Sigma detection rules, expert-reviewed

Suspicious Linux Network Route Reconnaissance via Proc Filesystem by UAT-7290

This rule detects reading of the kernel routing table from proc and filtering for the default gateway using awk. UAT-7290 runs this one-liner to fingerprint the network configuration of compromised edge devices. Parsing the default route helps an actor understand the victim network before deploying tunneling implants.

ShadowPad DLL Sideloading via logger.exe Loading logexts.dll (via image_load)

This rule detects logger.exe loading a logexts.dll from outside the Windows system directories, the DLL side-loading behavior used to launch the ShadowPad backdoor in the NailaoLocker intrusions across Europe. Adversaries abuse benign binary and library names to run the ShadowPad loader under a trusted-looking process while evading detection.

Suspicious Masqueraded Zemana Driver Written to Disk via updatedrv (via file_event)

This rule detects the vulnerable Zemana driver being written to disk under the masqueraded name updatedrv.sys, a staging step used by the Terminator tool before creating a service and loading the driver to disable endpoint protection. The file is typically dropped into the system drivers directory or a ProgramData usoshared path.

Suspicious Microsoft Defender Exclusion Added via Add-MpPreference (via process_creation)

This rule detects the use of Add-MpPreference to register a Microsoft Defender exclusion, a defense-evasion action performed by the malvertising-delivered info stealers to whitelist their payload paths before execution. Adversaries add exclusions so downloaded stealer and NetSupport components run without inspection, so unexpected exclusion changes outside managed policy warrant investigation.

Malicious Lazarus Rundll32 Execution of Sup ETL Privilege Escalation Loader (via process_creation)

This rule detects rundll32.exe executing a sup.etl file from the USOShared directory using the SerializeMarketTable export as observed in the Lazarus attack on Windows web servers. Loading an etl file as a DLL through an unusual export is a strong indicator of this loader.

IFM Detected - ESENT - Installation from Media (via application)

This rule detects create an IFM image (usually used for deploying domain controllers to reduce replication traffic) for dumping credentials.

Suspicious Privileged Group Membership Change via net.exe (via process_creation)

This rule detects net.exe adding an account to a privileged local group such as Administrators or Remote Desktop Users. Medusa operators manipulate group membership to escalate privileges and retain access, so an account addition to a sensitive group during an intrusion is a persistence and privilege-escalation signal.

Enable WDigest using PowerShell

Rule to detect registry modifications to enable WDigest using powershell over the commandline.

Suspicious SSH Reverse Tunnel Over Port 443 via ssh.exe by UNC1549

This rule detects the native Windows ssh.exe client establishing a reverse tunnel with the -R flag over port 443 as observed in UNC1549 operations. Attackers tunnel internal services outbound over an HTTPS port to blend with normal web traffic and bypass egress controls.

Malicious PowerShell Download Cradle via Invoke-WebRequest and IEX

This rule detects PowerShell run with an execution policy bypass that downloads content and pipes it directly to Invoke-Expression. Stealerium uses powershell -eP Bypass with Invoke-WebRequest to pull an atom feed from a blogspot dead drop and execute it in memory with IEX. This download-and-execute cradle is a widely abused fileless staging technique.

Suspicious Scheduled Task Masquerading as Edge Update Telemetry (via process_creation)

This rule detects creation of a scheduled task using the distinctive name CoreEdgeUpdateServicesTelemetry FallBack. The FLUX#CONSOLE campaign registered this task to run its sideloading Dism binary every five minutes for persistence.

Suspicious Execution From WinRAR Temporary Extraction Path via Command Line (via process_creation)

This rule detects process execution referencing the WinRAR temporary extraction directory pattern Rar$ under the local Temp folder, which the CVE-2023-38831 exploit uses to run its planted payload. It is associated with attacks abusing the WinRAR archive spoofing zero-day reported by Uptycs. Because scripts and binaries executed straight from this transient extraction path are characteristic of the exploit, this pattern indicates likely code execution from a crafted archive.

Malicious PlugX Sideload via Acrobat.dll

This rule detects the signed Acrobat.exe loading an Acrobat.dll from a location outside Program Files. This behavior matches CL-STA-0048 where operators sideloaded a malicious Acrobat.dll implementing PlugX which then injected into svchost.exe. A trusted Adobe binary loading its companion DLL from a non-standard path is a sideloading indicator of espionage malware.

Suspicious Silent MSI Installation from AppData Spawned by PowerShell (via process_creation)

This rule detects msiexec.exe spawned by PowerShell to silently install an MSI staged in the user AppData directory, the second step of the Bumblebee loader chain where PowerShell writes y.msi to AppData and installs it with no user interaction. Legitimate software rarely installs MSIs from AppData under a PowerShell parent, so this parent-child and path combination surfaces the loader stage.

Suspicious node.exe Inline Script Execution via -e

This rule detects node.exe executing an inline script through the -e flag, the stager execution method in the DEV#POPPER GitHub-lure infection. Victims who cloned the weaponized repository ran a hidden script that used node -e to bootstrap the RAT. While developers occasionally use node -e, inline Node execution from a cloned project should be reviewed for malicious staging.