Sigma detection rules, expert-reviewed

Suspicious COM Handler Hijack of MsCtfMonitor CLSID via CharmingCypress

This rule detects registration of a COM InprocServer32 handler under the MsCtfMonitor task CLSID which CharmingCypress hijacked for persistence and code execution. Hijacking this scheduled-task COM object causes attacker code to load when the task triggers. This technique blends malicious execution into legitimate Windows components.

Malicious Volume Shadow Copy Deletion via WMI PowerShell (via process_creation)

This rule detects PowerShell querying the Win32_Shadowcopy WMI class and invoking a delete or remove operation to destroy volume shadow copies. Akira used this to inhibit system recovery before encryption. Removing shadow copies prevents victims from restoring files without paying the ransom.

Malicious Wscript Executing Temp File as JavaScript (via process_creation)

This rule detects wscript or cscript invoking the JavaScript engine against a file with a tmp extension, the execution behavior of a Konni AsyncRAT chain that runs 83972.tmp as JavaScript from ProgramData. Adversaries leverage the engine override switch to run script content from a mismatched temp extension while evading extension based controls, making early detection critical for surfacing the scripting stage before further payload execution.

Suspicious Executable Launched By Explorer From Archive Path (via process_creation)

This rule detects explorer.exe launching an executable whose path resides inside a ZIP archive directory, matching TinyNote delivery where a user runs an EXE directly from an opened archive. Executing binaries from within archive temp paths is a common initial-access vector and bypasses mark-of-the-web prompts.

Malicious Webserver IIS Module Installed - Command (via process_creation)

This rule detects deploy an IIS module.

Suspicious Enabling of Remote Desktop via fDenyTSConnections (via registry_set)

This rule detects the fDenyTSConnections value being set to zero, which enables inbound Remote Desktop on a host, a change attackers make to establish interactive remote access for lateral movement. Enabling RDP through the registry is a lateral-movement enablement technique in the Red Canary Threat Detection Report. Detecting this modification surfaces remote-access being opened on the endpoint.

Malicious Account Added to Domain Admins Group via net Command

This rule detects the net command adding an account to the Domain Admins group, a privilege escalation step observed during Gootloader post-exploitation where a rogue account was joined to Domain Admins. Elevating an attacker-controlled account to domain administrator grants full directory control. Domain Admins membership changes from the command line are rare and high risk.

Uncommon Execution Delay via W32tm Stripchart (via process_creation)

This rule detects the time service utility w32tm being run in stripchart mode, an abuse the STRT cross-RAT analysis attributes to DarkCrystal RAT as a sleep primitive to delay execution and evade sandbox analysis. Adversaries leverage w32tm stripchart as an unusual timing mechanism in place of a normal sleep call, so this behavior warrants review alongside the surrounding process chain.

Suspicious rundll32 Loading DEEPDATA data.dll with mod.dat Key via BrazenBamboo

This rule detects rundll32 loading data.dll together with a mod.dat argument the loading pattern of the BrazenBamboo DEEPDATA malware framework. DEEPDATA decrypts its payload using the mod.dat key file. Proxy execution via rundll32 helps evade application controls and disguise malware as a signed process.

Malicious Silver Fox Scheduled Task Persistence via AppClient (via process_creation)

This rule detects schtasks.exe creating a minute interval task named AppClient, the persistence mechanism used by the Silver Fox ABCDoor backdoor to repeatedly relaunch itself. The high frequency task keeps the implant resident after a tax notification phishing compromise. Detecting the AppClient task creation surfaces backdoor persistence.

Suspicious Assembly Execution via Regasm or Regsvcs From a User Path (via process_creation)

This rule detects regasm.exe or regsvcs.exe executing an assembly from a user, temp or ProgramData directory, a signed-binary proxy technique that runs attacker .NET code through a trusted registration utility. Regasm and Regsvcs abuse is a defense-evasion technique in the Red Canary Threat Detection Report. Detecting execution from user-writable paths surfaces trusted-binary code proxying.

Suspicious UAT-8302 DLL Side-Loading via Signed Application Launcher

This rule detects the UAT-8302 side-load launchers Yandex.exe or VMtools.exe invoked with the campaign-specific -r and -p:ini arguments that trigger loading of a malicious DLL and its encrypted configuration. Abusing a benign signed application to load attacker code lets the CloudSorcerer implant execute under a trusted process. The paired argument pattern narrows this to malicious side-loading rather than normal use.

Malicious Volume Shadow Copy Deletion via vssadmin by Medusa Ransomware

This rule detects use of vssadmin to delete all volume shadow copies quietly, matching the inhibit-recovery step performed by Medusa ransomware before encryption per Unit 42. Ransomware wipes shadow copies to prevent victims from restoring files which is a strong pre-encryption indicator of an active ransomware attack.

Malicious Fileless PowerShell Registry Payload Execution via Process Creation

This rule detects hidden PowerShell that reads a payload from a registry value and pipes it to Invoke-Expression. StripedFly stores its encrypted loader under an HKCU Applets key and executes it fileless via hidden PowerShell with IEX, achieving stealthy in-memory execution.

PowerShell Command-Line Obfuscation Constructs (via process_creation)

This rule detects PowerShell command lines that use format-operator, character-array, backtick or string-reversal obfuscation to hide the real payload from simple string matching. Command obfuscation accompanies the heavy PowerShell abuse documented in the Red Canary Threat Detection Report, and these constructs are rarely produced by legitimate one-liners. Detecting the obfuscation syntax surfaces evasive script execution regardless of the ultimate payload.