Sigma detection rules, expert-reviewed

Malicious Kong RAT Keylogger Capture File Creation

This rule detects creation of keystroke capture files under the ProgramData Kong Keylogger path used by the Kong RAT keylogging module. The malware writes intercepted keystrokes to this fixed location before exfiltration to its MPK1 command and control. This file activity confirms active credential and input harvesting.

Suspicious Non-Wallet Process Accessing Cryptocurrency Wallet Files

This rule detects a process that is not the corresponding wallet application touching Exodus, Electrum, Coinomi or Ethereum keystore wallet files. The DarkCloud infostealer enumerated these wallet directories to steal keys and seed material for cryptocurrency theft. Access to wallet storage by an unrelated process is a strong indicator of credential and asset theft.

Suspicious Non-Browser Access to Chromium Credential Stores

This rule detects a process that is not a web browser touching the Local State and Login Data files inside a Chromium User Data directory. The ShadowCoil packed Python stealer read Chrome and Edge Local State (the encrypted master key) and Login Data SQLite databases and used DPAPI CryptUnprotectData to recover saved credentials. Attackers harvest browser-stored passwords to enable follow-on account takeover and ransomware operations.

Suspicious Modification of Windows Hosts File

This rule detects writes to the Windows hosts file, which Cyber Stealer manipulates to poison DNS resolution and redirect or block traffic such as security-vendor domains. Because the hosts file is rarely changed on managed endpoints, modifications outside of controlled administration are a meaningful sign of network defense tampering.

Malicious FakeBat Distribution Domain Lookup (via dns_query)

This rule detects DNS resolution of doggygangers[.]com, the FakeBat fake-browser-update landing and statistics domain that redirects victims to a malicious MSIX installer. Contact with this host indicates exposure to the drive-by distribution chain delivering Payk RunPE and LummaC2. It marks the delivery stage of the campaign.

Suspicious Tycoon PhaaS Panel Domain Lookup (via dns_query)

This rule detects DNS resolution of ailinux.ru, the TycoonGroup Phishing-as-a-Service control panel domain associated with voicemail-themed credential phishing. Contact with this host indicates interaction with the AiTM phishing backend used to steal session cookies valid for up to a year. It surfaces credential and MFA theft infrastructure.

Malicious Fenix Botnet C2 Communication via QuantumService Domain (via dns_query)

This rule detects DNS resolution of the quantumservice.lat command-and-control infrastructure used by the Fenix botnet in LATAM campaigns impersonating the Mexican Government. The NarniaRAT and Rust-based BotnetFenix payloads beacon to app.quantumservice.lat to register infected hosts. Detecting this lookup surfaces post-exploitation C2 activity aimed at LATAM banking credential theft.

Possible Token Manipulation via NewCredentials Logon Type 9

This rule detects Windows Security event 4624 with logon type 9 NewCredentials, the telemetry produced by access token manipulation methods such as runas netonly and MakeToken described by Elastic. This logon type creates a process whose network identity differs from the local user which adversaries leverage for pass-the-hash style lateral movement. Reviewing the account process and target of these logons helps separate benign administrative use from abuse.

Possible Local Group Membership Enumeration via Security Event 4798

This rule detects Windows Security event 4798 recording enumeration of a user local group membership, generated by the net user Beacon Object File used during Cobalt Strike post-exploitation reconnaissance. Attackers enumerate account and group membership to plan privilege escalation and lateral movement. A high volume or unusual source of these events can indicate automated discovery activity.

Suspicious Kerberoasting via RC4 Service Ticket Request for MSSQLSvc SPN (via security)

This rule detects Kerberos service ticket (TGS) requests using weak RC4 encryption for MSSQLSvc service principal names, a strong indicator of Kerberoasting activity used to extract crackable service account credential material. Observed in Elastic Security Labs GOAD live malware lab telemetry where adversaries request RC4 tickets to perform offline password cracking of privileged service accounts.

Malicious TELEPUZ Service Persistence via CipherAllocator Registry Key

This rule detects creation of the CipherAllocator service registry key which TELEPUZ registers for privileged persistence after loading its DLL payload. Naming a malicious service to resemble a legitimate cryptographic component helps it hide among system services. This fixed service name is a high-confidence indicator of the MaaS foothold.

Suspicious SCMBanker Autostart Persistence via Run Key VBScript

This rule detects a Run or RunOnce autostart entry pointing at a run.vbs script which SCMBanker establishes for persistence after initial compromise. The banking-fraud toolkit relaunches its VBScript loader at logon to survive reboots. A user-hive autostart referencing a loose VBScript is a reliable persistence signal.

Malicious Run Key Persistence Pointing to Renamed PowerShell via Axios Compromise

This rule detects a CurrentVersion Run key value whose data references the renamed wt.exe interpreter or a script staged in ProgramData or TEMP as used by the Axios supply chain RAT for persistence. Attackers register the masqueraded PowerShell to re establish the implant at logon, ensuring durable access to the compromised host.

Suspicious Task Manager Disabled via DisableTaskMgr Registry Value

This rule detects the DisableTaskMgr policy value being set to 1, which blocks users from opening Task Manager. The NOVABLIGHT infostealer applies this change to hinder analysts and users from inspecting or terminating its running processes.

Suspicious Image File Execution Options Debugger Hijack

This rule detects the creation of a Debugger value under an Image File Execution Options subkey, which causes an attacker-chosen program to launch whenever the named executable runs. This technique enables both persistence and injection into a targeted process as described in the process injection survey.