Sigma detection rules, expert-reviewed

Suspicious Python Runtime Executed from ProgramData

This rule detects the windowless Python interpreter executing from within ProgramData, a technique RansomHub affiliates used after unpacking a portable Python archive to run tooling and scheduled tasks. A pythonw.exe process running from ProgramData rather than a standard installation directory is abnormal and often indicates attacker-deployed scripting.

Suspicious System Reconnaissance Output Redirected to Temp rad File

This rule detects cmd.exe running host and network reconnaissance commands with output redirected to a temporary rad file, a collection pattern used by RansomHub affiliates staging SocGholish activity. Piping discovery command results into a randomized rad.tmp file for later exfiltration is an early hands-on-keyboard indicator.

Suspicious PowerShell Download Cradle via Net.WebClient DownloadFile

This rule detects PowerShell invoking the Net.WebClient DownloadFile method, a download cradle used by KoiLoader shortcut droppers to retrieve secondary payloads. Scripted retrieval of remote files through the .NET web client is a common ingress technique for loaders and should be reviewed in context.

Malicious KoiLoader Persistence via Scheduled Task Running WScript

This rule detects the creation of a high-frequency scheduled task that launches WScript against a JavaScript file staged in ProgramData, the persistence mechanism used by KoiLoader. The one-minute recurrence combined with a script under ProgramData is characteristic of KoiLoader maintaining execution to fetch the KoiStealer payload.

Suspicious Local Account Creation Matching Hunters International Naming

This rule detects the creation of local accounts using names observed in Hunters International intrusions that masquerade as legitimate service or administrator accounts. Attackers created these accounts after exploiting a FortiOS authentication bypass to establish persistent privileged access, so this naming combined with account creation is a targeted persistence indicator.

Suspicious Data Exfiltration via rclone

This rule detects the rclone utility copying data to a remote destination, a technique Hunters International affiliates used alongside WinSCP to stage and exfiltrate victim data prior to encryption. rclone with configuration and copy flags in an enterprise environment is a strong sign of automated data theft to cloud storage.

Malicious Hunters International Ransomware Execution via rundll32

This rule detects rundll32.exe executing the Hunters International ransomware encryptor DLL through its Open export with the operator flags used to target running processes. This proxy execution technique masks the ransomware payload behind a signed Windows binary immediately before mass file encryption, making it a critical late-stage indicator.

Suspicious Scheduled Task BrowserOSR Masquerading as Google Corporation (via process_creation)

This rule detects creation of a scheduled task whose name begins with BrowserOSR and which spoofs the author field as Google Corporation, the persistence mechanism of the RedCurl EarthKapre APT. The task name encodes the victim hostname and the fake Google author disguises the entry among browser update tasks. This pairing of the BrowserOSR prefix with a forged Google author reveals the persistence.

Malicious JuicyPotatoNG Privilege Escalation Tool Execution from Public Directory (via process_creation)

This rule detects execution of the JuicyPotatoNG privilege escalation tool, including from the world-writable C users Public directory used as a drop location in the Telerik exploitation intrusion. The attacker stages tooling such as JuicyPotatoNG and helper batch scripts in Public before abusing token privileges to elevate. Presence of this named tool indicates hands-on privilege escalation activity.

Suspicious mshta or wscript Spawned by Explorer via ClickFix Run Dialog (via process_creation)

This rule detects mshta.exe or wscript.exe being launched directly by explorer.exe, the signature of the ClickFix social engineering technique where the victim pastes a malicious command into the Windows Run dialog. Lumma Stealer uses this flow to execute its loader without a downloaded file on disk. A script host started from explorer through the Run prompt is unusual and warrants inspection.

Suspicious Script Host Launching PowerShell from Fattura Named JScript File (via process_creation)

This rule detects wscript or cscript executing a JScript file using the Fattura naming convention and then spawning PowerShell, the first stage of the MintsLoader delivery chain. The Italian themed Fattura invoice lure drops a .js file that calls WScript Shell Run to launch an obfuscated PowerShell downloader. This script host to PowerShell handoff from an invoice named file marks the loader kickoff.

Malicious Python Execution from Hidden .pyp Directory in Lazarus InvisibleFerret Chain (via process_creation)

This rule detects the Python interpreter running from a hidden .pyp folder inside a user profile, the staging location used by the Lazarus BeaverTail and InvisibleFerret campaign to launch its backdoor and stealer components. The dot-prefixed directory hides a private Python runtime that then executes payloads such as the .sysinfo module. Running python from such a concealed per-user path is not legitimate.

Suspicious rnpkeys Execution from AppData for DLL Side-Loading (via process_creation)

This rule detects the legitimate RNP key utility rnpkeys.exe running from a user AppData Roaming path, where LummaC2 side-loads a malicious rnp.dll to gain execution. The signed binary is relocated into a fake application folder so its adjacent DLL is loaded instead of the genuine library. Execution of this developer tool from a user writable profile directory is highly abnormal.

Suspicious RegAsm Execution Spawned by Script Host for Process Hollowing (via process_creation)

This rule detects the .NET RegAsm utility being launched by a script host or PowerShell, a pattern used by AsyncRAT to hollow the trusted RegAsm.exe process with the NewPE2 injector. RegAsm is a developer registration tool and is not normally started by wscript, cscript, mshta or powershell. This parent-child relationship exposes the injection target used to run the final RAT payload.

Suspicious Virtual Machine Detection via WMI Win32_Process Query (via process_creation)

This rule detects sandbox and virtual machine evasion where a process enumerates running processes through the Win32_Process WMI class while looking for virtualization service binaries such as VboxService.exe or Vmtoolsd.exe. The D3F@ck loader performs this check to abort execution inside analysis environments. Such targeted VM discovery is a strong indicator of evasive malware.