Sigma detection rules, expert-reviewed

Suspicious Hidden Scheduled Task via TaskCache Security Descriptor Manipulation

This rule detects modification of the SD security-descriptor value under the scheduled-task TaskCache Tree registry hive, the technique used by the Tarrask malware attributed to Hafnium to hide a task so it does not appear in schtasks query output. Removing or altering the SD value conceals the persistence mechanism from defenders. This registry activity has no legitimate purpose and indicates deliberate task hiding.

Suspicious Recurring Scheduled Task Named WindowsHelper via schtasks

This rule detects creation of a frequently recurring scheduled task named WindowsHelper, used by Armored Likho to run its BusySnake loader chain every few minutes. The masquerading task name and short interval reflect the actor persistence configuration. A benign sounding high-frequency task from an untrusted source indicates persistence.

Suspicious GhostLocker Watchdog Process Execution (via process_creation)

This rule detects execution of wuachost.exe, a watchdog process spawned by GhostLocker ransomware whose name masquerades as the legitimate Windows Update client wuauclt. The watchdog restarts the ransomware if terminated, making it a strong indicator of an active GhostSec infection.

Suspicious Mint Sandstorm MediaPl DLL Loaded from Media Player AppData Path (via image_load)

This rule detects loading of MediaPl.dll from the user AppData Local Microsoft Media Player directory. Mint Sandstorm dropped this malicious DLL into a Media Player folder to masquerade as legitimate media components while executing implant code.

LegionLoader DLL Sideloading via VMware mksSandbox Loading Fake libcrypto (via image_load)

This rule detects the legitimate VMware-signed mksSandbox.exe loading a libcrypto-1_1-x64.dll from outside the trusted VMware installation path, the DLL side-loading behavior used to stage LegionLoader after a fake CAPTCHA and Cloudflare Turnstile lure. Adversaries abuse a signed binary to execute a malicious OpenSSL impersonating DLL under a trusted process, making early detection critical for surfacing loader activity before browser credential and wallet theft.

Malicious Windows Defender Exclusion Added for PowerShell and conhost

This rule detects Add-MpPreference being used to register Windows Defender process exclusions for powershell or conhost. The ClipBanker campaign distributed through a trojanized Proxifier excluded its own living-off-the-land binaries from Defender scanning to run undetected as reported by Kaspersky. Adding process exclusions for these interpreters is a strong defense-evasion signal that precedes payload execution.

Malicious Service Creation - Command (via process_creation)

This rule detects create a service for persistence.

Suspicious Outbound Network Connection from Windows Dialer Process

This rule detects the legitimate Windows dialer.exe process in System32 initiating outbound network connections which is anomalous because the tool is rarely executed and does not normally beacon. In the copyright infringement infostealer campaign the loader injected shellcode into system32 dialer.exe to proxy command and control traffic making dialer network activity a strong compromise signal.

NjRAT Fileless Keylogger Storage via Registry Value (via registry_set)

This rule detects registry values containing NjRAT keystroke markers such as bracketed ENTER, TAP, or Back tokens, the fileless storage NjRAT uses to buffer captured keystrokes in the registry. Adversaries leverage registry-resident keylog data to avoid touching disk while collecting credentials, making these distinctive value contents a strong host artifact for detection.

PowerShell Spawned by Headless Conhost (via process_creation)

This rule detects powershell.exe launched as a child of conhost.exe running with the --headless argument, a hidden-console execution pattern used in the PureRAT infection chain to run a covert download command. Adversaries leverage headless conhost to hide interactive console activity from the user, making this uncommon parent-child pairing a useful signal of scripted payload staging.

Malicious GHOSTPULSE DLL Side-Loading of libcurl via VBoxSVC

This rule detects the VirtualBox VBoxSVC executable loading a libcurl DLL from outside its normal installation directory which is the side-loading path GHOSTPULSE abuses to execute its stager. The rule excludes loads from genuine VirtualBox directories to focus on the malicious wrong context placement.

Suspicious ctfmon.exe Execution With Command-Line Arguments via PikaBot Injection

This rule detects ctfmon.exe launched with command-line parameters, which is anomalous because the legitimate Text Services process normally runs without arguments. PikaBot spawns a suspended ctfmon.exe with a numeric switch such as -p 1234 to host injected shellcode through thread hijacking. Catching this deviation exposes early stage process injection used to evade endpoint controls.

Suspicious SQL Server Payload Staging via bcp queryout (via process_creation)

This rule detects the SQL Server bulk copy program launched from the sqlservr process to export binary data from a database table to a file using the queryout parameter. The STAC6451 cluster abused exposed SQL Server instances and xp_cmdshell to stage Mimic ransomware and supporting tools on disk through bcp queryout.

Suspicious Script Execution from Public User Folder Staging Directory

This rule detects wscript, cscript, or PowerShell executing a .js or .ps1 file staged under C:\Users\Public, a staging location used in a Huntress-analyzed malspam-to-loader chain to hide script components. The Public folder is world-writable and rarely a legitimate home for scripts. Interpreter execution of scripts from this path is a strong indicator of loader staging activity.

Malicious Hidden Logon Scheduled Task RuntimeOptimizeService via TCLBANKER

This rule detects creation of a scheduled task named RuntimeOptimizeService with a logon trigger and hidden attribute as used by the TCLBANKER banking trojan for persistence in Elastic research. The service like task name combined with a hidden logon trigger indicates a masqueraded persistence mechanism for the implant.