongside other reconnaissance.

Suspicious netsh Port Proxy Configuration for Covert Tunneling

This rule detects configuration of a netsh portproxy rule used by a Russian APT during the Nearest Neighbor Attack to relay traffic and pivot between networks. Port proxies forward connections to hide lateral movement paths. This technique enables covert access through compromised hosts.

Suspicious Browser Launch With Remote Debugging Port via Process Creation

This rule detects a Chromium-based browser started with the remote debugging port switch, the Chrome DevTools Protocol abuse msaRAT uses to hijack the browser and build a covert C2 channel as reported by Cisco Talos. The loader spawns the browser under its control to drive WebRTC and DevTools traffic through the victim session. Detecting the remote debugging switch surfaces browser hijacking that blends into normal web activity.

Suspicious Silent AnyDesk Installation for Remote Access by DeadLock Ransomware

This rule detects silent unattended installation of AnyDesk configured to start with Windows. The DeadLock ransomware operators deploy AnyDesk as a covert remote access tool for persistence and hands-on control. Silent installation with automatic startup indicates the tool is being planted rather than installed by a user.

Suspicious Internet Settings ZoneMap Modification Enabling UNC as Intranet (via registry_set)

This rule detects modification of the Internet Settings ZoneMap UNCAsIntranet value, part of the ZoneMap changes made by the OpenClaw payload to relax security zone handling and suppress network warnings before contacting its C2. Adversaries adjust ZoneMap keys to make remote and UNC content trusted, making this registry change a useful defense-evasion signal when correlated with the loader.

Suspicious Desktop Window Manager Spawning Shutdown Utility via Process Creation

This rule detects the Desktop Window Manager process dwm launching the shutdown utility which is an anomalous chain observed in an in the wild Windows local privilege escalation exploit that injected shellcode into dwm and invoked shutdown to trigger a DLL hijack against LogonUI. The genuine dwm process does not spawn shutdown so this relationship indicates exploitation.

Possible Process Injection Target RegAsm Launched Without Arguments via Process Creation

This rule detects RegAsm.exe from the .NET Framework directory started with no command-line arguments, a state characteristic of a hollowed or injected host process rather than legitimate assembly registration. Lumma Stealer distributed through fake Hamster Kombat lures injects its payload into RegAsm.exe to run under a trusted signed binary. This indicates likely process injection and stealer execution.

Malicious NTDS Extraction via Ntdsutil IFM Media Creation

This rule detects use of ntdsutil to create an install from media snapshot which extracts the Active Directory database and this technique was used during the NetSupport intrusion to steal the domain credential store and this matters because IFM creation dumps every domain hash in one operation and is almost never run by legitimate operators outside of controlled domain controller provisioning.

Suspicious Local Account Creation via Net Command

This rule detects local user account creation through the net utility, a living-off-the-land technique used to establish persistence, including accounts masquerading as WDAGUtilityAccount or ASP.NET service identities. Attackers add accounts to retain access after initial compromise. Unexpected account creation on endpoints is a common persistence and privilege staging step.

Malicious Remote HTA Execution Disguised as Media File via mshta (via process_creation)

This rule detects mshta.exe executing a remote HTA payload whose URL is disguised with an audio or video file extension. The ClearFake ClickFix variant delivers its loader as an HTA masquerading as an mp3 mp4 or m4a file fetched over HTTP. Combining the mshta living-off-the-land binary with a remote media-named URL is a reliable indicator of drive-by compromise.