Sigma detection rules, expert-reviewed

Suspicious NW.js Runtime Execution from AppData Roaming by Charcoal Stork (via process_creation)

This rule detects the NW.js runtime nw.exe executing from the AppData Roaming directory, the Charcoal Stork behavior Red Canary documented for delivering Yellow Cockatoo and related payloads. Legitimate NW.js applications install under Program Files, so execution from a user roaming profile indicates a bundled malicious NW.js package.

Suspicious PowerShell Spawned by mshta.exe in FakeSG Chain (via process_creation)

This rule detects mshta.exe spawning powershell.exe, the FakeSG execution chain Red Canary highlighted where a malicious HTA launches PowerShell to continue the infection. The HTML Application host launching PowerShell is uncommon in legitimate activity, so this parent-child pairing indicates script-based execution through a living-off-the-land binary.

Suspicious Scheduled Task Creation Referencing dllFake Batch Scripts (via process_creation)

This rule detects schtasks.exe creating a scheduled task whose command line references the dllCrt32 or sysCrt32 batch scripts that Red Canary observed dllFake using to persist its stealer for automatic execution. The batch-driven task registration is a distinctive persistence step for this family, so these referenced script names in a task creation indicate implant persistence.

Malicious dllFake Stealer Execution from WindowsApps Directory (via process_creation)

This rule detects execution of dllCrt32.exe or sysCrt32.exe from the LOCALAPPDATA Microsoft WindowsApps directory, the dropped stealer binaries Red Canary attributed to dllFake trojanized installers that share code with SecondEye. These named executables in the WindowsApps path are not legitimate Store aliases, so their execution indicates a data-stealing implant staged for credential and clipboard theft.

Suspicious Encoded PowerShell Using Base64 Stream Decompression Routines (via process_creation)

This rule detects PowerShell command lines combining base64 decoding with stream decompression routines that Red Canary tied to obfuscated loaders staging Cobalt Strike during a hospital ransomware attack. Adversaries chain FromBase64String with stream decompression to unpack in-memory payloads, so these combined tokens reveal obfuscated execution that plain string matching would miss.

Malicious IIS Worker Process Spawning Command Shell for Webshell Reconnaissance (via process_creation)

This rule detects the IIS worker process w3wp.exe spawning cmd.exe, the webshell execution behavior Red Canary observed during a hospital ransomware intrusion where the shell ran net.exe reconnaissance before lateral movement and Cobalt Strike deployment. A web server worker launching an interactive command shell is a strong sign of a deployed webshell running operating-system commands, making early detection critical for catching post-exploitation before ransomware.

Malicious Microsoft Defender Real-Time Monitoring Disabled via Set-MpPreference (via process_creation)

This rule detects PowerShell disabling Microsoft Defender real-time monitoring through the Set-MpPreference DisableRealTimeMonitoring parameter, a defense-evasion behavior Red Canary observed in a hospital ransomware intrusion where wmiprvse.exe spawned PowerShell ahead of Cobalt Strike deployment. Adversaries use this to blind endpoint protection before payload execution and lateral movement, making early detection critical for stopping ransomware before encryption.

Suspicious PowerShell Spawned by Windows Script Host during Scarlet Goldfinch Infection (via process_creation)

This rule detects wscript.exe spawning powershell.exe, the process chain Red Canary observed when Scarlet Goldfinch first-stage JScript from an updateinstaller.zip lure launched an obfuscated PowerShell command to continue the infection toward NetSupport Manager. Script hosts rarely launch PowerShell during normal use, so this parent-child relationship is a reliable indicator of script-driven execution.

Suspicious Windows Script Host Execution of JavaScript from Temporary Archive Extraction Folder (via process_creation)

This rule detects wscript.exe executing a .js payload from a temporary archive-extraction directory under the user AppData Local Temp path, the delivery behavior Red Canary tied to SocGholish, Gootloader, and Scarlet Goldfinch fake-update lures. Victims download an archive such as Update - 35129.zip, extract it, and double-click a script like Update_123.0.6312.111.js which Windows Script Host runs, so this pattern surfaces script-based initial access before the follow-on payload executes.

Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)

This rule detects the SQL Server process spawning cmd.exe or powershell.exe, the xp_cmdshell execution that follows SQL injection against FortiClientEMS in the CVE-2023-48788 exploitation Red Canary reported. A database engine launching a command interpreter is a classic sign of xp_cmdshell abuse turning a SQL flaw into operating system code execution.

Suspicious Rundll32 Loading DLL From Public or ProgramData Path via Process Creation (via process_creation)

This rule detects rundll32.exe loading a DLL from a world-writable staging path such as Users Public, ProgramData, or the user temp directory, a LOLBin abuse pattern Red Canary describes for executing attacker-dropped code. System DLLs load from System32, so rundll32 sourcing a library from these locations strongly suggests execution of a malicious module.

Malicious LSASS Credential Dump via Rundll32 Comsvcs MiniDump via Process Creation (via process_creation)

This rule detects rundll32.exe invoking the comsvcs.dll MiniDump export to dump process memory, the LOLBin credential-theft technique Red Canary highlights for extracting secrets from LSASS. This is a well-known method to harvest credentials while blending in with a signed system binary, and its use is almost always malicious.

Suspicious NetSupport Manager Client Executing From ProgramData via Process Creation (via process_creation)

This rule detects the NetSupport Manager client (client32.exe) running from the ProgramData directory, the remote access tool abused as a RAT in campaigns delivering malware through MSIX installers per Red Canary. Legitimate NetSupport deployments live under Program Files, so execution from ProgramData indicates an attacker-installed remote access foothold.

Suspicious Active Directory Export via Csvde via Process Creation (via process_creation)

This rule detects csvde.exe exporting directory data to a file, a bulk LDAP account-enumeration technique observed following MSIX malware delivery by Red Canary. Adversaries use csvde to dump the entire directory for reconnaissance and targeting, so its use outside routine administration warrants review.

Suspicious Windows Defender Exclusion Added via PowerShell via Process Creation (via process_creation)

This rule detects PowerShell adding Windows Defender exclusions or disabling real-time monitoring via Add-MpPreference or Set-MpPreference, a defense-evasion step used by malware delivered through MSIX installers per Red Canary. Attackers carve out exclusion paths so their staged payloads run unscanned, making unexpected exclusion changes a strong impairment-of-defenses signal.