Sigma detection rules, expert-reviewed

Suspicious Acrobat.exe Loading Co-located DLL from ProgramData

This rule detects a signed Acrobat.exe located under ProgramData side-loading a co-located Acrobat.dll. Adversaries plant an unsigned malicious DLL beside a legitimate signed executable in ProgramData so it is loaded under a trusted process. This masquerade plus wrong-path context is a strong indicator of DLL side-loading.

Malicious RansomHub Ransom Note Creation via README Random Suffix Pattern (via file_event)

This rule detects creation of RansomHub ransom note files following the README_ prefix with a random six-character suffix documented by Group-IB. Adversaries drop these notes across encrypted directories to signal impact and deliver extortion demands, so their appearance indicates active ransomware encryption.

Suspicious DarkMe Cabinet.ocx Payload Dropped in AppData WinSoft Directory

This rule detects the DarkMe payload Cabinet.ocx being written to the APPDATA WinSoft directory during WinRAR CVE-2023-38831 exploitation. The dropped OCX component is registered and loaded to establish persistence. Its distinctive path indicates a compromised host in this campaign.

Malicious VietCredCare Credential Exfiltration Staging Files

This rule detects staging files created by the VietCredCare stealer using its distinctive COMPUTERNAME--COOKIES-.txt and --PASS-.txt naming pattern. These files hold stolen browser cookies and passwords prior to exfiltration to a Telegram channel. Their presence indicates active credential harvesting on the host.

Malicious Vulnerable Driver Load via TfSysMon.sys BYOVD (via driver_load)

This rule detects loading of the TfSysMon.sys vulnerable driver abused by the RansomHub Killer tool to disable security products through bring-your-own-vulnerable-driver as reported by Group-IB. Adversaries load this signed but vulnerable driver to terminate AV and EDR processes from kernel space, making its load a strong defense-evasion indicator.

Suspicious PowerShell Reverse-HTTP Shellcode Download via CVE-2024-4577 Exploitation

This rule detects PowerShell processes that download a payload.ps1 stager delivering reverse-HTTP shellcode from an external command-and-control host. The behavior follows exploitation of the PHP-CGI argument injection vulnerability CVE-2024-4577 on Windows servers seen in a broad mass-exploitation campaign. Attackers use it to gain remote code execution and deploy Cobalt Strike beacons for persistent access.

Suspicious Run Key Persistence Executing regsvr32

This rule detects a Run registry autostart value whose data invokes regsvr32, a persistence method observed in the AppleSeed triple-combo campaign that added a TripServiceUpdate entry launching regsvr32 against a malicious DLL. It captures the establishment of boot persistence combined with signed-binary proxy execution. Detecting this is important because legitimate autostart entries seldom call regsvr32 with install switches to load a DLL at logon.

Suspicious Masquerading Scheduled Task Impersonating Microsoft Edge Update

This rule detects schtasks creating a scheduled task named to impersonate a Microsoft Edge update while configured to run PowerShell with an execution-policy bypass, a persistence and masquerading technique observed in a nation-state APT campaign that registered an hourly MicrosoftEdgeUpdateVersion task to launch XenoRAT. It captures a malicious task disguised under a trusted update name. Detecting this is important because a scheduled task masquerading as a browser updater yet invoking PowerShell bypass is a clear sign of stealthy persistence.

Suspicious Obfuscated Hidden PowerShell with Encoded Command

This rule detects PowerShell launched with hidden window, no-profile, and no-logo flags together with an encoded or Base64 command argument, an execution pattern observed in a nation-state APT campaign delivering XenoRAT through LNK files that decoded a randomly named script. It captures concealed and encoded script execution used to run in-memory payloads. Detecting this is important because the combination of hidden execution and encoded commands is a strong indicator of obfuscated malicious PowerShell.

Suspicious File Concatenation via copy Binary Mode

This rule detects the command shell copy utility used in binary mode to concatenate multiple files into one, a payload-assembly technique observed in a Lumma infostealer campaign that combined an AutoIt interpreter with a script to reconstruct an executable. It captures the joining of staged fragments into a runnable payload on disk. Detecting this is important because copy /b concatenation of separate files is an established malware building technique that reassembles payloads to evade detection.

Suspicious CAB Extraction via extrac32 LOLBin

This rule detects extrac32 being used to extract cabinet archive contents, a living-off-the-land technique observed in a Lumma infostealer campaign that used extrac32 to unpack a CAB file masquerading as a document during payload staging. It captures abuse of a signed Windows utility to unpack malicious archives. Detecting this is important because extrac32 is rarely used interactively and its appearance in an attack chain often indicates covert payload deployment.

Suspicious Hidden PowerShell Launched by Batch Script

This rule detects a batch script spawning PowerShell with hidden and minimized window options, an execution pattern observed in a K-Messenger abuse campaign delivering RoKRAT where a lexus.bat file invoked PowerShell with -windowstyle hidden and -min to run fileless payload stages. It captures concealed script execution originating from a batch launcher. Detecting this is important because hidden PowerShell descending from a batch file is a frequent fileless malware loading technique.

Suspicious Command Shell Executing Batch Script from LNK Delivery

This rule detects a command shell executing a batch script through the /c switch when launched from explorer, a delivery pattern observed in an EDR analysis of LockBit ransomware where a Documentos.lnk shortcut ran a batch file to stage the attack. It captures the shortcut-to-script execution that begins the intrusion. Detecting this is important because user-facing shortcuts launching batch scripts via the shell is a common ransomware and loader initial-execution technique.

Malicious Safe Mode Boot Configuration via bcdedit

This rule detects bcdedit configuring the system to boot into Safe Mode by setting the safeboot option, a defense-impairment technique observed in an EDR analysis of LockBit ransomware that forced Safe Mode to disable security tooling before encryption. It captures tampering with boot configuration to weaken host defenses. Detecting this is important because interactive bcdedit safeboot changes are strongly associated with ransomware attempting to evade protection prior to file encryption.

Suspicious PowerShell String Concatenation Obfuscation for Batch Extension via LNK (via process_creation)

This rule detects PowerShell command lines that split the "bat" extension into concatenated string fragments to evade static detection, a technique observed in the APT37 ToyBox Story campaign delivering RoKRAT via malicious LNK files. It captures the obfuscation used to reconstruct a batch loader name at runtime so that command inspection does not reveal the dropped payload. Detecting this hidden concatenation surfaces the initial LNK-driven execution stage before the staged loaders run.