Sigma detection rules, expert-reviewed

Suspicious Creation of MuddyWater Log-Named Payload Files

This rule detects the creation of files named ManagerProc.log or PhotoAcq.log, distinctive artifact names observed in a MuddyWater APT campaign where malicious components were dropped under a log file guise. It captures the staging of implant files disguised with benign logging names. Detecting this is important because these specific filenames are tied to the campaign and their appearance strongly indicates targeted intrusion activity.

Suspicious Ousaban Persistence via Financeiro Run Registry Value (via registry_set)

This rule detects the Ousaban banking trojan establishing autostart persistence by creating a Run key value named Financeiro under the CurrentVersion Run key that launches its payload from a hardcoded path. The Portuguese value name is specific to this Iberian campaign. Any such value indicates the trojan.

Suspicious UAC Weakening via ConsentPromptBehaviorAdmin Disable by Winos (via registry_set)

This rule detects the Winos 4.0 implant weakening User Account Control by setting ConsentPromptBehaviorAdmin and PromptOnSecureDesktop to zero under the system policy key. This silences elevation prompts to allow silent privilege escalation. Setting these values to zero is rarely legitimate on managed hosts.

Malicious Winos 4.0 Configuration and Shellcode Storage in Registry (via registry_set)

This rule detects the Winos 4.0 implant storing configuration, encrypted plugin DLLs and shellcode under registry keys named with the campaign identifier B118D5E900008F7A in the HKCU hive. The malware reads these keys to reload modules in memory. Presence of this identifier in a registry path is a strong indicator.

Suspicious .NET Utility Spawned by AutoHotkey Loader for Process Hollowing (via process_creation)

This rule detects the AsyncRAT loader hollowing legitimate .NET Framework utilities such as AddInProcess32.exe, AppLaunch.exe and aspnet_compiler.exe launched from the Windows Sound Diagnostics staging folder. These binaries are injected with the final remote access trojan. A parent located in that package path spawning these utilities indicates hollowing.

Suspicious AutoHotkey Execution Masquerading as Realtek Audio in Sound Diagnostics Path (via process_creation)

This rule detects the AI themed AsyncRAT campaign running AutoHotkey binaries renamed to Realtek audio components from the Windows Sound Diagnostics package folder. The renamed interpreters execute .ahk orchestration scripts that perform process hollowing. Execution of an .ahk script from this staging path is highly suspicious.

Suspicious PowerShell Spawned by WScript With Hidden Bypass via PureLogs Loader (via process_creation)

This rule detects the PureLogs phishing chain in which a malicious JavaScript file executed by wscript.exe spawns PowerShell with an execution policy bypass and a hidden window to run a dropped script from a temp folder. This parent child relationship between the script host and PowerShell is a strong loader signal. The staged script then hollows a .NET binary.

Suspicious javaw.exe Executing JAR From Masqueraded Roaming Directory via Interlock Ransomware (via process_creation)

This rule detects the Interlock Windows ransomware which runs through a legitimate javaw.exe copied into Roaming subfolders that impersonate FortiClient, VMware or a Welcome application to execute its JAR payload. Java runtimes staged under these AppData paths are not normal on endpoints. This execution indicates ransomware deployment.

Malicious Browser Credential Theft via rundll32 Loading move.dll (via process_creation)

This rule detects the Interlock custom infostealer move.dll executed through rundll32.exe with a start argument, a DER key file and a target host to collect browser credential stores. The stolen data is written per host as a CSV file. This rundll32 invocation of move.dll with a key file is characteristic of the stealer.

Suspicious Scheduled Task With TimeSync Masquerade via Interlock RAT (via process_creation)

This rule detects Interlock RAT persistence which registers scheduled tasks using deceptive time synchronization names such as TimeSyncDrive and TimeSyncroDriver. These names imitate legitimate Windows time services to blend in. Creation of tasks with these exact names indicates the RAT.

Malicious Inhibit System Recovery via Native Backup and Shadow Copy Deletion (via process_creation)

This rule detects the multi stage campaign destroying recovery options by disabling the Windows Recovery Environment with reagentc, deleting the backup catalog with wbadmin and removing volume shadow copies with vssadmin before ransomware deployment. Executing these recovery inhibiting commands together is a strong pre encryption signal.

Malicious Inhibit System Recovery via bcdedit Boot Policy Change by Chaos Ransomware (via process_creation)

This rule detects Chaos C++ ransomware disabling Windows recovery by running bcdedit to ignore all boot failures and to turn off the recovery environment prior to encryption. These bcdedit modifications remove the user ability to recover the system. They are a reliable pre encryption indicator.

Suspicious DLL Download via curl to User Profile by Confucius Loader (via process_creation)

This rule detects the Confucius LNK loader using curl launched from PowerShell to fetch side loading DLLs such as python313.dll and mapistub.dll into the user profile alongside a decoy PDF. Downloading these specific DLL names with curl is characteristic of the actor. The DLLs are then side loaded by copied system binaries.

Suspicious Winos Persistence Binary Created as ProgramData BITTS2.exe (via process_creation)

This rule detects the Winos 4.0 implant establishing persistence by copying itself to ProgramData as BITTS2.exe and executing it. This hardcoded path and file name are unique to the campaign. Execution of this binary indicates an active infection.

Suspicious Python Interpreter Execution From Downloads Directory via PureHVNC Loader (via process_creation)

This rule detects the PureHVNC loader which extracts a portable Python environment into a hidden folder under the user Downloads directory and runs Python files carrying RC4 encrypted shellcode. A Python interpreter executing scripts from Downloads is unusual on endpoints. This stage decrypts and runs shellcode.