Sigma detection rules, expert-reviewed

Suspicious SlowStepper DNS TXT C2 Subdomain Lookup via DNS Query

This rule detects DNS lookups to the gsm.360safe.company namespace, the command-and-control domain the SlowStepper backdoor queries over DNS TXT records after the PlushDaemon supply-chain compromise. This subdomain pattern is specific to the actor infrastructure. Its resolution indicates active DNS-based C2 communication.

Suspicious Microsoft Edge Native Messaging Host Registration via UNC6692

This rule detects registration of a Microsoft Edge native messaging host, the mechanism UNC6692 uses to bridge its sideloaded extension to a local Python messaging host. This channel lets the browser extension execute native code and communicate with attacker tooling. New native messaging host registrations should be validated against known browser integrations.

Malicious Kong RAT Configuration Registry Keys

This rule detects writes to the Software Kong Client registry path used by the Kong RAT distributed through a multi-stage SEO poisoning campaign against Chinese-speaking developers. The malware stores its configuration and state under this dedicated key. Presence of this key indicates an active Kong RAT implant on the host.

Suspicious Run Key Persistence Masquerading as MicrosoftUpdate via Axios npm Compromise

This rule detects a Run key persistence value named MicrosoftUpdate, a masquerade used by the SILKBELL payload delivered through the compromised axios npm package. The benign-looking value name hides a batch launcher that beacons to attacker infrastructure. Autostart entries impersonating Microsoft update services should be validated against their target executable.

Malicious UPlugPlay Service Creation Masquerading as PlugPlay

This rule detects creation of a service named UPlugPlay, the persistence service Prometei installs to masquerade as the legitimate PlugPlay service. The botnet registered an auto-start UPlugPlay service pointing at its sqhost.exe binary to survive reboots. The near-identical service name to a real Windows service is a deliberate masquerade with no legitimate counterpart.

Suspicious SyncFuture GcServices Configuration Key Creation

This rule detects writes to an HKCU Software Microsoft GcServices key, a fake Microsoft-branded configuration store used by SyncFuture malware. The actors stored year and MD5-derived values under this masqueraded key to hold implant configuration. A GcServices subkey under the Microsoft software hive does not correspond to any legitimate product and indicates implant configuration persistence.

Suspicious Startup Persistence via Registry Run Key Pointing to Script

This rule detects a registry Run key value being set to a VBScript or JScript file, a startup persistence method used by Pure Crypter alongside scheduled tasks. Run keys that launch script files at logon are a frequent malware persistence mechanism and should be validated against known good software.

Suspicious Winos4.0 Configuration Registry Keys under HKCU Console IpDate (via registry_set)

This rule detects creation of the Winos4.0 configuration values stored under HKCU Console IpDate and HKCU Software IpDates_info during the CleverSoar campaign. The malware abuses the Console registry branch to persist shellcode and staging data using these distinctive value names. Legitimate software does not write IpDate style keys into the Console hive, making this a precise indicator of the online module component.

Suspicious Zloader Configuration Registry Key under HKCU Microsoft hcdg (via registry_set)

This rule detects creation of the unusual hcdg subkey under HKCU Software Microsoft, a location Zloader uses to store its encrypted configuration and campaign state. The key name does not correspond to any legitimate Microsoft product and its placement under the trusted Microsoft branch is meant to blend in. Detection of this specific key exposes Zloader persistence and configuration storage.

Suspicious Fodhelper UAC Bypass ms-settings Command Registry Modification

This rule detects creation of the HKCU ms-settings shell open command key used to hijack fodhelper.exe for a UAC bypass, a technique used in the Ducktail PowerShell chain to gain elevation. Attackers stage a payload path in this key so that auto-elevated fodhelper executes it without a consent prompt.

Suspicious File Association Shell Command Handler Hijack via Registry

This rule detects modification of a shell open command handler under the user Classes hive, a file-association hijack SolarMarker uses to trigger its payload when a document type is opened. Redirecting the open command executes attacker code transparently. Detecting the change exposes execution-hijack persistence.

Suspicious User Shell Folders Startup Redirect for Persistence via Registry

This rule detects modification of the User Shell Folders Startup value, redirecting the startup directory to an attacker-controlled path for persistence. This registry hijack was seen in fake browser update infections chaining LummaC and Amadey. Detecting the redirect exposes a stealthy autostart mechanism outside the normal Startup folder.

Suspicious Archive Expansion into Public User Directory via PowerShell (via ps_script)

This rule detects PowerShell Expand-Archive activity that extracts content into the C users Public directory, a world-writable staging location abused by the AsyncRAT infostealer chain. Combined with the BITS download of the original archive this reveals payload unpacking prior to execution. Legitimate software rarely unpacks archives into the Public profile.

Suspicious PowerShell .NET Extraction from JPG with Base64 Marker

This rule detects PowerShell reading a jpg image and carving an embedded payload delimited by a base64 start marker. Ande Loader hid an AES encrypted .NET assembly inside a new image jpg between BASE64_START markers before hollowing AddInProcess32. Extracting executable code from an image file this way is a steganography style loader technique.

Malicious Whole-Drive Defender Exclusion via Add-MpPreference (via ps_script)

This rule detects a PowerShell command adding the entire C drive as a Microsoft Defender exclusion path via Add-MpPreference, the defense-evasion step used by the D3F@ck MaaS loader before dropping payloads. Excluding the whole system drive from scanning is never a legitimate administrative action and effectively blinds Defender. This precedes RegAsm.exe injection of Raccoon Stealer.