Sigma detection rules, expert-reviewed

Masquerading Machine-Like Local Admin Account Creation Ending With Dollar Sign (via process_creation)

This rule detects creation of a local account whose name ends with a dollar sign, a masquerading technique from the Truesec intrusion where operators created admin accounts mimicking machine accounts to blend into directory listings. Adversaries use dollar-suffixed names to hide backdoor accounts, making creation of such an account a focused persistence indicator.

Suspicious PowerShell Download to Public Libraries Folder (via process_creation)

This rule detects PowerShell using Invoke-WebRequest to download payloads into the Public Libraries staging directory. This behavior was observed in the MULTI#STORM campaign delivering Warzone and Quasar RAT payloads.

Malicious Veeam Credential Extraction via sqlcmd (via process_creation)

This rule detects use of sqlcmd to query the VeeamBackup Credentials table directly from the backup database. Akira ransomware operators extracted stored Veeam credentials this way to move laterally and destroy backups before encryption.

Suspicious Recursive icacls Grant of Full Access to Everyone via process_creation

This rule detects icacls granting the Everyone group full control over a directory tree recursively and quietly, a technique used by WannaCry ransomware to keep its dropped files accessible. The /T /C /Q flags silently apply permissions across all subdirectories. While administrators may occasionally adjust permissions this exact combination is strongly associated with malware staging.

Malicious Windows Defender Exclusion of Drive Roots via Add-MpPreference (via process_creation)

This rule detects a PowerShell Add-MpPreference command adding whole drive roots as Windows Defender scan exclusions, an impairment step the 8220 Gang cryptomining campaign runs before dropping miner payloads. Excluding entire drives blinds antivirus across the system. Detecting broad exclusion-path additions surfaces defense evasion that precedes cryptominer deployment.

Suspicious Aimmy Cheat Loader Executing Renamed LuaJIT Launcher via process_creation

This rule detects the trojanized Aimmy game cheat that uses Aimmy.bat to launch AimmyLauncher.exe, a renamed LuaJIT interpreter which executes malicious Lua bytecode. The threat abuses a signed scripting engine to run attacker supplied Lua while posing as a gaming aimbot. Flagging the batch launcher and the renamed interpreter surfaces the living off scripting execution chain before the bytecode payload runs.

Malicious Active Directory Database Backup via wbadmin to Loopback Admin Share (via process_creation)

This rule detects wbadmin backing up the NTDS database and registry hives while including ntds.dit in the target set, the domain credential-theft technique used in the Akira intrusion to copy the directory database via a loopback admin share. Adversaries abuse wbadmin to snapshot ntds.dit and the SYSTEM and SECURITY hives for offline hash extraction, so a wbadmin job referencing ntds.dit is a high-confidence dumping indicator.

Suspicious Font File Passed as Argument to Script Interpreter via Lua Loader (via process_creation)

This rule detects the TTF Trap loader in which a WScript or CScript host launches a bundled Lua or AutoIt interpreter and passes a file with a .ttf extension as the script to execute. Legitimate font files are never executed as interpreter scripts. This masquerade of a loader script as a font is characteristic of the campaign.

Malicious Impacket WMIExec ADMIN Share Output Redirection

This rule detects the Impacket wmiexec pattern where a command is executed through WMI and its output is redirected to the local ADMIN$ share on 127.0.0.1. The BlackJack group used WMIExec for remote command execution during lateral movement, and this loopback ADMIN$ redirection is characteristic of the tool.

Suspicious SafeBoot RunOnce Persistence for Safe Mode Encryption by RA World

This rule detects registry additions creating a RunOnce entry under the SafeBoot key, a technique the RA World ransomware group uses to force execution after rebooting the host into safe mode where security tooling is inactive. Encrypting in safe mode evades endpoint defenses that do not load there. Detecting this configuration exposes preparation for defense-evasive ransomware execution.

Malicious Salat Stealer Microsoft Defender Disable via Multiple Set-MpPreference Flags (via process_creation)

This rule detects PowerShell invoking Set-MpPreference with the behavior, real-time, or script-scanning disable flags used by the Salat Stealer Rust loader to turn off Microsoft Defender protections before deploying its payload. Adversaries leverage this to blind endpoint protection ahead of credential theft and exfiltration, making early detection critical for stopping the intrusion.

SmartLoader Execution via LuaJIT Interpreter Running Obfuscated Text Script (via process_creation)

This rule detects a renamed LuaJIT interpreter named compiler.exe executing a gc.txt script, the SmartLoader stage delivered through fake AI tools targeting developers. The malware ships lua51.dll and compiler.exe alongside gc.txt so a trusted-looking binary runs an obfuscated Lua payload from a plain text file, making this pairing a reliable loader signal before infostealer retrieval.

Suspicious Larva-24009 Scheduled Task Masquerading as Google Update or Intel Driver (via process_creation)

This rule detects schtasks creation of persistence tasks whose names impersonate legitimate Google update or Intel Ethernet driver tasks as used by the Larva-24009 phishing campaign. Attackers reuse trusted task naming to blend malicious persistence with normal scheduled jobs.

Suspicious Gh0stGambit Run Key Persistence for Phone Executable

This rule detects a Run key value named Phone pointing at a Phone executable being written for persistence. The Gh0stGambit dropper set this autorun entry to relaunch its payload across reboots. Autorun persistence under this specific value and image name maps to the Gh0st RAT deployment chain.

Malicious Event Log Cleared - Native (via security, system)

This rule detects cleared the event logs.