Sigma detection rules, expert-reviewed

Suspicious CloudZ RAT Loader Execution via regasm.exe LOLBin

This rule detects the regasm.exe LOLBin executing against content staged under ProgramData, matching the CloudZ RAT which abuses regasm to load a dropped .NET assembly outside developer workflows. Legitimate use of regasm operates on assemblies in build or install directories, not ProgramData staging folders. Execution from this location signals proxied malicious code loading.

Suspicious PowerShell Execution via SyncAppvPublishingServer LOLBIN

This rule detects abuse of the signed SyncAppvPublishingServer.vbs script to proxy execution of PowerShell, a technique used in the GuLoader to Remcos infection chain. The LNK lure invokes this LOLBIN to run obfuscated PowerShell that stages shellcode. Detecting the script use surfaces the proxied execution step of the chain.

Uncommon File Download via Uncommon LOLBIN (via process_creation)

This rule detects file-download abuse of lesser-known living-off-the-land binaries such as certreq -Post, desktopimgdownldr lockscreenurl and finger, which retrieve remote content while blending into signed Windows tooling. Ingress tool transfer via LOLBINs is a technique tracked in the Red Canary Threat Detection Report. Detecting these invocations surfaces payload retrieval that evades naive download monitoring.

Suspicious Code Compilation via Aspnet_compiler LOLBIN (via process_creation)

This rule detects aspnet_compiler.exe being executed to compile and run arbitrary code, a signed-binary proxy technique used by AsyncRAT and similar tooling to build a payload in place while evading application allowlisting. Aspnet_compiler abuse is a defense-evasion technique in the Red Canary Threat Detection Report. Detecting this rarely-interactive binary surfaces trusted-utility code execution.

Suspicious DLL Execution via Odbcconf LOLBIN (via process_creation)

This rule detects odbcconf.exe registering or executing a DLL through its regsvr action or a response file, a signed-binary proxy technique used to run attacker code past application allowlisting. Odbcconf abuse has appeared in Raspberry Robin activity profiled in the Red Canary Threat Detection Report. Detecting these invocations surfaces trusted-binary DLL execution.

Suspicious Code Execution via InstallUtil LOLBIN (via process_creation)

This rule detects InstallUtil.exe run with uninstall or log-suppression flags used to trigger attacker code in a .NET assembly's Uninstall method while avoiding console output, a signed-binary proxy technique. InstallUtil abuse is a defense-evasion technique tracked in the Red Canary Threat Detection Report. Detecting these command lines surfaces code execution under a trusted Microsoft utility.

Malicious Command Injection via SyncAppvPublishingServer VBS LOLBin (via process_creation)

This rule detects abuse of the SyncAppvPublishingServer.vbs living-off-the-land script to inject PowerShell after a semicolon separator, the ClickFix delivery behavior ClearFake uses to launch a hidden PowerShell downloader from a clipboard-pasted Run command. Adversaries proxy execution through this signed script to evade script-host controls, making early detection critical for catching the infection at the first execution stage.

Malicious regsvcs LOLBin Loading Ransomware DLL from UNC Path

This rule detects the regsvcs.exe living-off-the-land binary being used to load and install a DLL from a UNC network path, matching SafePay ransomware deployment via regsvcs proxy execution. Attackers abuse regsvcs to run their encryptor DLL while bypassing application controls. Loading a DLL over UNC through regsvcs is not a legitimate developer workflow.

Suspicious Payload Retrieval from Cloudflare Tunnel via LOLBin (via process_creation)

This rule detects Windows script and download utilities referencing a trycloudflare.com tunnel hostname on their command line, an infrastructure pattern used by PythonRatLoader to stage batch, WebDAV and Python payloads. Cloudflare quick tunnels are occasionally used by developers so context should be reviewed.

Suspicious TALONITE Certutil LOLBIN Decode and Download Abuse (via process_creation)

This rule detects certutil.exe invoked with decode, URL cache, or verifyctl arguments used to deobfuscate or download payloads. TALONITE abuses certutil as a living-off-the-land binary to decode staged content and retrieve additional tooling during intrusions. Certutil used for file decoding or remote fetch outside certificate management is a common defense-evasion and delivery technique.

Suspicious sLoad Payload Download via BITSAdmin LOLBin Transfer (via process_creation)

This rule detects bitsadmin.exe transferring a file from a remote HTTP location, the living-off-the-land download technique used by the sLoad downloader to stage banking-malware payloads in the drIBAN fraud operation. Adversaries abuse the Background Intelligent Transfer Service through bitsadmin to retrieve second-stage code under a trusted Windows utility while evading download controls, making early detection critical for catching delivery before Ramnit is deployed.

Suspicious Data Exfiltration via Finger LOLBIN

This rule detects execution of finger.exe, a rarely used legacy binary abused as a living-off-the-land channel for data exfiltration and remote content retrieval. It was catalogued among data-exfiltration LOLBIN binaries. Any finger.exe execution in modern environments is anomalous and warrants review.

Suspicious Download LOLBIN Spawned by ScreenConnect Client

This rule detects the ScreenConnect client service spawning download utilities such as bitsadmin or PowerShell which is the payload retrieval chain that dropped KrustyLoader after a ScreenConnect exploit as described by WithSecure. Remote monitoring tools launching download LOLBINs shortly after exploitation frequently indicates ingress tool transfer of a second stage.

Suspicious PowerShell Spawning .NET LOLBIN (via process_creation)

This rule detects PowerShell spawning uncommon .NET framework utilities used as living-off-the-land execution proxies. The Veil#Drop loader cascaded through these binaries as fallback execution paths for its payload.

Malicious more_eggs LOLBIN Scriptlet Execution via ie4uinit BaseSettings Abuse (via process_creation)

This rule detects the ie4uinit LOLBIN being run with the -basesettings flag from a user-writable location such as AppData, the first-stage technique in the more_eggs TA4557 resume-lure intrusion where a copied ie4uinit loaded a malicious SCT through a planted ieuinit.inf. Adversaries relocate this signed binary to abuse its inf-driven command execution while evading path-based controls, so an out-of-System32 ie4uinit with -basesettings indicates staged code execution.