Sigma detection rules, expert-reviewed

Suspicious Scarab Service Persistence Registration via Registry (via registry_set)

This rule detects registration of the masquerading services UpdateStorServ or StorageDataServ used by the Scarab group for persistence on compromised servers. These fake storage-service names blend with legitimate system services while launching the group's backdoor at boot.

Suspicious CredSSP Encryption Oracle Remediation Weakening via Registry (via registry_set)

This rule detects setting the CredSSP AllowEncryptionOracle policy value to 2 (Vulnerable), a defense-weakening change used by the Scarab group to enable RDP connections to unpatched hosts. Lowering this protection re-exposes systems to the CVE-2018-0886 encryption oracle and signals attacker lateral-movement preparation.

Possible OxideHarvest Stealer Execution via Combined Short Flag Set

This rule detects a process invoked with the combined i, u, p, t and o short flags used by the OxideHarvest Rust stealer distributed alongside the Gentlemen EDR killer framework. The flag set drives credential and data harvesting stages of the stealer once security tooling has been disabled. Detecting this argument combination helps surface stealer execution, although the generic single-letter flags require corroboration to reduce noise.

Possible Firewall Rule Manipulation via netsh advfirewall by FishMonger

This rule detects use of netsh to add advanced firewall rules, an action used by the FishMonger group to weaken host defenses and allow SprySOCKS communication. The technique modifies the Windows firewall configuration to permit inbound or outbound traffic for attacker tooling. Detecting this command is useful because unexpected firewall changes on endpoints can indicate defense evasion, though it also occurs during legitimate administration.

Suspicious IntelAudioService Execution with StateRepository Arguments via SPECTRALVIPER

This rule detects execution of IntelAudioService.exe with the specific appmodel, StateRepository and Service command-line arguments used to launch the SPECTRALVIPER backdoor. The behavior is linked to the OceanLotus (APT32) espionage operation that shifted from external to domestic targeting. Detecting this masqueraded launcher pattern is important because attackers use it to covertly start their implant and blend with legitimate audio service activity.

Suspicious SearchApp Masquerading Executed Outside System Directory

This rule detects a process named SearchApp.exe running from a location other than the Windows System directories, matching the Webworm EchoCreep implant that impersonates the Windows Search application. The genuine SearchApp.exe executes only from packaged system paths, so a copy running elsewhere exposes the masqueraded malware.

Malicious Webworm MicrosoftSSHUpdate Scheduled Task Persistence

This rule detects creation of a scheduled task named MicrosoftSSHUpdate, used by the Webworm group to persist and launch its EchoCreep implant disguised as SearchApp.exe. The task name imitates a Microsoft SSH update to blend with legitimate services, so its registration signals attacker persistence.

Malicious FrostyNeighbor ViberPC Renamed Rundll32 DLL Execution

This rule detects a rundll32 copy renamed to ViberPC.exe loading ViberPC.dll and invoking its SettingTimeAPI export, the execution chain used by the FrostyNeighbor PicassoLoader campaign. Renaming rundll32 and the payload to imitate the Viber messenger disguises DLL proxy execution as a trusted application.

Suspicious Rubeus Kerberos Abuse Tool Execution from Downloads

This rule detects execution of the Rubeus Kerberos abuse tool from a user Downloads folder, as observed in the DynoWiper intrusion for ticket theft and forging. Rubeus is an offensive credential-access utility, and its presence under Downloads on an endpoint indicates hands-on-keyboard Active Directory attack activity.

Malicious Rundll32 notepad2 DLL Proxy Execution

This rule detects rundll32 loading notepad2.dll and invoking its notepad export, the proxy-execution technique used by the spyware in the Pakistan dating-app campaign. Naming the malicious DLL and export after Notepad disguises code execution as a benign editor, so this specific invocation reveals the loader.

Malicious ReverseSocks5 Reverse Tunnel Execution via Command Line

This rule detects execution of the ReverseSocks5 tunneling tool by its distinctive connect and pre-shared-key command-line flags, as deployed by LongNosedGoblin for covert proxying. Establishing a reverse SOCKS5 tunnel with a PSK back to attacker infrastructure enables persistent access and traffic relaying through the victim network.

Malicious LongNosedGoblin OneDrive Reporting Task Scheduled Task Persistence

This rule detects registration of a scheduled task whose name begins with OneDrive Reporting Task-S-1-5-21-, the persistence pattern used by the LongNosedGoblin toolset against government targets. The task masquerades as a OneDrive reporting job appended with a user SID, so this naming structure reveals attacker persistence.

Malicious Kazuar DLL Side-Loading via Renamed Host Binaries

This rule detects execution of vncutil64.exe or LaunchGFExperience.exe, host binaries abused via DLL side-loading to restart the Turla Kazuar backdoor during a Gamaredon and Turla collaboration. These legitimately named executables running from non-standard locations serve as loaders for a malicious sideloaded DLL and indicate espionage backdoor activity.

Malicious Command Execution Spawned by SharePoint w3wp Worker Process

This rule detects the IIS worker process w3wp.exe spawning cmd.exe or a scripting host, behavior seen when ToolShell webshells such as spinstall0.aspx execute operating system commands on compromised SharePoint servers. A web server worker launching a command interpreter is a hallmark of webshell-driven remote command execution following exploitation.

Suspicious PowerShell Execution of TrainedDataStore Script

This rule detects PowerShell executing a script named TrainedDataStore.ps1, associated with the P.S. Olala tooling used by the BladedFeline group. Execution of this specifically named script indicates attacker PowerShell tradecraft used for command execution and post-compromise activity.