Sigma detection rules, expert-reviewed

Suspicious search-ms Protocol Handler Abuse for Remote Payload via PureHVNC (via process_creation)

This rule detects the PureHVNC delivery chain abusing the search-ms URI protocol handler to present a remote malicious LNK disguised with a PDF icon from a WebDAV share. Command lines invoking the search-ms protocol are a known phishing staging technique. This step precedes the Python multi stage loader.

Suspicious Ousaban Installation Marker maisum.dat Created (via file_event)

This rule detects the Ousaban banking trojan dropping its empty installation marker file maisum.dat whose creation time records the infection timestamp alongside the payload directory. Creation of this specific marker file indicates a successful install. The trojan then persists through a Run key.

Malicious Ransom Note and Encrypted Extension via Hakuna Matata Variant (via file_event)

This rule detects the ransomware stage of the multi stage campaign which appends the @NeverMind12F extension to encrypted files and drops a ransom note that carries a distinctive Cyrillic file name. Creation of files with this extension or note name indicates encryption in progress. The variant derives from the Hakuna Matata family.

Suspicious Defendnot Antivirus Disabling Component Dropped in ProgramData (via file_event)

This rule detects the multi stage campaign deploying the Defendnot tool which drops defendnot.dll and defendnot-loader.exe into ProgramData and injects into Taskmgr.exe to deregister Microsoft Defender. Creation of these named components indicates an attempt to blind endpoint protection. This precedes the RAT and ransomware stages.

Malicious NailaoLocker Ransom Note and Encrypted File Creation (via file_event)

This rule detects file system artifacts of NailaoLocker which writes the ransom note unlock_please_view_this_file.html and appends the .locked extension to encrypted files. The locker also drops a lock.log progress file under ProgramData. Creation of these named artifacts indicates active encryption.

Possible TrickBot DNS Tunneling C2 to westurn.in (via dns_query)

This rule detects DNS based command and control from the analyzed TrickBot variant which tunnels XOR encrypted commands as hex encoded labels beneath the westurn.in domain. Queries embed data in long subdomains separated every sixty three characters. Any resolution of this domain indicates the tunneling channel.

Malicious Sednit COM Hijacking Persistence via InprocServer32

This rule detects COM hijacking where a per-user CLSID InprocServer32 key is pointed at the Sednit loader DLLs eapphost.dll or tcpiphlpsvc.dll used by the SlimAgent and BeardShell implants. The DLL names impersonate legitimate Windows components while the HKCU CLSID registration hijacks object loading for stealthy persistence.

Suspicious Shahmaran Autostart Masquerading as Adobe Updater

This rule detects registration of an autostart Run key value pointing to adobeupdater.exe, a persistence file name used by the BladedFeline group to launch the Shahmaran backdoor while impersonating Adobe update software. The legitimate-looking name combined with autorun persistence indicates a masqueraded implant rather than genuine Adobe tooling.

Suspicious K7Soft Autostart Persistence

This rule detects creation of a Run key or service registry value named K7Soft, a persistence mechanism used by the FamousSparrow group to survive reboots by masquerading as security software. The K7Soft name mimicking a legitimate antivirus vendor while establishing autostart execution indicates malicious persistence.

Malicious LSA Password Filter Registration via Notification Packages

This rule detects modification of the LSA Notification Packages registry value to register a rogue password filter DLL such as sasetup.dll. Operation FishMedley abused this mechanism to capture plaintext passwords during password change events via the PasswordChangeNotify export. Password filters run inside LSASS and let attackers persistently intercept credentials as users change them.

Suspicious Run Key Persistence to svcghost in Public WPSManager Path via Registry

This rule detects a Run key value that points to svcghost.exe inside the public WPSDocuments\WPSManager directory, the persistence PlushDaemon establishes after its Korean VPN supply-chain compromise. Executing a service-looking binary from a public documents path is not legitimate autostart behavior. This indicates registry Run-key persistence for the SlowStepper backdoor loader.

Suspicious Service ImagePath Pointing to ShieldNetWork Driver via Registry

This rule detects creation or modification of a service ImagePath value that references the ShieldNetWork directory, the mechanism HotPage uses to register a randomly named service that loads its vulnerable driver. Legitimate services do not install binaries under C:\Windows\ShieldNetWork. This indicates kernel-driver persistence supporting privileged ad injection and hooking.

Suspicious Scarab Service Persistence Registration via Registry (via registry_set)

This rule detects registration of the masquerading services UpdateStorServ or StorageDataServ used by the Scarab group for persistence on compromised servers. These fake storage-service names blend with legitimate system services while launching the group's backdoor at boot.

Suspicious CredSSP Encryption Oracle Remediation Weakening via Registry (via registry_set)

This rule detects setting the CredSSP AllowEncryptionOracle policy value to 2 (Vulnerable), a defense-weakening change used by the Scarab group to enable RDP connections to unpatched hosts. Lowering this protection re-exposes systems to the CVE-2018-0886 encryption oracle and signals attacker lateral-movement preparation.

Possible OxideHarvest Stealer Execution via Combined Short Flag Set

This rule detects a process invoked with the combined i, u, p, t and o short flags used by the OxideHarvest Rust stealer distributed alongside the Gentlemen EDR killer framework. The flag set drives credential and data harvesting stages of the stealer once security tooling has been disabled. Detecting this argument combination helps surface stealer execution, although the generic single-letter flags require corroboration to reduce noise.