Sigma detection rules, expert-reviewed

Suspicious TALONITE Certutil LOLBIN Decode and Download Abuse (via process_creation)

This rule detects certutil.exe invoked with decode, URL cache, or verifyctl arguments used to deobfuscate or download payloads. TALONITE abuses certutil as a living-off-the-land binary to decode staged content and retrieve additional tooling during intrusions. Certutil used for file decoding or remote fetch outside certificate management is a common defense-evasion and delivery technique.

Suspicious Disabling of Windows Firewall via Netsh (via process_creation)

This rule detects netsh being used to turn the Windows firewall off across profiles, a defense-impairment step attackers take to unblock command-and-control or lateral-movement traffic. Disabling the host firewall is a defense-evasion technique tracked in the Red Canary Threat Detection Report. Detecting these commands surfaces an attacker lowering host defenses ahead of further activity.

Malicious TALONITE FlowCloud Renamed HTML Help Workshop Binary (via process_creation)

This rule detects a process whose original file name is the legitimate HTML Help Workshop binary hhw.exe but which runs under a different image name. TALONITE FlowCloud executes a renamed copy of hhw.exe to store harvested host data in database files while evading name-based detection. A mismatch between the embedded original name and the on-disk name is a strong masquerading signal.

Malicious PowerShell IEX DownloadString One-Liner

This rule detects PowerShell using Invoke-Expression together with a WebClient DownloadString call to fetch and run remote code in memory. This one-liner is delivered through the Win+R fake CAPTCHA lure used to distribute Lumma Stealer. Catching the fetch-and-execute pattern flags fileless staging before the stealer touches disk.

Malicious Mimikatz LSASS Credential Dumping via Command Line

This rule detects Mimikatz command modules such as sekurlsa logonpasswords or lsadump on the process command line, the credential harvesting method TrickBot uses through its Mimikatz-based module to dump LSASS memory. These module strings are distinctive to Mimikatz regardless of the binary name. Their presence indicates active credential theft supporting lateral movement.

Masquerading Noodlophile Payload Execution via Video File Double Extension (via process_creation)

This rule detects execution of an image named with a video double extension such as .mp4.exe, the masquerading technique used by the Noodlophile stealer campaign delivered through fake AI video-generation platforms. Adversaries leverage a video-looking filename so users who expect a rendered clip instead launch the wrapper binary, making early detection critical for catching the intrusion at first execution before the CapCut loader and XWorm injection proceed.

Suspicious Windows Event Log Clearing via wevtutil

This rule detects clearing of Windows event logs using wevtutil cl. Ransomware operators covered in this report chain wevtutil cl commands against the Security, System and Application logs to erase forensic evidence around encryption. Bulk event-log clearing is a strong indicator of anti-forensic activity.

ValleyRat Beacon Sideloading via NtHandleCallback Loading log.dll (via image_load)

This rule detects the NtHandleCallback.exe process loading log.dll from its working directory, the DLL sideloading pair used to launch the ValleyRat beacon in the Silver Fox campaign. Adversaries leverage a masqueraded executable and a co-located malicious DLL to run the beacon under a benign-looking process, making detection valuable for surfacing command-and-control staging.

Malicious Microsoft Defender Service Components Status Disabled - Registry via Sysmon (via process_creation)

This rule detects disable Defender security features by modifying service configuration in registry.

Masquerading Scheduled Task Masquerading as WindowsUpdate with One-Minute Interval (via process_creation)

This rule detects creation of a scheduled task named WindowsUpdate configured to run every minute, a persistence behavior used by the Anivia loader for rapid respawn of OctoRAT. Adversaries leverage a benign-sounding task name and an aggressive minute interval to keep the implant resident on the host.

Suspicious Parallax RAT Startup Folder Executable Persistence via File System (via file_event)

This rule detects creation of an executable named milk.exe in the Windows Startup folder, the persistence artifact used by the Parallax RAT. It is associated with a campaign targeting cryptocurrency entities with Parallax RAT as reported by Uptycs. Dropping an executable directly into Startup guarantees relaunch at logon, so this artifact indicates established persistence by the RAT.

Suspicious Scheduled Task Launching VBScript From ProgramData (via process_creation)

This rule detects schtasks creating a minute-interval task that runs a VBScript from ProgramData. The AgentTesla loader registers such a task to repeatedly re-launch its VBS staging script.

Malicious PsExec Service Installation via PSEXESVC

This rule detects installation of the PSEXESVC service on a target host which is created when Sysinternals PsExec is used for remote command execution as described in the WithSecure lateral movement lab. Attackers routinely abuse PsExec for hands on keyboard lateral movement so a PSEXESVC service install on a system that does not routinely receive one is a strong lateral movement indicator.

Suspicious VBScript Dropped to Startup Folder (via file_event)

This rule detects Hive0051 GammaInstall and GammaSteel persistence where a randomly named VBScript launcher is written to the user Startup folder so it executes at every logon. Writing a vbscript file directly under the Start Menu Programs Startup path is uncommon for legitimate software. The behavior provides logon persistence for the loader chain.

Suspicious Registry Modification Disabling RestrictedAdmin Mode (via process_creation)

This rule detects a reg add command disabling RestrictedAdmin mode under the LSA key. The SLOW#TEMPEST campaign disabled this protection to enable pass-the-hash remote desktop logons during lateral movement.