Sigma detection rules, expert-reviewed

Malicious PlugX DLL Side-Loading via iviewers OLE Object Viewer (via image_load)

This rule detects the legitimate iviewers.exe OLE COM Object Viewer loading a co-located iviewers.dll from a non standard directory such as ProgramData. Velvet Ant abused DLL search order hijacking against this signed Windows SDK utility to load a PlugX loader and payload. Legitimate use of this tool loads its DLL from the SDK installation directory only.

Suspicious Wireless Credential Extraction via netsh wlan show profile in Katz Stealer (via process_creation)

This rule detects netsh.exe enumerating stored wireless profiles through the wlan show profile command, the WiFi credential extraction behavior performed by Katz Stealer during system profiling. Adversaries leverage netsh to recover saved network keys in clear text, making detection useful for identifying credential collection, though administrative troubleshooting can produce the same telemetry.

Suspicious SoftPerfect Network Scanner Execution (via process_creation)

This rule detects execution of the SoftPerfect Network Scanner, a discovery tool used by the Agrius group during MoneyBird operations to enumerate hosts and services on victim networks. While a legitimate administrative tool, its appearance on endpoints often precedes lateral movement and should be reviewed.

Malicious Microsoft Defender Whole-Drive Exclusion via PowerShell

This rule detects PowerShell adding the entire system drive as a Microsoft Defender exclusion path, an aggressive defense-evasion action used by Cyber Stealer to blind antivirus across the whole host. Excluding C drive from scanning is almost never legitimate and effectively disables Defender file protection, making this a high-confidence evasion indicator.

Suspicious Modification of dMSA Managed Account Link Attributes

This rule detects directory modifications to the msDS-ManagedAccountPrecededByLink or msDS-DelegatedMSAState attributes of a delegated Managed Service Account. The BadSuccessor attack abuses these dMSA attributes to inherit privileges from a targeted account and escalate in Active Directory. Changes to these attributes outside sanctioned administration indicate an escalation attempt.

Possible CVE-2023-23397 Outlook Forced Authentication via Outbound SMB (via network_connection)

This rule detects a Windows host initiating an outbound SMB connection on TCP 445 to a non-private external address. CVE-2023-23397 abuses a Microsoft Outlook reminder property carrying a UNC path to coerce the host into leaking Net-NTLMv2 credentials to an attacker-controlled SMB server. Successful forced authentication lets adversaries relay or crack the hash so the residual leak of a domain credential must be triaged.

Suspicious NTDS Database Access via Command Line (via process_creation)

This rule detects command lines referencing the ntds.dit Active Directory database, which was staged along with the SECURITY and SYSTEM registry hives for credential extraction in a ShadowPad intrusion. Access to ntds.dit outside of backup software is a strong credential theft indicator. Copying the directory database yields every domain account hash for offline cracking and forgery.

Suspicious winhlp32 Network Connection Indicating RemcosRAT Injection

This rule detects winhlp32.exe establishing an external network connection, behavior the legacy help viewer never performs and used in the OnlyDcRatFans intrusion as the injection host for RemcosRAT command and control. An outbound connection from winhlp32 signals injected malicious code beaconing to an attacker server.

Malicious Kimsuky Keylogger PowerShell Functions PokDoc and InfoKey (via ps_script)

This rule detects PowerShell script content containing the PokDoc and InfoKey function names used by the Kimsuky implant observed against Japanese organizations. These function names are implant-specific keylogging and document-collection routines, so their presence in scriptblock logs indicates hands-on infostealer activity.

RedCurl QWCrypt Ransomware Execution with Hyper-V Targeting Flags

This rule detects the QWCrypt ransomware binary launched with its distinctive command line flags that target Hyper-V virtual machines while excluding gateway hosts and disabling shadow copies during encryption.

Malicious Windows Event Log Clearing via wevtutil (via process_creation)

This rule detects wevtutil being used to clear Windows event logs. LockBit clears event logs during deployment to erase evidence of its activity and hinder incident response, so a log-clear command is a strong defense-evasion indicator.

Malicious Remote Process Creation via WMIC Node

This rule detects wmic invoking process call create against a remote node which the ALPHV actor used to launch payloads on other hosts during lateral movement and this matters because remote process creation through wmic is a well established lateral movement primitive that is uncommon in day to day administration and warrants scrutiny.

Suspicious Decoy Copy and Rename of PDF to Executable (via process_creation)

This rule detects a malicious LNK using xcopy or ren to copy a decoy PDF and rename it into an executable or DLL as part of a Cobalt Strike delivery chain distributed via GitHub and Quora dead-drops. Disguising a payload as a document and flipping the extension at runtime lets the attacker present a benign lure while planting the real loader on disk.

Malicious APT-C-60 COM Hijack via SpyGlace CLSID InProcServer32 (via registry_set)

This rule detects registry modification of the InProcServer32 value for the specific CLSIDs abused by APT-C-60 for COM hijacking to load the SpyGlace backdoor. Pointing these class identifiers at an attacker DLL provides stealthy persistence and execution whenever the hijacked COM object is instantiated.

Suspicious Download LOLBIN Spawned by ScreenConnect Client

This rule detects the ScreenConnect client service spawning download utilities such as bitsadmin or PowerShell which is the payload retrieval chain that dropped KrustyLoader after a ScreenConnect exploit as described by WithSecure. Remote monitoring tools launching download LOLBINs shortly after exploitation frequently indicates ingress tool transfer of a second stage.