Sigma detection rules, expert-reviewed

Suspicious netsh Firewall Rule Masquerading as SSTP HTTP

This rule detects netsh adding a firewall rule named after the Secure Socket Tunneling Protocol, the masquerade Prometei used to allow its sqhost.exe binary through the firewall. The botnet created an inbound allow rule with an SSTP-themed name to blend its C2 access into normal-looking firewall configuration. This masqueraded rule name combined with netsh firewall additions indicates malicious network enabling.

Malicious Enabling of Test Signing Mode via bcdedit

This rule detects bcdedit enabling testsigning mode on the system, a step in the SyncFuture espionage chain to load unsigned or improperly signed drivers. The actors turned on test signing so their transplanted-signature driver components would load despite failing normal signature checks. Enabling testsigning is a rare, high-impact defense-evasion action with almost no legitimate production use.

Malicious PowerShell StreamReader WebRequest Download Cradle

This rule detects PowerShell constructing an IO.StreamReader over a Net.WebRequest response stream and executing it, the fileless NetSupport RAT ClickFix cradle. The loader used this in-memory download-and-execute technique to pull its next stage without writing a script to disk. Reflective download cradles built from StreamReader and WebRequest are almost exclusively malicious.

Suspicious PowerShell UTF8 OutputEncoding Command Wrapper

This rule detects PowerShell command lines that set OutputEncoding to a UTF8 encoding object before running an inline command, the wrapper ChaosBot used for every shell command it executed. The Rust bot prefixed all remote commands with this OutputEncoding assignment to reliably capture and exfiltrate output over Discord. While some scripts set encoding, this exact inline pattern combined with remote command execution is suspicious.

Malicious UAC Bypass via HKCU Environment windir Hijack

This rule detects reg add writing a windir value under the HKCU Environment key, the environment-variable hijack half of the SilentCleanup UAC bypass used by NightshadeC2. The botnet set windir to its payload path so an auto-elevating scheduled task would launch its code with high integrity. Poisoning the windir user environment variable is a well-known privilege-escalation technique with no legitimate use.

Suspicious Data Exfiltration via Rclone Remote Copy

This rule detects rclone-style command lines that reference a config file and copy data to a remote destination, matching the Sinobi exfiltration step. The actors ran rclone with a custom config to copy victim data to attacker-controlled cloud storage before encryption. Bulk copy to a remote target via rclone flags is a common precursor to double-extortion ransomware.

Suspicious Service binPath Hijack Followed by System Reboot

This rule detects the sc command rewriting a service binPath in the same command line that triggers shutdown /r, matching the Sinobi tactic of hijacking a security service to run a dropped binary after reboot. The actors repointed the cbdefense service to a ProgramData executable and immediately forced a restart to load it. Combining a service binary reconfiguration with a reboot is a strong indicator of persistence and defense evasion.

Malicious Account Added to Domain Admins via net localgroup

This rule detects a local user being added to the Domain Admins group using net localgroup. Sinobi operators created an account and elevated it into privileged groups including Domain Admins after abusing compromised SonicWall SSL VPN credentials. Adding a fresh account to Domain Admins is a high-confidence sign of privilege escalation and preparation for domain-wide ransomware deployment.

Malicious PowerShell Clipboard Script Execution via ScriptBlock Create

This rule detects PowerShell reading the clipboard and executing it through ScriptBlock Create, the core of the Interlock ClickFix lure. Victims were tricked into pasting a command that pipes a downloaded payload to the clipboard and then runs Get-Clipboard as a script block. This clipboard-to-execution pattern lets attackers gain code execution while hiding the real command from the user.

Suspicious rundll32 Execution of PNG File as DLL

This rule detects rundll32.exe being pointed at a file with a .png extension and a start export, which loads the image as a DLL. Interlock masqueraded its DLL payloads with .png and other benign extensions to bypass file-type inspection and defender expectations. Executing a renamed DLL through rundll32 is a defense-evasion technique used to stage the next loader stage.

Malicious Interlock LNK Execution via rundll32 ShellExec_RunDLL

This rule detects rundll32.exe invoking the shell32.dll ShellExec_RunDLL function to launch a masqueraded LNK file. The Interlock KongTuke ClickFix chain used this technique to execute a dropped shortcut as part of its multi-stage loader. Proxying execution through a signed binary lets attackers run their payload while evading application controls that trust rundll32.

Suspicious csc.exe Spawned by Document Reader for Process Injection

This rule detects the C# compiler being launched by the hpreader host process, which Ghost Crypt abuses as an injection target using a debugger-based process hypnosis technique to load PureRAT. A document reader spawning csc.exe is not expected behavior and points to code injection into a benign child process.

Malicious ClickFix MSI Download and Execution via PowerShell

This rule detects PowerShell using curl to download an MSI installer to disk, the ClickFix delivery chain used to stage DeerStealer. Victims are socially engineered into pasting a Run-dialog command that fetches and installs a malicious package, so a scripted curl download of an .msi followed by installation is a high-fidelity infection indicator.

Suspicious Miner Operator Account Creation Named samsungmid

This rule detects creation of the local account name observed in the Samsung MagicINFO cryptomining intrusion, where the attacker added a persistent account and granted it administrative and remote desktop access. Creation of this specific account name is a targeted indicator of the unauthorized mining campaign establishing persistent access.

Suspicious Active Directory Enumeration via PowerShell DirectorySearcher

This rule detects PowerShell using the DirectoryServices DirectorySearcher class to enumerate Active Directory objects, a domain reconnaissance technique used by RansomHub affiliates. Scripted LDAP searching through DirectorySearcher is rarely performed by ordinary users and commonly precedes lateral movement and privilege escalation.