Sigma detection rules, expert-reviewed

Malicious Scheduled Task Masquerading as Google Updater via Schtasks

This rule detects creation of a scheduled task named after the Google updater with the highest run level triggered on user logon. The CL-STA-1062 actor deploying the TinyRCT backdoor against Southeast Asian governments registers a task called GoogleUpdaterTaskSystem to blend with legitimate Chrome update tasks. Detecting this masqueraded persistence surfaces an elevated logon-triggered foothold hiding behind a trusted name.

Suspicious Executable Running From Fake Chrome User Profile Directory

This rule detects a process executing from a user profile directory named Chrome such as C\Users\Chrome. QwixxRAT copies itself as a hidden rat.exe into this fabricated profile path to blend with the Chrome browser and evade casual inspection. A process running from a user folder named after a browser is an uncommon masquerading pattern that warrants review.

Malicious Recovery Disablement via bcdedit

This rule detects bcdedit disabling Windows recovery, used by the hacktivist ransomware operators to block system restoration before encryption. Turning off automatic recovery removes a victim safety net. Combined with shadow deletion this is a strong pre-encryption impact signal.

Malicious Node.js Execution of test.js from .vscode Folder in Lazarus Lure (via process_creation)

This rule detects the Node.js runtime running a script named test.js located inside a .vscode project folder, the exact loader pattern used by the Lazarus BeaverTail campaign after a victim runs npm install. The hidden .vscode directory disguises the malicious bootstrap among normal editor files. This execution kicks off the download of the follow-on Python infostealer.

Suspicious Regsvr32 Loading DLL from Remote WebDAV Location via Strela Stealer (via process_creation)

This rule detects regsvr32 executing a DLL from a remote WebDAV or HTTP location without writing it to disk, the fileless second stage delivery technique used by Strela Stealer.

Suspicious Lateral Movement via Invoke-WMIExec or Invoke-SMBExec (via ps_script)

This rule detects PowerShell use of the Invoke-WMIExec or Invoke-SMBExec pass-the-hash tooling observed alongside the ThrottleStop AV-killer intrusion. These functions authenticate to remote hosts with an NTLM hash and run commands such as local account creation without a plaintext password. Their presence indicates hands-on lateral movement using stolen credential material.

Malicious Update Orchestrator Service Reconfiguration for Privilege Escalation

This rule detects reconfiguration of the Update Orchestrator Service binary path via sc.exe, the abuse chain behind CVE-2019-1322 that runs an attacker command as SYSTEM. Repointing UsoSvc to an arbitrary command lets a low-privileged user escalate to SYSTEM when the service restarts.

Suspicious Command Prompt Spawned by Winlogon

This rule detects winlogon.exe spawning cmd.exe, an anomalous parent-child relationship used by Backdoor.Stupig to run a SYSTEM command prompt on the secure logon desktop. Winlogon rarely launches an interactive shell.

Suspicious DNS Zone Enumeration via dnscmd

This rule detects dnscmd.exe enumerating or printing DNS zones, a discovery technique used by espionage actors against Asian governments to map internal hosts and infrastructure from a compromised DNS server.

Possible UAC Bypass via ms-settings Shell Open Command Hijack (via registry_set)

This rule detects modification of the ms-settings shell open command registry value under HKCU which is the fodhelper.exe auto-elevation UAC bypass. Lunar Spider used this technique to elevate privileges without a consent prompt. The registry hijack redirects a trusted auto-elevating binary to run an attacker-controlled command with high integrity.

OpenSSH Server Firewall Configuration on Windows - PowerShell (via powershell)

This rule detects configure the Windows firewall to allow incoming connections to perform stealthy lateral movement.

Malicious BlackByte Ransomware Host Marker via Control Panel Registry

This rule detects the international control panel values s1159 and s2359 being set to BLACKBYTE, a distinctive host-marking artifact created by BlackByte ransomware. BlackByte writes this value to tag infected systems.

Malicious Event Log Service Disabled via sc.exe (Soco404 Cryptomining)

This rule detects sc.exe stopping the Windows event log service, an anti forensic action used by the Soco404 cryptomining campaign to blind defenders. It is important because stopping event logging removes the primary source of endpoint telemetry during active intrusion.

Suspicious SharpDPAPI Machine Masterkey Extraction (via process_creation)

This rule detects command lines invoking SharpDPAPI machine masterkey or machine credential functions, the tooling used to recover machine-scoped DPAPI keys and ultimately active ADFS signing keys in the observed intrusion. Adversaries extract these keys to decrypt protected secrets and forge SAML tokens for cloud access, so SharpDPAPI machine operations are a high-fidelity credential access indicator.

Suspicious sLoad Payload Download via BITSAdmin LOLBin Transfer (via process_creation)

This rule detects bitsadmin.exe transferring a file from a remote HTTP location, the living-off-the-land download technique used by the sLoad downloader to stage banking-malware payloads in the drIBAN fraud operation. Adversaries abuse the Background Intelligent Transfer Service through bitsadmin to retrieve second-stage code under a trusted Windows utility while evading download controls, making early detection critical for catching delivery before Ramnit is deployed.