Sigma detection rules, expert-reviewed

Suspicious PowerShell Download of scrss or ekrn Masquerading Scripts

This rule detects PowerShell referencing scrss.ps1 or ekrn.ps1, downloader script names used in the Gamaredon and Turla collaboration to fetch and stage further payloads. The script names imitate the legitimate csrss and ESET ekrn processes, and their presence in PowerShell activity indicates masqueraded ingress tooling and command execution.

Obfuscated Firewall Deactivation - Modern Command (via process_creation)

This rule detects disabled the Windows Firewall to evade defense.

Suspicious Encoded PowerShell Command Execution (via process_creation)

This rule detects PowerShell invoked with an encoded command payload passed through the EncodedCommand parameter. Adversaries base64-encode PowerShell to obscure their commands from casual inspection and simple content filters. While some administrative tooling encodes commands, encoded PowerShell on user endpoints is a frequent execution and obfuscation indicator worth reviewing.

Malicious DLL Sideloading of screen_retriever_plugin via TCLBANKER Loader

This rule detects the signed logiaipromptbuilder executable loading a screen_retriever_plugin DLL used to sideload the TCLBANKER banking trojan in Elastic research. Abusing a trusted host binary to load an attacker controlled DLL of this name lets the trojan execute under a legitimate process context.

Suspicious Process Injection via mavinject INJECTRUNNING

This rule detects mavinject.exe injecting a DLL into a running process via the INJECTRUNNING flag, a living-off-the-land process injection technique observed in Lancefly intrusions to load the Merdoor backdoor.

Possible Task Manager Access Indicator for Potential LSASS Dump (via process_creation)

This rule detects provides an indicator of a user accessing the task manager in order to eventually dump the LSASS process content using the "Details" tab > right click on "lsass.exe" > Create a dump file.

Suspicious Cloudflare Tunnel Masquerading as conhost.exe During Medusa Operations (via process_creation)

This rule detects a binary named conhost.exe running Cloudflare tunnel arguments, a masquerade Storm-1175 uses by renaming the cloudflared client to conhost.exe to establish covert command and control during Medusa ransomware operations. Legitimate conhost.exe never runs tunnel parameters, so this combination surfaces a disguised tunneling channel used for remote access and exfiltration.

Suspicious File Download via certutil urlcache split

This rule detects certutil downloading a file using the urlcache split -f flag combination, an ingress technique used in the ActiveMQ intrusion. Legitimate certutil usage does not combine these download flags, so this pattern reliably flags living-off-the-land payload retrieval.

Malicious WinRing0 Vulnerable Driver Load

This rule detects loading of the WinRing0 kernel driver which the BlueSky actor deployed as a bring your own vulnerable driver to tamper with protected processes and disable security controls and this matters because this signed but abusable driver grants ring zero access and its presence outside of the few legitimate hardware utilities that ship it is a strong indicator of defense evasion.

Suspicious PowerShell Remote Script Execution From GitHub via irm and iex (via process_creation)

This rule detects the multi stage Windows campaign loader running PowerShell that pipes an Invoke-RestMethod download of a raw GitHub hosted script into Invoke-Expression for fileless execution. Fetching and executing raw GitHub content in memory is a hallmark of the initial loader. Later stages disable Defender and deploy a RAT and ransomware.

SystemNightmare by GentilKiwi - New External Device Added - CVE-2021-1675 / CVE-2021-34527 (via security)

This rule detects exploit the PrintNightmare vulnerability by abusing the Windows print spooler using the service exposed by Gentilkiwi.

Suspicious Winlogon Loading Keyboard Layout DLL kbdus1.dll

This rule detects winlogon.exe loading a DLL named kbdus1.dll, a keyboard-layout persistence technique used by Backdoor.Stupig to execute code as SYSTEM at logon. The legitimate keyboard file is kbdus.dll without the trailing digit.

Suspicious SearchIndexer Outbound Network Connection after Injection

This rule detects the Windows SearchIndexer process making outbound network connections to non local addresses. SolarMarker StellarInjector injects the SolarPhantom backdoor into SearchIndexer to run hVNC and stealer traffic from a trusted host. SearchIndexer should not initiate internet connections so this indicates code injection and C2.

Suspicious COLDRIVER BAITSWITCH Execution via Rundll32 Verifyme Export (via process_creation)

This rule detects rundll32 invoking a DLL export named verifyme as used by the COLDRIVER ClickFix chain to run the BAITSWITCH loader from a remote share. Rundll32 calling this export is characteristic of the campaign.

Suspicious Installed Software Enumeration via Registry Uninstall Key Query

This rule detects recursive querying of the registry Uninstall keys via reg to enumerate installed software which the RM3 banking malware performed during host profiling as documented by NCC Group. Enumerating installed products helps operators fingerprint the victim and identify security tooling before further action.