Sigma detection rules, expert-reviewed

Suspicious Hidden Executable Launched from Mounted Image via Shortcut (via process_creation)

This rule detects a shortcut-launched executable running with a hidden or minimized window from a non-system drive letter that typically corresponds to a mounted image. EnvyScout ships an NV.lnk shortcut that silently starts the hidden BOOM.exe from the mounted NV folder after the victim opens the ISO. Hidden execution from freshly mounted removable media is characteristic of container-delivered malware.

Suspicious PowerShell Reflective Assembly Load Invoking VAI Method (via process_creation)

This rule detects PowerShell reflectively loading a .NET assembly and invoking a method named VAI. This layered loader uses this in-memory technique to execute payloads decoded from steganographic images.

Suspicious Kimsuky JS Downloader Staging in Public and Templates Paths (via file_event)

This rule detects the creation of Kimsuky downloader and launcher scripts such as DefenderUpdate.js in Public Downloads or Templates.js and Templates.ps1 in the Windows Templates directory. These filenames and locations are used by the PebbleDash infection chain to stage follow on payloads.

Suspicious IIS Worker Process Spawning Command Shell via Web Shell (via process_creation)

This rule detects the IIS worker process spawning a command interpreter or WMI utility, a behavior consistent with the Phantom Taurus web shell loading IIServerCore inside w3wp.exe. Server-side web shells use the worker process to execute reconnaissance and lateral movement commands. Detecting this chain surfaces active exploitation of a public-facing web application by a Chinese-nexus APT.

Malicious Computer Account Modifying Active Directory Permissions - PrivExchange (via security)

This rule detects compromise a server with high privileges to perform permissions changes. PrivExchange attack can be detected using this rule.

Suspicious Modification of SSH Authorized Keys on SD-WAN Appliance by UAT-8616

This rule detects changes to the root SSH authorized_keys file on Cisco Catalyst SD-WAN appliances. UAT-8616 adds attacker-controlled SSH keys and enables root login to persist after exploiting vManage. Injecting authorized keys grants durable passwordless root access to the compromised device.

Suspicious Cron Persistence Installing a Downloader via Command Line

This rule detects a crontab entry being registered that embeds a curl or wget download command, indicating a scheduled task that re-fetches attacker code on a recurring basis. The OpenClaw supply chain campaign uses cron jobs for command-and-control persistence on macOS and Linux hosts. Flagging this uncovers a recurring foothold that survives reboots and re-establishes contact with the attacker.

StealC Loader Execution via Blender Spawning Script Interpreter (via process_creation)

This rule detects blender.exe spawning a command shell or script interpreter such as PowerShell, cmd, or python, the execution behavior triggered when a malicious .blend file with embedded auto-run Python fetches a remote loader in the StealC V2 Blender campaign. Adversaries leverage the Blender Auto Run Python Scripts setting so opening a downloaded model executes their loader, making early detection critical for stopping the chain before the StealC stealer and Pyramid C2 module deploy.

Malicious Brutforce Enumeration with Unexisting Users - Kerberos (via security)

This rule detects enumerate potential existing users, resulting in failed Kerberos TGT requests with unexisting or invalid accounts.

Suspicious Session Manager Execute Value Modification for Persistence (via registry_set)

This rule detects modification of Session Manager execution values such as BootExecute, SetupExecute, PlatformExecute and S0InitialCommand under the Control key. These values run native applications very early during boot and are abused by adversaries for stealthy persistence and defense evasion.

Suspicious icacls Grant of Full Control to Everyone

This rule detects icacls granting the Everyone security principal full control, the permissive access change The Gentlemen ransomware applied to ease propagation and encryption. Granting the Everyone group full control over files is rarely legitimate and typically supports lateral movement or mass file access.

Malicious Defender Exclusion for Fake DefenderUpdates Folder via Add-MpPreference (via process_creation)

This rule detects Add-MpPreference adding a scanning exclusion for the DefenderUpdates folder under the roaming profile, the staging directory into which Salat Stealer drops its docconv.exe payload. Adversaries leverage a Defender exclusion path that mimics a legitimate update folder so the dropped executable can run unscanned, making early detection critical for catching persistence before data theft.

Masquerading Bumblebee Loader MSI Download via PowerShell Invoke-WebRequest and Silent msiexec (via process_creation)

This rule detects a single PowerShell command that uses Invoke-WebRequest to download an MSI installer and then launches msiexec silently, the delivery behavior used by an LNK-triggered Bumblebee loader infection chain masquerading as Nvidia and Midjourney installers. Chaining a remote MSI fetch with a quiet install in one command line is a strong indicator of staged loader delivery before in-memory payload execution.

Suspicious Self-Copied CMD Script in ProgramData (via file_event)

This rule detects creation of a command script named rEgX.cmd within the ProgramData directory. The Dead#Vax campaign copied itself to this file as part of its persistence and self-healing routine.

Malicious Webserver IIS Module Installed - Command (via process_creation) - Variant 2

This rule detects deploy an IIS module via the gacutil tool.