Sigma detection rules, expert-reviewed

Malicious PlugX Scheduled Task Named InternetUpdateTask (via process_creation)

This rule detects creation of a scheduled task named InternetUpdateTask, the persistence artifact left by the PlugX malware family to relaunch its DLL sideloaded loader at logon. The benign sounding task name masks recurring execution of the implant, so its creation is a strong indicator of PlugX persistence being established.

Suspicious Python Execution from WebDAV Share via PowerShell (via process_creation)

This rule detects python.exe spawned by PowerShell while referencing a remote WebDAV share path in its command line. The Voldemort espionage campaign ran Python directly from mounted TryCloudflare WebDAV shares to load its backdoor without local staging.

Malicious Reverse SSH Tunnel via Renamed PuTTY svchosts.exe (via process_creation)

This rule detects the Hive0129 BlotchyQuasar RAT establishing a reverse SSH tunnel using a renamed PuTTY binary called svchosts.exe to forward internal SMB and RDP ports over the HTTPS port. The misspelled svchosts.exe name combined with remote-forward switches and batch mode reveals covert tunneling. Legitimate services do not run this binary.

Self-Deletion via Ping Loopback Delay and Del Command

This rule detects a command line that pings the loopback address to introduce a delay before deleting a file, the self-cleanup routine used by PlayBoy Locker to remove its own binary. Chaining ping 127.0.0.1 with del is a common anti-forensic indicator-removal technique in malware.

Suspicious Wi-Fi Credential Harvesting via netsh wlan show profile (via process_creation)

This rule detects netsh.exe enumerating stored wireless profiles with wlan show profile, a command HookSpoofer stealer runs via cmd.exe to harvest Wi-Fi credentials and map nearby networks. The stolen wireless keys support credential theft and local discovery. Detecting this command line flags stealer reconnaissance on infected hosts.

Malicious Rundll32 Execution Of HTML Payload With DllRegisterServer

This rule detects rundll32 loading a file with an .html extension and calling the DllRegisterServer export, the disguised DLL execution used in the Zloader attack against Intel 471. Masquerading the DLL as an HTML file evades extension-based inspection while rundll32 still runs it as a library. This mismatch of extension and export is a strong loader indicator.

Suspicious Screen Capture via PowerShell Graphics API (via process_creation)

This rule detects PowerShell invoking the CopyFromScreen graphics method to grab the desktop, a screen-capture collection technique used to spy on a victim's session. Screen capture is tracked in the Red Canary Threat Detection Report. Detecting the graphics-API call surfaces surveillance of the user's screen.

Suspicious netsh Outbound Network Connection from IDAT Loader Injection

This rule detects the netsh utility initiating outbound internet connections which is abnormal for the tool. A fake IT support site leading to Vidar used the Hijack IDAT Loader to inject shellcode into netsh so C2 traffic runs from a signed process. netsh has no legitimate reason to reach external hosts so this points to process injection.

Malicious MSI Installation from Remote WebDAV Share via process_creation

This rule detects msiexec.exe installing an MSI package from a remote WebDAV or HTTP location when launched by the WMI provider host, matching the LATRODECTUS loader delivery chain. The oversized JavaScript dropper uses WMI to spawn msiexec and retrieve a remote installer. This staging technique delivers second-stage payloads while evading direct download detection.

Suspicious Windows Event Log Clearing via Dire Wolf Ransomware (via process_creation)

This rule detects use of wevtutil to clear Windows event logs, an indicator removal step performed by Dire Wolf ransomware across the Application, System, Security and Setup logs.

DSRM Password Changed - Reg via PowerShell (via powershell)

This rule detects reset or synchronize with another domain account the DSRM (Directory Services Restore Mode) password in order to escalate privileges.

Obfuscated Edge/Chrome Headless Feature Abuse for Payload Download (via process_creation)

This rule detects executes Chrome in headless mode in order to download a payload. Document Object Model (DOM) may also be abused to download obfuscated data from attacker repositary.

Malicious Data Exfiltration via MEGAcmd

This rule detects execution of MEGAcmd components such as MEGAcmdUpdater.exe used to sync victim data to MEGA cloud storage during double-extortion. This was observed during Cephalus ransomware intrusions. Cloud exfiltration to MEGA prior to encryption signals data theft ahead of extortion.

Suspicious PowerShell Indirect Execution via Get-Command

This rule detects PowerShell using Get-Command together with the call operator to resolve and invoke a cmdlet indirectly which the Gamaredon LNK delivery chain uses to obscure calls to Invoke-Expression and evade command line based detection. Piping or passing Get-Command output into an invocation operator is an obfuscation pattern rarely seen in legitimate scripts.

Malicious User Added to a Group via Commandline (via process_creation)

This rule detects escalate privilege by adding a user to a group via commandline.