Sigma detection rules, expert-reviewed

Suspicious Scheduled Task With Cyrillic Autorun Name via UNC6692

This rule detects creation of a scheduled task whose name contains the Cyrillic word for autorun. UNC6692 names its persistence task with this Cyrillic label followed by a GUID after Quick Assist based intrusion. Scheduled task names in Cyrillic on predominantly English endpoints are a strong anomaly indicating this actor.

Suspicious ClickFix PowerShell Download Cradle via TAG-150 Tradecraft

This rule detects a PowerShell download cradle that pipes a fetched script directly into Invoke-Expression using the wget alias. TAG-150 delivers its Griffin20 loader through this ClickFix one-liner that pulls and runs the next stage in memory. In-memory execution of a downloaded script is a strong indicator of fileless staging.

Malicious PowerShell Base64 Exfiltration to save.php via EKZ Stealer

This rule detects PowerShell posting data with UploadString to a save.php endpoint, the exfiltration channel used by the EKZ Stealer following Fortinet exploitation. Base64-encoded stolen data including credentials is sent to the attacker web handler. Outbound UploadString calls to a save.php target strongly indicate data theft over the C2 channel.

Malicious PowerShell Download of FortiEndpoint Patch Masquerade via EKZ Stealer

This rule detects PowerShell using WebClient DownloadFile to retrieve a payload named FortiEndpoint_Patch.exe into ProgramData. This masquerade is used after exploitation of Fortinet CVE-2026-35616 to stage the EKZ Stealer while posing as a security patch. Downloading a fake endpoint patch via PowerShell indicates active post-exploitation tooling.

Suspicious Quick Assist Remote Tool Launched by Explorer via Nimbus RAT Lure

This rule detects the Quick Assist remote assistance tool being launched from Explorer, the entry point in the Nimbus RAT campaign where actors impersonate IT support over Microsoft Teams. Attackers guide victims to start Quick Assist to gain hands-on-keyboard access before dropping the Java RAT. Because Quick Assist has legitimate support uses this warrants correlation with unexpected external sessions.

Suspicious Registry Import of Nimbus RAT Configuration via Regedit

This rule detects regedit.exe silently importing an InboxCorePro registry file, a step the Nimbus RAT uses to apply its configuration and persistence keys. The reg file is dropped alongside the Java payload in the ProgramData install directory. Automated registry imports referencing the malware family name indicate implant setup.

Malicious Nimbus RAT Java Archive Execution From ProgramData

This rule detects javaw.exe running the InboxCorePro Java archive used by the Nimbus RAT that is delivered through Microsoft Teams social engineering and Google Drive staging. The malware installs under ProgramData InboxCorePro and executes its Java payload silently. This launch confirms the Java remote access trojan is active on the endpoint.

Suspicious Delayed Expansion Command Obfuscation Building PowerShell via Amatera Stealer

This rule detects cmd.exe using delayed variable expansion to concatenate fragmented strings that reassemble the word powershell at runtime. The Amatera Stealer 4.0.2 loader splits pow and ershell across set commands to defeat static string matching before invoking an encoded PowerShell stage. This command-line obfuscation is a strong indicator of staged stealer execution.

Suspicious Scheduled Task Creation for Kong RAT Persistence

This rule detects creation of a scheduled task whose name begins with SimpleActivityScheduleTimer, a fixed prefix used by the Kong RAT for persistence in the SEO poisoning campaign. The randomized GUID suffix varies while the descriptive prefix remains constant. Scheduled tasks matching this naming scheme reestablish the implant across reboots.

Suspicious Windows Terminal Binary Masquerade From ProgramData via Axios npm Compromise

This rule detects a process named wt.exe executing from the ProgramData directory. The legitimate Windows Terminal binary ships under WindowsApps, so a wt.exe copy in ProgramData is the SILKBELL loader masquerading through the axios npm supply chain compromise. Placing a renamed payload in a trusted-sounding location evades name-based allowlisting.

Suspicious PowerShell Host and Locale Reconnaissance via MuddyWater Tsundere Botnet

This rule detects PowerShell enumerating the video controller hardware together with the installed UI culture in a single command. This combined host and locale fingerprinting is used by the MuddyWater Tsundere botnet to profile victims and filter sandboxes before staging its Ethereum-based command and control. Such reconnaissance precedes payload delivery and warrants investigation.

Suspicious node.exe Spawning tasklist Process Enumeration

This rule detects a Node.js process spawning tasklist with CSV no-header output, the process-enumeration recon used by OmniStealer to identify security tooling. The malware parsed the CSV process list to hash and match process names before attempting to terminate defenders. A node.exe parent running tasklist in this scripted format indicates automated host reconnaissance by the RAT.

Suspicious node.exe Spawning PowerShell Get-Clipboard

This rule detects a Node.js process spawning PowerShell to run Get-Clipboard, the clipboard-theft behavior of the North Korean DEV#POPPER RAT. The malware, launched from a weaponized developer repository, harvested clipboard contents to steal secrets and seed phrases. A node.exe parent invoking Get-Clipboard is a strong indicator of the DEV#POPPER collection stage.

Suspicious Disabling of WinRM Service via sc config

This rule detects the sc command setting the WinRM service start type to disabled, an impair-defenses step observed in the Prometei intrusion. Disabling WinRM reduces remote management and logging capabilities that defenders rely on during response. While admins occasionally disable WinRM, doing so alongside other malware activity is a meaningful defense-evasion signal.

Suspicious netsh Firewall Rule Masquerading as SSTP HTTP

This rule detects netsh adding a firewall rule named after the Secure Socket Tunneling Protocol, the masquerade Prometei used to allow its sqhost.exe binary through the firewall. The botnet created an inbound allow rule with an SSTP-themed name to blend its C2 access into normal-looking firewall configuration. This masqueraded rule name combined with netsh firewall additions indicates malicious network enabling.