Sigma detection rules, expert-reviewed

Suspicious PowerShell Spawned by VBScript for RMM Delivery

This rule detects wscript.exe spawning a PowerShell process that skips the user profile, the delivery chain of the 46-country RMM phishing campaign that fetches and installs remote-access tools. A script-host parent driving profile-skipping PowerShell is characteristic of malicious RMM deployment.

Suspicious Banana RAT UAC Skip Environment Variable in PowerShell

This rule detects the MSEDGE_SKIP_UAC environment variable being set within a PowerShell command line, a marker used by Banana RAT during staging to bypass user prompts. This variable is not used by legitimate Microsoft Edge update processes.

Suspicious PowerShell Loading Fake Edge Update Script

This rule detects a PowerShell process that reads and invokes a msedgeupdate.txt payload, the staging technique used by Banana RAT to masquerade as a Microsoft Edge updater. Loading a text file from disk through PowerShell is a strong loader indicator when tied to this filename.

Suspicious JScript.NET Compiler Spawned by AutoIt for Process Hollowing

This rule detects jsc.exe being launched by AutoIt3.exe, a chain used by CastleLoader to create a suspended JScript.NET compiler process that is later hollowed with an injected PE. A jsc.exe process spawned from AutoIt3 is highly unusual in benign environments.

Suspicious AutoIt3 Compiled Script Execution via A3X File

This rule detects AutoIt3.exe executing a compiled .a3x script, a technique used by CastleLoader to run obfuscated AutoIt payloads dropped by an Inno Setup installer. Compiled AutoIt scripts are commonly abused by loaders to stage further code injection.

Suspicious Masquerading Python Interpreter csshost Executing Script

This rule detects a renamed Python interpreter named csshost.exe executing a Python script, a masquerading technique used by PyLangGhost RAT to hide its stealer logic behind a system-looking process name. The legitimate Python binary is copied and renamed to blend in.

Suspicious Interlock Fake Updater Executable Execution

This rule detects execution of Interlock loader binaries named with the upd_ prefix, dropped by fake browser and Teams updater phishing pages. This naming convention is used by Interlock to disguise its payloads as software updates.

Suspicious Hidden PowerShell Executing Substring of Dropped File

This rule detects a hidden PowerShell process that reads a dropped file with Get-Content, extracts a substring, and invokes it as code, matching the AZORult fileless loader stage. Reading an oddly named data file and executing a slice of it is characteristic of obfuscated PowerShell stagers.

Malicious PureMiner Persistence Executable in AppData HResult Folder

This rule detects execution of TypeId.exe from an AppData Roaming HResult directory, the persistence location used by PureMiner to launch its XMRig-based cryptominer at startup. This path and filename combination is specific to the Pure malware family.

Suspicious Outbound Connection From CasPol Binary

This rule detects the .NET CasPol.exe binary establishing outbound network connections, behavior consistent with the XWorm LATAM campaign hollowing CasPol to beacon to its C2. CasPol has no legitimate need for network communication.

Suspicious shfolder.dll Sideloading via VMware net-service Binary

This rule detects the VMware net-service.exe binary loading shfolder.dll from outside the System directory, the DLL search-order hijack abused by Gh0stBins RAT to run its loader. Legitimate shfolder.dll is loaded from System32, so a load from the application folder indicates sideloading.

Malicious Interlock Credential Stealer Output File

This rule detects creation of chrgetpdsi.txt, the file used by the Interlock ransomware credential stealer to store harvested browser credentials. This filename is a unique host-based indicator of Interlock stealer activity.

Suspicious WDigest UseLogonCredential Enablement for Plaintext Credential Theft (via registry_set)

This rule detects setting the WDigest UseLogonCredential value which forces Windows to cache plaintext credentials in memory as observed in the SoftEther VPN intrusion. Enabling this value is a credential access preparation step ahead of memory dumping.

Suspicious PebbleDash C2 Configuration Stored Under WMI Security Key (via registry_set)

This rule detects writes to the HKLM SYSTEM CurrentControlSet Control WMI Security value with the GUID used by the Kimsuky PebbleDash backdoor to store its encrypted command and control address. This registry location is not normally written by user applications.

Malicious Invoke-WMIExec Lateral Movement Download and Execute (via ps_script)

This rule detects a PowerShell one liner that downloads Invoke-WMIExec via a web client and executes it against a remote target using a pass the hash argument as observed in the MeshAgent and SuperShell intrusion. This chains in memory script download with WMI based lateral movement.