Sigma detection rules, expert-reviewed

ValleyRAT Keylog Output File Creation in ProgramData (via file_event)

This rule detects creation of a sys.key file under ProgramData, the keystroke-log output artifact written by ValleyRAT when its keylogger module is activated via configuration or registry key. Adversaries leverage a low-profile filename in a machine-wide directory to collect captured input for later exfiltration, making early detection critical for exposing active collection before credentials and sensitive data leave the host.

Malicious Kimsuky Troll Stealer Collected Data Staging Files with gte1 Extension (via file_event)

This rule detects creation of Troll Stealer staging files under the local AppData folder that follow the tokenized naming scheme used for exfiltration containers such as tsd, tfd, tbd and ccmd with the .gte1 extension. These encrypted collection files hold stolen SSH, FileZilla, browser and system data prior to upload, making their creation a high-confidence sign of active data theft.

Suspicious Scheduled Task SystemSoundsService2 Creation via Process Creation

This rule detects creation of a scheduled task named SystemSoundsService2 through schtasks.exe, a masquerading name GoldenJackal uses to persist its air-gap tooling on government systems. The name imitates a legitimate Windows sounds service to blend in. This indicates scheduled-task persistence by an espionage actor.

Suspicious XScan Network Vulnerability Scanner Execution After Citrix Bleed Exploitation

This rule detects execution of the XScan network scanner with finger and vulnerability scanning flags against a subnet, matching internal reconnaissance seen after Citrix Bleed exploitation by Unit 42. Adversaries sweep the environment for hosts and weaknesses which precedes lateral movement and marks an active operator on the network.

Suspicious Curl Download and Script Execution Chain via Command Line

This rule detects a single command line that downloads an archive with curl, expands it with PowerShell, and executes a VBScript with wscript, matching the PyLangGhost RAT initial delivery chain. This staged download-and-run pattern is characteristic of fake job-interview lures deploying Python-based RATs.

Suspicious Image File Execution Options Debugger Hijack by Miner Campaign

This rule detects creation of a Debugger or MonitorProcess value under Image File Execution Options, an IFEO hijack the Wazuh-agent miner campaign uses for persistence and to launch its payload when a targeted process starts. IFEO debugger entries are seldom set legitimately and are a well-known persistence and injection vector.

Malicious ClickFix PowerShell IEX DownloadString Execution

This rule detects PowerShell running with no-profile and bypass execution policy while using DownloadString and IEX to fetch and run a remote payload, the EVALUSION ClickFix loader. Victims were social-engineered into executing this command which pulled Amatera Stealer and NetSupport RAT from attacker infrastructure. The combination of policy bypass and an in-memory download cradle is a high-confidence execution indicator.

Suspicious Security Center Health Notification Hidden via Registry

This rule detects modification of the Explorer policy value that hides the Security and Maintenance health notifications which the Trigona actor set to suppress warnings while disabling protections and this matters because hiding security health alerts is a user impact evasion technique meant to keep victims unaware of a degraded security posture.

Malicious NTDS.dit Copy for Domain Credential Theft (via file_event)

This rule detects an ntds.dit Active Directory database file being written to disk, the credential-theft step where Muddled Libra copies the domain database and SYSTEM hive from a mounted VMDK. Extracting ntds.dit yields every domain account hash for offline cracking and full domain compromise.

Malicious COM Hijack via CLSID InProcServer32 Registry Modification (via registry_set)

This rule detects a COM hijack targeting the CLSID 2227A280-3AEA-1069-A2DE-08002B30309D by writing to its InProcServer32 registry value. In Operation Phantom Net Voxel APT28 abuses this specific shell folder CLSID so that explorer loads a malicious DLL for persistence and execution. Redirecting this InProcServer32 value to an attacker DLL is a reliable indicator of COM hijacking.

Malicious Scheduled Task for Cryptominer Persistence at Logon (via process_creation)

This rule detects creation of the Monero mining operation scheduled tasks that run at logon with highest privileges. Observed in the Elastic Security Labs fake-installer campaign where SVCConfig or HostDataProcess tasks with ONLOGON and HIGHEST run levels persist the XMRig miner.

Suspicious DanaBot Updater Scheduled Task Running Rundll32 from AppData via schtasks

This rule detects creation of a scheduled task named Updater that launches rundll32.exe against a DLL staged under a per-user AppData Custom_update directory, a persistence pattern used by DanaBot when deploying IcedID. Attackers abuse task scheduler plus rundll32 proxy execution to survive reboots and blend malicious loader activity into routine update tasks.

Malicious Ntospy Network Provider DLL Registration for Credential Capture

This rule detects registration of a malicious Network Provider DLL under the credman service key, matching the Ntospy credential-stealing component used against organizations in the Middle East, Africa and the US per Unit 42. Registering a rogue authentication package as a network provider lets the actor intercept plaintext logon credentials which enables persistent credential theft.

Malicious VenomRAT Scheduled Task Masquerading as Windows Gaming Preview via process_creation

This rule detects creation of a scheduled task named Windows.Gaming.Preview that points to an executable inside the user AppData Drivers directory. The fake CVE-2023-40477 proof-of-concept lure installs VenomRAT with this masqueraded task that reruns the payload from a non-standard path, combining a benign-looking name with a wrong execution context for persistence.

Suspicious Curl POST Downloading PowerShell Payload to Temp Directory (via process_creation)

This rule detects curl issuing an HTTP POST request whose output is a PowerShell script, the ingress technique used in the Axios NPM supply chain attack where cmd.exe piped a curl POST response into a .ps1 file in the Temp directory. Adversaries stage second-stage scripts this way to pull payloads from attacker infrastructure, so the combination of curl, a POST verb, and a PowerShell target file is worth alerting on.