Sigma detection rules, expert-reviewed

Suspicious FrostyNeighbor WinDataScope JavaScript Dropper Artifact

This rule detects creation of the FrostyNeighbor dropper artifacts under an AppData WinDataScope folder, specifically Update.js and WinUpdate.reg. These files are staged by the JavaScript dropper to seed later stages and registry persistence, so their appearance in this path indicates an active infection.

Malicious Secure Boot Bypass Files Dropped to EFI Partition

This rule detects creation of the cloak.dat or reloader.efi files used by HybridPetya to exploit CVE-2024-7344 and bypass UEFI Secure Boot. Writing these bootkit components onto the EFI system partition indicates an attempt to load unsigned code during boot and achieve stealthy pre-OS persistence.

Malicious Windows Boot Manager Backup Created by UEFI Bootkit

This rule detects creation of a bootmgfw.efi.old file on the EFI system partition, an artifact left when HybridPetya backs up the legitimate Windows Boot Manager before overwriting it with a malicious bootkit. Preserving the original boot manager under a .old name while hijacking the boot chain indicates pre-OS persistence and boot process tampering.

Malicious Startup LNK Dropped by WinRAR via CVE-2025-8088 Path Traversal

This rule detects the WinRAR process writing a shortcut (.lnk) file into a user or common Startup folder, behavior produced when RomCom and others exploit the CVE-2025-8088 alternate data stream path traversal flaw to gain persistence. Archive tools should not place shortcuts into autostart locations, so this write indicates exploitation and persistence installation.

Suspicious ToolShell Webshell Written to SharePoint Layouts Directory

This rule detects creation of the ToolShell webshell files spinstall0.aspx or ghostfile-prefixed .aspx files used by multiple threat actors after exploiting the SharePoint ToolShell vulnerability chain. These named ASPX payloads dropped onto a SharePoint server provide persistent remote command execution and are strong indicators of compromise.

Suspicious Whisper Backdoor Log File in Windows Temp

This rule detects creation of a file named WindowsEventLogs.txt in C:\Windows\Temp, the hardcoded log location written by the Whisper backdoor used by the BladedFeline group. The filename masquerades as legitimate event log data while actually storing attacker command output and activity records.

Suspicious Webshell Deployment in DNN DesktopModules Directory

This rule detects creation of ASP.NET handler (.ashx) files inside the DotNetNuke DesktopModules directory, a webshell staging location used by the FamousSparrow group for initial access and persistence on IIS servers. Web-facing handler files written into CMS module folders commonly represent server-side backdoors enabling remote command execution.

Suspicious CloudScout hxkz_zip Exfiltration Archive Creation via File System

This rule detects creation of files with the .hxkz_zip extension, the custom archive format CloudScout produces to stage stolen browser cookies and cloud session data before exfiltration. This extension is unique to the tooling and is not produced by legitimate software. Its presence indicates collection of session tokens for cloud-service hijacking.

Suspicious HotPage Driver Drop under ShieldNetWork Directory via File System

This rule detects file creation under C:\Windows\ShieldNetWork\, the fixed directory where the HotPage installer drops its encrypted, randomly named vulnerable driver. The ShieldNetWork path is a distinctive artifact of this signed ad-injecting driver campaign. Its appearance indicates staging of a BYOVD component intended to run privileged browser injection code.

Suspicious Lunar Backdoor State File Creation via File System

This rule detects the creation of Lunar backdoor state and configuration files with the distinctive names perfconfm.dat, content.tpl, and outlk.share. These artifacts are dropped by the LunarMail and LunarWeb implants used against European diplomatic missions. Their presence indicates active espionage tooling and stager persistence on the host.

Malicious Vulnerable Driver Load by GentleKiller BYOVD EDR Killer

This rule detects loading of known vulnerable or malicious kernel drivers abused by the GentleKiller BYOVD framework to disable endpoint security. The Gentlemen intrusion set uses these signed drivers to gain kernel access and terminate hundreds of protection processes. Detecting these specific driver names is important because a successful load precedes mass tampering with security tooling and credential theft.

Possible Gamaredon Dead-Drop C2 via Telegraph and GoFile Web Services

This rule detects DNS resolution of api.telegra.ph and gofile.io, legitimate web services abused by Gamaredon in 2025 as dead-drop resolvers and exfiltration channels through its PteroOdd and PteroEffigy tools. The group stores C2 configuration and stages stolen data on these platforms to blend with normal web traffic. Detecting these lookups is important because they reveal web-service based command-and-control and data exfiltration that evades domain reputation controls.

Possible Gamaredon C2 via Ephemeral Tunneling and Worker Services

This rule detects DNS resolution of ephemeral tunneling and serverless worker domains abused by Gamaredon in 2025 for command-and-control, including trycloudflare.com, workers.dev, devtunnels.ms and loophole.site. The group routes implant traffic through these disposable services to hide infrastructure behind trusted providers. Detecting these lookups is useful for spotting covert C2, while acknowledging that developers also use these tunneling services legitimately.

Suspicious SlowStepper DNS TXT C2 Subdomain Lookup via DNS Query

This rule detects DNS lookups to the gsm.360safe.company namespace, the command-and-control domain the SlowStepper backdoor queries over DNS TXT records after the PlushDaemon supply-chain compromise. This subdomain pattern is specific to the actor infrastructure. Its resolution indicates active DNS-based C2 communication.

Suspicious Microsoft Edge Native Messaging Host Registration via UNC6692

This rule detects registration of a Microsoft Edge native messaging host, the mechanism UNC6692 uses to bridge its sideloaded extension to a local Python messaging host. This channel lets the browser extension execute native code and communicate with attacker tooling. New native messaging host registrations should be validated against known browser integrations.