Sigma detection rules, expert-reviewed

Malicious Event Log Service Disabled via sc.exe (Soco404 Cryptomining)

This rule detects sc.exe stopping the Windows event log service, an anti forensic action used by the Soco404 cryptomining campaign to blind defenders. It is important because stopping event logging removes the primary source of endpoint telemetry during active intrusion.

Suspicious SharpDPAPI Machine Masterkey Extraction (via process_creation)

This rule detects command lines invoking SharpDPAPI machine masterkey or machine credential functions, the tooling used to recover machine-scoped DPAPI keys and ultimately active ADFS signing keys in the observed intrusion. Adversaries extract these keys to decrypt protected secrets and forge SAML tokens for cloud access, so SharpDPAPI machine operations are a high-fidelity credential access indicator.

Suspicious sLoad Payload Download via BITSAdmin LOLBin Transfer (via process_creation)

This rule detects bitsadmin.exe transferring a file from a remote HTTP location, the living-off-the-land download technique used by the sLoad downloader to stage banking-malware payloads in the drIBAN fraud operation. Adversaries abuse the Background Intelligent Transfer Service through bitsadmin to retrieve second-stage code under a trusted Windows utility while evading download controls, making early detection critical for catching delivery before Ramnit is deployed.

Malicious AMSI Bypass via PowerShell Reflection (via ps_script)

This rule detects PowerShell attempting to disable the Antimalware Scan Interface by patching AmsiUtils fields such as amsiInitFailed. The ClearFake variant runs an AMSI bypass before decrypting its AES payload so in-memory scanning is suppressed. Manipulating AMSI internals from a script is a strong signal of malicious execution.

Suspicious BunnyLoader Keylog Capture File in AppData Temp (via file_event)

This rule detects creation of files matching the ADE_ prefix text file pattern in the local AppData Temp directory, the naming scheme BunnyLoader uses to stage captured keystrokes before exfiltration. Writing keylog output under this predictable path reflects the loader collection module in operation, marking active credential and data theft.

Malicious Chrome Extension Sideload via --load-extension from User-Writable Path (via process_creation)

This rule detects a Chromium-based browser launched with the --load-extension flag pointing to a user-writable AppData or Public directory. The Ducktail campaign drops a malicious extension into the Chrome User Data folder and injects it through a LNK shortcut using --load-extension to steal session cookies and hijack business accounts, so this command line indicates unauthorized extension loading.

ResolverRAT Loader DLL Sideloading via hpreader (via image_load)

This rule detects the legitimate signed hpreader.exe loading a DLL from a user-writable directory, the DLL sideloading behavior used by the ResolverRAT loader to reflectively execute its .NET payload in memory under a trusted process. Adversaries leverage sideloading against a signed binary to run malicious code with a benign parent, making early detection critical for surfacing the loader before registry persistence and encrypted C2 are established.

Malicious Network Login Performed to Multiple Targets (via security)

This rule detects would attempt to enumerate hosts resources and execute a payload with a compromised account. Vulnerability scanners, enumeration software or tool like SharepHound/CrackMapexec may generate such behavior.

Data Exfiltration to WebDAV Share via curl Upload

This rule detects curl uploading a file to a remote WebDAV endpoint using the upload flag. RedCurl uses this method to stage stolen data and logs to attacker controlled Nextcloud style cloud storage.

Suspicious Network Download Spawned by Node.js During Package Install

This rule detects the Node.js process spawning a download utility or command interpreter during an npm package install which the Stressed Pungsan campaign abuses through a malicious preinstall hook to fetch a second stage payload onto developer machines.

Suspicious Remote UAC Restriction Disabled via LocalAccountTokenFilterPolicy (via process_creation)

This rule detects a reg add command setting LocalAccountTokenFilterPolicy to 1, which disables remote UAC token filtering and grants full administrative access over the network to local accounts. Akira ransomware operators set this value to enable lateral movement with local administrator credentials.

Malicious COM Hijack of PSFactoryBuffer InprocServer32

This rule detects modification of the InprocServer32 value under the CLSID {1299CF18-C4F5-4B6A-BB0F-2299F0398E27} PSFactoryBuffer key in the per-user registry hive, a COM hijack used by RomCom for persistence and execution after WinRAR exploitation. Redirecting this COM server class to an attacker DLL causes malicious code to load when the COM object is instantiated.

Malicious NTLM Downgrade Attack - Reg via SYSMON (via registry_set)

This rule detects modifies the registry configuration in order to enable or downgrade NTLM protocol version, to later on perform relay attacks.

Suspicious Replacement of termsrv DLL to Enable Concurrent RDP via file_event

This rule detects a write to the Terminal Services termsrv.dll in System32, the technique OkoBot uses to patch the RDP service and allow multiple concurrent sessions. The genuine termsrv.dll changes only through Windows servicing. An out-of-band modification indicates tampering to enable stealthy remote access.

Malicious Cicada3301 Ransomware Locker Execution via Command Line Key (via process_creation)

This rule detects execution of the Cicada3301 ransomware locker binary with its command-line decryption key argument, which the Repellent Scorpius affiliate launched remotely through PsExec to encrypt hosts. Passing the encryption key on the command line is characteristic of this Rust-based locker and indicates active ransomware deployment.