Sigma detection rules, expert-reviewed

Malicious Safe Mode Boot Configuration via bcdedit

This rule detects bcdedit configuring the system to boot into Safe Mode by setting the safeboot option, a defense-impairment technique observed in an EDR analysis of LockBit ransomware that forced Safe Mode to disable security tooling before encryption. It captures tampering with boot configuration to weaken host defenses. Detecting this is important because interactive bcdedit safeboot changes are strongly associated with ransomware attempting to evade protection prior to file encryption.

Suspicious PowerShell String Concatenation Obfuscation for Batch Extension via LNK (via process_creation)

This rule detects PowerShell command lines that split the "bat" extension into concatenated string fragments to evade static detection, a technique observed in the APT37 ToyBox Story campaign delivering RoKRAT via malicious LNK files. It captures the obfuscation used to reconstruct a batch loader name at runtime so that command inspection does not reveal the dropped payload. Detecting this hidden concatenation surfaces the initial LNK-driven execution stage before the staged loaders run.

Malicious Remote Process Creation via WMI Win32_Process

This rule detects use of WMI to create a process through the Win32_Process class from wmic or a script host, an execution technique observed in a MuddyWater APT campaign targeting the Middle East to run payloads while evading direct process lineage. It captures lateral or local execution driven through the WMI provider. Detecting this is important because Win32_Process Create invocations are a frequent attacker method to launch code outside normal parent-child relationships.

Suspicious AutoIt Interpreter Launched by Script Host or Shell

This rule detects the AutoIt3 interpreter being launched by PowerShell or a command shell, a delivery pattern observed in Operation Poseidon where a ZIP to LNK to PowerShell chain executed AutoIt3.exe to load the EndRAT payload in memory. It captures abuse of the legitimate AutoIt engine to run compiled malicious scripts. Detecting this parentage is important because AutoIt3 spawned by a scripting host rather than a user-launched application is a common malware loader pattern.

Suspicious attrib Hidden and System Attribute Assignment

This rule detects the attrib command setting hidden and system attributes on files, a concealment technique observed in the Suky Castle campaign where the chain applied attrib to hide dropped artifacts before scheduling persistence. It captures the marking of files as hidden and system to keep malicious payloads out of view. Detecting this is important because interactive use of attrib to apply both hidden and system flags is uncommon and frequently tied to staging of malware.

Suspicious Office Application Spawning Script Interpreter Chain

This rule detects Microsoft Word spawning a command shell or PowerShell that in turn is associated with script-host execution, a chain observed in a WizardSpider-themed intrusion where winword launched cmd or PowerShell leading to cscript. It captures the transition from a weaponized document to interactive command execution. Detecting this parent-child relationship is important because productivity applications launching shells is a strong indicator of malicious macro or exploit activity.

Suspicious Rename of Text File to Script via Move Command

This rule detects a command shell renaming a .txt file into a .vbs script using the move command, a defense-evasion trick observed in a WizardSpider-themed chain where adb.txt was converted into adb.vbs prior to execution with cscript. It captures the staging step that disguises a script payload as a benign text file. Detecting this matters because legitimate workflows rarely rename plain text files into executable script extensions from the command line.

Suspicious rundll32 Control_RunDLL DLL Execution

This rule detects rundll32 invoking a DLL through the Control_RunDLL entry point, a technique observed in a WizardSpider-themed intrusion chain to proxy execution of a malicious DLL named adb.dll. It captures signed-binary proxy execution used to blend malicious code with legitimate control-panel handling. Detecting this is important because Control_RunDLL is frequently abused to run attacker DLLs while evading application controls.

Malicious Ransomware Payload Execution via HWP Word Processor Spawning Executable from Temp

This rule detects the Hancom HWP word processor spawning an executable file from the user AppData Local Temp directory, a behavior observed in an EDR-analyzed ransomware campaign delivered through malicious HWP documents. It captures the initial code-execution stage where a lure document drops and launches a payload leading to file encryption. Detecting this parent-child anomaly is important because office document processors should not launch arbitrary executables from temporary folders.

Possible EndRAT C2 Communication via Distinctive Client Identifier

This rule detects network traffic containing the EndRAT-specific identifiers endServer9688 or endClient9688, string markers observed in Operation Poseidon where the AutoIt-delivered EndRAT implant used these tokens to communicate with its command-and-control server. It captures the beaconing of a specific remote-access trojan by its protocol constants. Detecting this is important because these identifiers are unique to the malware family and provide a high-confidence signal of active compromise.

Malicious RoKRAT Staged Loader Files in Temp via LNK (via file_event)

This rule detects the creation of the sequentially named toy01.dat, toy02.dat and toy03.bat loader files inside the user Temp directory as staged by the APT37 ToyBox Story campaign. These files form the multi-stage loader chain that ultimately decrypts and executes the RoKRAT payload on disk. Alerting on these campaign-specific staged artifacts catches the delivery step where the loaders are written before execution.

Suspicious Creation of MuddyWater Log-Named Payload Files

This rule detects the creation of files named ManagerProc.log or PhotoAcq.log, distinctive artifact names observed in a MuddyWater APT campaign where malicious components were dropped under a log file guise. It captures the staging of implant files disguised with benign logging names. Detecting this is important because these specific filenames are tied to the campaign and their appearance strongly indicates targeted intrusion activity.

Suspicious Ousaban Persistence via Financeiro Run Registry Value (via registry_set)

This rule detects the Ousaban banking trojan establishing autostart persistence by creating a Run key value named Financeiro under the CurrentVersion Run key that launches its payload from a hardcoded path. The Portuguese value name is specific to this Iberian campaign. Any such value indicates the trojan.

Suspicious UAC Weakening via ConsentPromptBehaviorAdmin Disable by Winos (via registry_set)

This rule detects the Winos 4.0 implant weakening User Account Control by setting ConsentPromptBehaviorAdmin and PromptOnSecureDesktop to zero under the system policy key. This silences elevation prompts to allow silent privilege escalation. Setting these values to zero is rarely legitimate on managed hosts.

Malicious Winos 4.0 Configuration and Shellcode Storage in Registry (via registry_set)

This rule detects the Winos 4.0 implant storing configuration, encrypted plugin DLLs and shellcode under registry keys named with the campaign identifier B118D5E900008F7A in the HKCU hive. The malware reads these keys to reload modules in memory. Presence of this identifier in a registry path is a strong indicator.