Sigma detection rules, expert-reviewed

Malicious PlugX Sideload via Acrobat.dll

This rule detects the signed Acrobat.exe loading an Acrobat.dll from a location outside Program Files. This behavior matches CL-STA-0048 where operators sideloaded a malicious Acrobat.dll implementing PlugX which then injected into svchost.exe. A trusted Adobe binary loading its companion DLL from a non-standard path is a sideloading indicator of espionage malware.

Suspicious Silent MSI Installation from AppData Spawned by PowerShell (via process_creation)

This rule detects msiexec.exe spawned by PowerShell to silently install an MSI staged in the user AppData directory, the second step of the Bumblebee loader chain where PowerShell writes y.msi to AppData and installs it with no user interaction. Legitimate software rarely installs MSIs from AppData under a PowerShell parent, so this parent-child and path combination surfaces the loader stage.

Suspicious node.exe Inline Script Execution via -e

This rule detects node.exe executing an inline script through the -e flag, the stager execution method in the DEV#POPPER GitHub-lure infection. Victims who cloned the weaponized repository ran a hidden script that used node -e to bootstrap the RAT. While developers occasionally use node -e, inline Node execution from a cloned project should be reviewed for malicious staging.

Suspicious AppLaunch.exe Execution as Process Hollowing Target

This rule detects the .NET ClickOnce host AppLaunch.exe running with a parent other than a legitimate development tool. Titan Stealer hollows AppLaunch.exe and injects its XOR-decoded Golang stealer into the trusted signed binary to evade detection. AppLaunch.exe spawned outside of Visual Studio or build tooling is a common injection and masquerading target.

Driverquery Lookup

Detects use of driverquery to look up the installed and configured drivers as part of host discovery

Suspicious CoffeeLoader Execution via Armoury Crate DLL Side-Loading (via process_creation)

This rule detects rundll32 executing the ArmouryAIOSDK.dll with the Post_EntrypointReturn export that CoffeeLoader uses to run its stager through DLL side-loading of ASUS Armoury Crate. Legitimate Armoury Crate components are not invoked this way from user writable paths.

Malicious Metasploit PsExec Named Pipe Command Execution

This rule detects a command shell echoing data into a local named pipe, the service-based execution pattern produced by the Metasploit PsExec module when it installs a service that writes command output back through a pipe. This is used for remote code execution and lateral movement from a compromised host. Legitimate software does not echo into a raw named pipe from cmd.exe in this way.

Malicious WannaCry Run Key Persistence to tasksche via registry_set

This rule detects the creation of a Run key registry value pointing to the WannaCry payload tasksche.exe, establishing persistence at user logon. The malware writes this value under the CurrentVersion Run key to survive reboots. Presence of a tasksche.exe reference in an autostart location is a high-confidence indicator of WannaCry infection.

Suspicious File Created in Startup Folder by WinRAR via CVE-2025-8088

This rule detects WinRAR or its extraction binaries writing a file into a user Startup folder which indicates exploitation of the CVE-2025-8088 alternate data stream path traversal flaw. Attackers drop LNK HTA or BAT payloads into Startup to gain logon persistence when a user opens a crafted archive.

Suspicious Service Host Spawning Command Interpreter in Session 0 via WFP Kernel Backdoor (via process_creation)

This rule detects svchost.exe spawning command interpreters such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe, the command-execution pattern produced by the wskmon.sys WFP kernel backdoor when it injects operator commands into a service host in Session 0. Adversaries leverage this parent-child relationship to run shells under a trusted system process, making detection valuable for catching kernel-driven command execution.

Malicious ESXi Secure Boot Bypass via execInstalledOnly Disable

This rule detects an esxcli command disabling the execInstalledOnly kernel setting on an ESXi host, matching UNC3944 tampering that allows unsigned binaries to run so the actor can deploy ransomware and offline tooling. Turning off this protection removes a core defense against untrusted code on the hypervisor.

Malicious Payload Download and Execution via certutil urlcache (via process_creation)

This rule detects certutil being used with the urlcache option to download a remote executable to disk, a living off the land technique used by a ransomware actor after exploiting an unsupported ColdFusion server to fetch and launch beacon payloads into the Windows temp directory. Legitimate use of certutil to download arbitrary executables over HTTP is rare.

Suspicious Kerberos Password Account Reset to Issue Potential Golden Ticket (via security)

This rule detects scenarios where a suspicious password reset of the Krbtgt account is performed by attacker to issue a potential Golden ticket.

Suspicious Scheduled Task Masquerading as Realtek Audio Service (via process_creation)

This rule detects the AsyncRAT campaign registering scheduled tasks that impersonate Realtek audio maintenance to launch its batch and AutoHotkey loaders. The tasks use names such as CheckRealtekAudioVersion and execute dropped RealtekAudioService64 components. Creation of these named tasks indicates persistence by the loader.

Suspicious Remote Desktop Enablement via Registry fDenyTSConnections and Firewall Rule (via process_creation)

This rule detects Remote Desktop being switched on by setting fDenyTSConnections to zero or by opening the RDP firewall group through netsh advfirewall, the lateral-access preparation in the ELPACO-team intrusion before RDP movement to backup and file servers. Adversaries enable inbound RDP to pivot with stolen credentials, so these host-hardening reversals outside change control warrant investigation and can be filtered on approved administration hosts.