Sigma detection rules, expert-reviewed

Suspicious Payload Retrieval from Cloudflare Tunnel via LOLBin (via process_creation)

This rule detects Windows script and download utilities referencing a trycloudflare.com tunnel hostname on their command line, an infrastructure pattern used by PythonRatLoader to stage batch, WebDAV and Python payloads. Cloudflare quick tunnels are occasionally used by developers so context should be reviewed.

Malicious SnipBot DLL Execution via rundll32 from KeyStore Directory (via process_creation)

This rule detects rundll32 loading SnippingTool.dll from a KeyStore folder and invoking its Main export, the execution technique used by the SnipBot variant of RomCom malware. Proxying execution of the malicious DLL through the trusted rundll32 binary helps the loader evade application controls.

Malicious Phantom Taurus OutlookEN Web Shell File Creation (via file_event)

This rule detects creation of the OutlookEN.aspx web shell dropped by Phantom Taurus on compromised Exchange and IIS servers. The web shell loads the NET-STAR IIServerCore backdoor into the worker process to provide persistent server access. Detecting the file drop catches the initial foothold before the backdoor is loaded into memory.

Suspicious Scheduled Task Masquerading as Wininet CacheTask (via process_creation)

This rule detects schtasks creating a scheduled task under a Wininet CacheTask name that impersonates a legitimate Windows maintenance task. The malvertising backdoor operators registered a task with this masqueraded name for persistence and periodic payload execution. A user-created task mimicking a built-in system task path is a strong persistence and masquerading indicator.

Scheduled Task Creating Per-Minute Hidden PowerShell Execution

This rule detects schtasks creating a task that runs at a one-minute interval and launches a hidden PowerShell script. The GPU miner campaign registered a scheduled task firing every minute to run hidden powershell against cor.ps1 or core.ps1 for persistence and re-infection. A minute-cadence hidden PowerShell task is a strong indicator of automated malware persistence.

Malicious LSASS Credential Dumping via Comsvcs MiniDump (via process_creation)

This rule detects the use of the built-in comsvcs.dll MiniDump export (typically invoked through rundll32) to write a memory dump of a target process such as LSASS to disk. Credential access via LSASS memory is a top technique in the Red Canary Threat Detection Report, giving adversaries plaintext credentials and hashes for lateral movement. Because this pattern relies on a signed system DLL, detecting the comsvcs MiniDump invocation surfaces stealthy credential theft.

Malicious Microsoft Defender Massive Host Infection (via windefend)

This rule detects scenarios where multiple suspicious threats are detected on a single host.

OceanLotus (APT-C-00) Payload Staging in Fake NVIDIA Setup Temp Directory (via file_event)

This rule detects files being written into a fake NVIDIA setup directory under the user Temp folder, a staging behavior observed by the 360 Threat Intelligence Center in the OceanLotus double-loader campaign where the loader created a NVidiaSetup working directory to host encrypted host data and the reflectively loaded Cobalt Strike beacon. Adversaries masquerade attacker directories as trusted vendor installers to blend payload staging into ordinary Temp activity.

Malicious InvisibleFerret Python Loader Execution from Hidden .pyp Directory

This rule detects a python.exe located in a hidden .pyp user directory executing the .npl payload, matching the InvisibleFerret stage of the North Korean job-hunter campaigns described by Unit 42. The actor stages a private Python runtime and payload under a dotted folder in the user profile which is an unusual pattern that reveals the second-stage backdoor.

AdminSDHolder Permissions Changed for Persistence (via security)

This rule detects changes permissions on the AdminSDHolder container to establish persistence.

Suspicious Msiexec Remote Package Installation from URL via Process Creation

This rule detects msiexec.exe installing an MSI package directly from a remote HTTP or HTTPS URL, a technique used in the Operation Rusty Flag campaign to deploy a Rust implant from a Dropbox-hosted MSI reached through a double-extension LNK. Adversaries abuse the trusted Windows Installer to proxy execution and pull payloads while evading application controls.

Malicious ClickFix PowerShell DownloadFile Loader with Hidden Window

This rule detects a hidden-window PowerShell process using DownloadFile to fetch a script from a remote host, the NetSupport RAT ClickFix loader pattern. Victims pasted a command that ran PowerShell with hidden window and no-profile flags to download and then execute a follow-on .ps1 payload. Hidden PowerShell combined with a remote file download is a classic first-stage loader behavior.

Suspicious MSHTA Execution of Polyglot PDF File Spawned by cmd (via process_creation)

This rule detects mshta.exe launched by cmd.exe with a PDF file argument, matching the UNK_CraftyCamel chain where an LNK ran cmd then mshta to execute a PDF and HTA polyglot. Legitimate mshta rarely processes files with a .pdf extension.

Suspicious Linux Network Route Reconnaissance via Proc Filesystem by UAT-7290

This rule detects reading of the kernel routing table from proc and filtering for the default gateway using awk. UAT-7290 runs this one-liner to fingerprint the network configuration of compromised edge devices. Parsing the default route helps an actor understand the victim network before deploying tunneling implants.

ShadowPad DLL Sideloading via logger.exe Loading logexts.dll (via image_load)

This rule detects logger.exe loading a logexts.dll from outside the Windows system directories, the DLL side-loading behavior used to launch the ShadowPad backdoor in the NailaoLocker intrusions across Europe. Adversaries abuse benign binary and library names to run the ShadowPad loader under a trusted-looking process while evading detection.