Sigma detection rules, expert-reviewed

Interactive Service Creation Executing cmd via sc.exe

This rule detects use of sc.exe to create a service whose binary path launches cmd with an interactive start command. Lazarus created a service named WindowsNotification with an interactive binpath of cmd /K start to execute QuiteRAT. Registering a service that spawns an interactive command shell is a persistence and privilege abuse technique rarely seen in legitimate administration.

Curl Downloading Executable to Public User Directory

This rule detects curl.exe fetching a remote file and writing an executable into the C:\\Users\\Public directory. Lazarus operators used curl to download a payload as notify.exe into the public user folder after exploiting a ManageEngine vulnerability. Staging a downloaded binary in a world-writable public path is a common precursor to persistence and execution.

Potential StyleSmuggler (CVE-2026-75650) Exploitation Attempt - Magento GraphQL Styles Parameter (via webserver)

Detects POST requests to the Magento GraphQL endpoint carrying a styles[...] query parameter, the pattern reported for exploitation of StyleSmuggler (CVE-2026-75650), an unauthenticated remote code execution vulnerability in Magento Open Source and Adobe Commerce 2.4.4 through 2.4.9. A match indicates an exploitation attempt, not confirmed compromise; correlate with implant process and file indicators on the host.

Possible Plink Reverse Tunnel Command Line Execution

This rule detects Plink invoked to establish a reverse SSH tunnel with no interactive shell, using the -N and -R switches together. The Lazarus Group deployed a customized Plink (including a renamed pvhost.exe) to build reverse tunnels such as -N -R 18118 and -N -R 4443 -P 443 for command-and-control relaying. This tunneling technique lets attackers pivot into internal networks through an outbound SSH connection.

Suspicious svchost.exe Execution From AppData Roaming Directory

This rule detects svchost.exe running from a user AppData Roaming path instead of the System32 directory. The customized Yashma ransomware dropped a malicious svchost.exe copy into %AppData%\\Roaming to masquerade as the legitimate Windows service host. Attackers abuse this trusted name and wrong path to blend malicious execution into normal process activity and evade defenders.

Malicious StyleSmuggler (CVE-2026-75650) Web Shell Dropped In Magento Product Image Cache (via file_event)

Detects creation of a PHP web shell under the Magento product image cache using the ss_<10hex>/sync_<10hex>.php naming pattern. The web shell was dropped by a second threat actor observed exploiting StyleSmuggler (CVE-2026-75650), separate from the operator deploying the Rust implant. The shell returns 404 unless the request carries the expected X-Cache-Token header and executes arbitrary PHP supplied in the task parameter.

Malicious StyleSmuggler (CVE-2026-75650) Post-Exploitation Implant Process (via process_creation)

Detects execution of the Rust backdoor deployed on Magento and Adobe Commerce servers after successful exploitation of StyleSmuggler (CVE-2026-75650). The implant masquerades as a kernel thread ([kworker/u:8:0]) or as legitimate system binaries (fc-cache, chronyd, gvfsd-user) running from temporary or hidden home-directory paths. Kernel threads are never created through exec, so a kworker-like command line in a process creation event indicates masquerading; genuine fc-cache and chronyd binaries do not run from these paths.

Suspicious Network Connection From wabmig.exe (Turian Injection)

This rule detects the Windows Contacts import utility wabmig.exe initiating outbound network connections. The Turian backdoor injects into wabmig.exe, an application with no legitimate need for network communication, to mask its command-and-control traffic. Outbound connections from this process strongly indicate process injection and active C2.

Malicious Evilginx AiTM Phishing Proxy Default TLS Certificate

This rule detects TLS certificates carrying the Evilginx default issuer strings Evilginx Signature Trust Co. or Evilginx Super-Evil Root CA. These constants are baked into the Evilginx reverse-proxy adversary-in-the-middle framework used in this MFA-bypass phishing campaign to relay victim sessions, so observing them indicates an active AiTM proxy harvesting credentials and session cookies.

Suspicious Outbound Network Connection from Explorer Process

This rule detects the Windows explorer.exe process establishing outbound network connections to external hosts which is anomalous because Explorer does not normally initiate internet beacons. In the Gamaredon campaign the Remcos backdoor injected into explorer.exe to blend command and control traffic with a trusted process.

Suspicious Outbound Connection To MoonPeak C2 High Ports

This rule detects outbound network connections to the non-standard high ports used by MoonPeak command-and-control infrastructure. MoonPeak a XenoRAT-based implant tracked to North Korean actors communicated with its C2 over ports 9999 9966 9936 and 8936. Beaconing to fixed uncommon high ports is a strong indicator of covert C2 that bypasses port-based egress assumptions.

Suspicious LucidRook DismCore.dll Side-Load into Browser Process

This rule detects the DISM component DismCore.dll being loaded by msedge.exe, matching the LucidRook side-loading chain where a renamed DISM host loads a trojanized DismCore.dll. Microsoft Edge has no legitimate reason to load DISM servicing libraries, so this pairing reveals DLL search-order hijacking. The load indicates the LucidRook implant is being activated.

Malicious BadIIS Module Load into IIS Worker Process by UAT-8099

This rule detects the IIS worker process loading one of the BadIIS native module DLLs used by UAT-8099. The actor deploys modules such as iis32.dll and iis64.dll to passively backdoor Internet-facing web servers. A worker process loading these attacker-specific DLLs indicates a malicious IIS module is active.

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

This rule detects the IIS process inetinfo.exe loading wmicodegen.dll, a DLL sideloading technique UAT-8099 uses to run Cobalt Strike on compromised web servers. The inetinfo.exe process has no legitimate reason to load this library. This load indicates in-memory beacon deployment via search-order hijacking.

Suspicious Dell ControlVault DLL Load by Unexpected Process (ReVault)

This rule detects processes other than the legitimate Windows Biometric service host loading the Dell ControlVault libraries bcmbipdll.dll or BCMStorageAdapter.dll. The ReVault attack abuses ControlVault firmware vulnerabilities, and abnormal processes loading these libraries indicate exploitation attempts against the security co-processor. Such loads can lead to code execution and firmware-level persistence.