Sigma detection rules, expert-reviewed

Malicious Windows Defender Root Exclusion via Add-MpPreference (via process_creation)

This rule detects the use of Add-MpPreference to register a broad exclusion path covering an entire drive root such as C. The D3F@ck Malware-as-a-Service loader uses this technique to disable Microsoft Defender scanning of its staging locations before dropping additional payloads. Blanket root exclusions are almost always malicious and blind the endpoint to all downstream tooling.

Suspicious Self-Delete via cmd choice Timeout and Del

This rule detects the cmd choice command used as a timing delay chained with a Del to remove the launching file. Ande Loader used a choice based countdown before deleting itself to erase the dropper after 0bj3ctivity Stealer was staged. This choice plus Del idiom is an anti forensic self cleanup pattern seen across loaders.

Suspicious Python Execution from Hidden Downloads Python Folder

This rule detects a Python interpreter running scripts out of a hidden Downloads Python directory used by the Quartet loader. The campaign staged its interpreter and payloads in concealed Downloads subfolders to persist and execute the RAT quartet. Python launched from this hidden staging path is not normal developer activity.

Suspicious DarkGate AutoIt3 Script Execution from C Test Directory

This rule detects AutoIt3 executing an a3x compiled script from a non standard root path such as C test. DarkGate used a fake reader update to run its a3x from this staging directory before process hollowing. AutoIt scripts running from an unusual top level folder are a strong DarkGate loader indicator.

Suspicious PIF Payload Assembly via copy /b Binary Concatenation

This rule detects the cmd copy command using the b binary flag to concatenate files into a pif output. An NSIS delivered Industries batch used copy /b to rebuild an AutoIt pif payload before AsyncRAT injection. Binary concatenation into a pif reassembles a split malicious executable to evade static delivery detection.

Suspicious AdsExhaust Batch Persistence in AppData wespmail Folder

This rule detects execution of backup or update batch scripts staged in an AppData Local wespmail directory. The AdsExhaust adware masquerading as the Oculus installer dropped these batch files and scheduled them for persistence. The distinctive folder and script names mark the adware footholding on the host.

Suspicious regsvr32 Registering DLL from User AppData

This rule detects regsvr32 registering a DLL located in a user AppData path. In More_eggs intrusions a WMI launched process fetched a numbered dll that regsvr32 then registered to load the backdoor. Executing DLLs from user writable directories via regsvr32 is a common proxy execution technique for staged malware.

Suspicious More_eggs ie4uinit Copy to AppData Microsoft Folder

This rule detects the signed ie4uinit binary being executed from a user AppData Microsoft folder rather than System32. More_eggs fake job applicant lures copy ie4uinit alongside an attacker written ieuinit inf to abuse its inf handling. Running the LOLBIN from the wrong path enables execution of attacker controlled directives under a trusted name.

Malicious Renamed Python Interpreter svchostc Executing Script (via process_creation)

This rule detects execution of svchostc.exe, a renamed Python interpreter used by FIN7 to run its svchostc.py loader while impersonating the legitimate Windows svchost service host. The genuine binary is svchost.exe, so the trailing character is a masquerade meant to blend into process listings. This executes the FIN7 payload staged from a spoofed brand MSIX.

Malicious FIN7 SYSTEM Scheduled Task Masquerading as Windows Updater (via process_creation)

This rule detects creation of a per-minute SYSTEM scheduled task placed under the Microsoft\Windows\Updater path, the FIN7 persistence mechanism that runs a renamed Python interpreter as SYSTEM. Nesting a custom task inside the Microsoft\Windows tree masquerades as a built-in maintenance job while the minute interval and SYSTEM context reveal malicious intent. This sustains the NetSupport RAT foothold.

Suspicious Pastebin Raw Content Retrieval via curl (via process_creation)

This rule detects curl fetching raw content from pastebin.com, the technique the D3F@ck loader batch uses to retrieve a follow-on download URL into url.txt. Pulling raw Pastebin text via curl on an endpoint is a common staging pattern for loaders and is atypical of normal user activity. This drives the loader's ingress of the 125.exe payload.

Suspicious PowerShell Spawned from PyInstaller MEI Extraction Folder (via process_creation)

This rule detects powershell.exe spawned by a process running from a PyInstaller _MEI extraction folder under the user Temp directory, matching SolarMarker's shift to PyInstaller-packed loaders. The bundled Python script decodes base64 and invokes PowerShell with a hidden window, so a PowerShell child of a _MEI process is anomalous. This stages the SolarMarker backdoor.

Suspicious Double-Extension PDF JavaScript Lure via WScript (via process_creation)

This rule detects Windows Script Host executing a file whose name uses a .pdf .js double extension, the lure format in the XWorm tax scam where Tax-docs-2023.pdf .js masquerades as a PDF. The trailing .js reveals it as a script rather than a document, and wscript execution launches the PowerShell downloader. This is the initial-execution stage of the campaign.

Suspicious VBScript Execution from Public User Directory (via process_creation)

This rule detects Windows Script Host running a VBScript dropped into the C\Users\Public directory, matching the tax-themed GuLoader chain where a .lnk uses PowerShell to save Fjoua.vbs to Public before execution. The Public folder is an atypical location for legitimate scripts and is chosen to evade per-user monitoring. This stages GuLoader to deliver the Remcos RAT.

Malicious Koi Loader Scheduled Task Masquerading as Firefox Agent (via process_creation)

This rule detects creation of a scheduled task named Firefox Default Browser Agent that launches wscript, the persistence trick used by Koi Loader to run agent.js under a legitimate-sounding Mozilla task name. The genuine Firefox task executes default-browser-agent.exe rather than a script host, so a wscript action is false context. Koi Loader is a precursor to the Koi Stealer.