Sigma detection rules, expert-reviewed

Suspicious VirtualBox Registry Artifact Anti-VM Check via Command Line

This rule detects command-line access to the VirtualBox ACPI DSDT registry artifact used to fingerprint virtual machines. StealC probes HKLM HARDWARE ACPI DSDT VBOX to decide whether it is running in a sandbox. Detecting the probe exposes evasion behavior before the stealer proceeds.

Suspicious Anti-VM WMI Thermal Zone Temperature Query via Command Line

This rule detects a WMI query against MSAcpi_ThermalZoneTemperature, an anti-VM sandbox-evasion check that fails inside most virtual machines. StealC delivered through deceptive Google Sheets uses this probe before unpacking. Detecting the query reveals evasion logic running prior to payload execution.

Suspicious Scheduled Task Creation Running VBScript for Persistence via Command Line

This rule detects creation of a scheduled task that launches a VBScript through wscript or cscript, a persistence pattern used by the AsyncRAT loader in Operation PhantomControl. Attackers register such tasks to relaunch their loader after reboot. Catching the task registration surfaces persistence establishment early in the intrusion.

Suspicious Outbound Connection from tracerpt.exe after Process Hollowing (via network_connection)

This rule detects the trace report utility tracerpt.exe initiating outbound network traffic, a behavior produced when the Winos4.0 loader hollows this System32 binary and beacons to command and control. The genuine tracerpt tool parses local event logs and does not communicate over the network. Any external connection from tracerpt indicates injected code and staging traffic.

Suspicious Outbound Network Connection from msiexec.exe (via network_connection)

This rule detects the Windows installer msiexec.exe initiating outbound network traffic, a behavior seen when Zloader injects its Cobalt Strike stager into msiexec and beacons to command and control. Under normal conditions msiexec only reaches out to fetch packages from known distribution points. Unexpected connections from an injected msiexec process indicate hollowed execution and C2 activity.

Suspicious AddInProcess32 Outbound Connection after Process Hollowing

This rule detects the dotnet AddInProcess32 utility initiating outbound network connections which is highly unusual. Ande Loader hollowed 0bj3ctivity Stealer into AddInProcess32 so its C2 and exfiltration traffic run under a signed process. External connections from this rarely used binary indicate injected stealer activity.

Suspicious microsoftedgeupdatecore Outbound Connection from Wrong Path

This rule detects a process named microsoftedgeupdatecore running outside the legitimate Microsoft Edge program folders while initiating network connections. DarkGate hollowed a process under this Edge updater name to blend its C2 traffic with normal update activity. A legitimate name in the wrong path making external connections reveals the masquerade.

Suspicious RegAsm or AppLaunch Outbound Connection after Injection

This rule detects the RegAsm or AppLaunch dotnet utilities making outbound internet connections. AsyncRAT was injected into these signed binaries so its RC4 encrypted C2 traffic originates from a trusted image. Neither utility normally reaches external hosts so outbound traffic indicates injected malware beaconing.

Suspicious DotNet Utility MSBuild RegAsm RegSvcs Network Beacon Indicating Hollowing

This rule detects MSBuild.exe, RegAsm.exe or RegSvcs.exe making an external network connection, the process hollowing targets used by Blind Eagle to run Remcos and njRAT with command and control over dynamic DNS. These .NET utilities have no reason to beacon outbound, so an external connection reveals injected remote access malware.

Suspicious SearchProtocolHost Network Connection Indicating Process Hollowing

This rule detects SearchProtocolHost.exe initiating an external network connection, behavior inconsistent with the Windows Search indexer and used by Pikabot as a process hollowing target for command and control. The indexer never reaches out to the internet, so an outbound connection from it points to injected malicious code.

Malicious MpGear.dll Side-Loading by Signed Host Binary

This rule detects the load of MpGear.dll, the malicious library side-loaded by a signed Inspection Document Review executable in the SyncFuture campaign. The DLL carried a transplanted invalid Microsoft signature and ran attacker code under a trusted signed host process. The presence of this named side-loaded module indicates active SyncFuture tradecraft.

Malicious msedge_elf.dll Side-Loading from Public Libraries

This rule detects the Edge helper library msedge_elf.dll being loaded from the C:\Users\Public\Libraries directory instead of a legitimate browser install path. ChaosBot side-loaded a malicious msedge_elf.dll through identity_helper.exe placed in Public Libraries to run its Rust payload under a trusted process. A signed Microsoft DLL name loading from a world-writable staging path is a hallmark of DLL side-loading.

Suspicious DLL Sideloading by hpreader Executable from Documents

This rule detects the hpreader host executable loading a DLL from the user Documents directory, the DLL sideloading technique used by Ghost Crypt to launch PureRAT. A signed reader binary loading a masqueraded dependency from Documents rather than its install path is highly abnormal and indicates search-order hijacking.

Suspicious DLL Sideloading via EngineX Executable

This rule detects the DeerStealer loader executable side-loading its malicious companion DLL, a DLL search-order hijacking technique that runs attacker code under a benign-looking process. Loading cmdres.dll from the EngineX host binary is characteristic of the DeerStealer execution chain and indicates active compromise.

Suspicious DynamicWrapperX dynwrapx.dll Load Enabling Script Based Injection

This rule detects loading of dynwrapx.dll, the DynamicWrapperX COM helper abused in the OnlyDcRatFans chain to let a VBScript call Windows APIs and inject RemcosRAT into winhlp32.exe. This library is rarely used by legitimate software, so its presence in a script host process points to API abuse for code injection.