Sigma detection rules, expert-reviewed

Suspicious Curl POST Downloading PowerShell Payload to Temp Directory (via process_creation)

This rule detects curl issuing an HTTP POST request whose output is a PowerShell script, the ingress technique used in the Axios NPM supply chain attack where cmd.exe piped a curl POST response into a .ps1 file in the Temp directory. Adversaries stage second-stage scripts this way to pull payloads from attacker infrastructure, so the combination of curl, a POST verb, and a PowerShell target file is worth alerting on.

Suspicious ASPX Webshell Written to IIS inetsrv Directory via file_event

This rule detects an fd.aspx file being written under the IIS inetsrv directory, matching the webshell dropped by the hacktivist actors for server access. Web-facing script files appearing in the IIS binaries path are a hallmark of server-side webshell deployment. This supports persistence and remote command execution on internet-facing hosts.

PowerShell In-Memory Shellcode Execution via Memory Allocation APIs (via ps_script)

This rule detects a PowerShell script block that combines GlobalAlloc VirtualProtect and CreateThread calls to allocate executable memory and run shellcode, the in-memory loading behavior of the RokRAT search.dat loader read from the public directory. Adversaries leverage reflective shellcode execution to run their payload without touching disk as a file, making early detection critical for surfacing fileless code execution before RokRAT deploys.

Malicious more_eggs Scriptlet DLL Registration via regsvr32 Action Install from AppData (via process_creation)

This rule detects regsvr32 registering a DLL from a user AppData path with the /i Action install switch, the second-stage more_eggs loader behavior in which wmiprvse.exe spawned regsvr32 to activate a payload dropped under AppData Roaming Microsoft. Adversaries use the regsvr32 /n /i scriptlet-install path to run code through a trusted binary while avoiding on-disk executables, so this pattern from a user directory is a strong loader indicator.

Malicious SAM and SYSTEM Hive Dump via reg save (via process_creation)

This rule detects use of reg.exe to save the SAM or SYSTEM registry hives to disk for offline credential extraction. This technique was observed in the APT41 intrusion targeting government IT services in Africa. Dumping these hives lets attackers recover local account password hashes and boot keys away from the host and is a strong precursor to lateral movement.

Suspicious Wscript Executing UN VBS Cleanup Script via Command Line (via process_creation)

This rule detects wscript.exe executing a VBScript named UN.vbs, the cleanup component used by the Parallax RAT to remove infection artifacts. It is associated with the Parallax RAT campaign reported by Uptycs. Attackers run this script to erase traces after establishing access, so the execution is a useful indicator of post-infection cleanup activity.

Malicious UNC1549 MINIBIKE DLL Side-Load of secur32.dll via FileCoAuth (via image_load)

This rule detects the OneDrive-associated FileCoAuth.exe binary loading a secur32.dll from a non-system directory, the side-load path for UNC1549 MINIBIKE and MINIBUS backdoors. The suspected Iranian actor abused a trusted-looking executable to load a malicious DLL of the same name as a system library. Loading secur32.dll from outside System32 through FileCoAuth is a high-fidelity side-loading indicator.

Possible DLL Side-Loading via DicomPortable Spawned by ITarian RmmService

This rule detects DicomPortable launched by the ITarian RmmService process which the phishing RMM campaigns abuse to side-load HijackLoader and DeerStealer through a trojanized DLL. Chaining a legitimate RMM service into a vulnerable portable binary lets adversaries execute malware under a trusted parent. Detecting this parent-child pair surfaces DLL search order hijacking used for stealer delivery.

Suspicious File Download via Certutil URLCache

This rule detects certutil being used with its url cache download flags which the ALPHV intrusion leveraged as a living off the land downloader to stage tooling and this matters because certutil is a signed system binary frequently abused to retrieve remote payloads and its download flags rarely appear in legitimate certificate operations.

Suspicious PowerShell Invoke-WebRequest and Invoke-Expression Download Cradle via ClickFix

This rule detects PowerShell combining Invoke-WebRequest with Invoke-Expression to download and execute a payload in memory as seen in the ClickFix Revenge of detection campaign. This download cradle avoids writing the payload to disk and is triggered from a pasted Run dialog command. The pairing of remote fetch and dynamic execution is a strong malicious signal.

Malicious DLL Side-Loading of SBAMBRES.DLL by VIPRE Binary via DeedRAT (via image_load)

This rule detects the legitimate VIPRE MambaSafeModeUI.exe binary loading SBAMBRES.DLL from the ProgramData Micro directory, the side-loading step that launches the DeedRAT backdoor. Genuine VIPRE components load this DLL from their install directory, not ProgramData.

Suspicious notepad Spawned by mshta for Process Injection

This rule detects mshta spawning notepad which in the WithSecure Windows lab was created suspended as an injection host for a Covenant Grunt implant. The script host mshta launching notepad has no legitimate purpose and strongly suggests it is being used as a hollow target for process injection.

Suspicious Child Process Spawned by WmiPrvSe

This rule detects the WMI provider host WmiPrvSe.exe spawning command interpreters or scripting engines. This process tree is characteristic of remote WMI execution abuse for code execution and lateral movement. Shell processes parented to WmiPrvSe should be reviewed for unauthorized activity.

Conhost Suspicious Command Execution

Detects use of conhost in "headless" mode. By running conhost.exe in "headless" mode, it means that no visible window will pop up on the victim's machine.

Suspicious Windows Credential Manager Enumeration (via process_creation)

This rule detects cmdkey /list or vaultcmd /list enumerating saved credentials in the Windows Credential Manager, a credentials-from-password-stores technique used to reveal cached logins for lateral movement. Credential Manager enumeration is tracked in the Red Canary Threat Detection Report. Detecting these commands surfaces stored-credential discovery.