Sigma detection rules, expert-reviewed

Suspicious Rename of Double-Extension PowerShell Script (via process_creation)

This rule detects a command shell renaming a file with a ps12x extension to a ps1 script. The DEEP#GOSU campaign linked to Kimsuky staged its PowerShell payload with this uncommon double extension before renaming and executing it.

Possible UAC Bypass via easinvoker Spawning Batch Script (via process_creation)

This rule detects the trusted Windows binary easinvoker.exe spawning a command shell running a batch script. This mock-trusted-directory DLL hijack UAC bypass was observed in the MULTI#STORM campaign to elevate and execute KDECO.bat.

Suspicious Payload Staging in ProgramData IntelDriver Folder (via file_event)

This rule detects creation of an encrypted shellcode container named boot64x.w inside an IntelDriver directory under ProgramData. The Dead#Vax campaign staged its AsyncRAT shellcode at this path before process injection.

Suspicious Fake ACPIx86 Driver File Creation (via file_event)

This rule detects creation of a driver file named ACPIx86.sys in the system drivers directory. The OBSCURE#BAT campaign dropped this fake driver, whose name imitates a legitimate Windows component, as part of its rootkit deployment.

Suspicious Keylogger Output File in Windows Themes Folder (via file_event)

This rule detects creation of a version.xml file under the Windows Themes directory. The DEEP#GOSU campaign wrote captured keystrokes and clipboard data to this path, disguising keylog output as a theme resource.

Malicious WordPress Core SQL Injection Scanner via User-Agent

This rule detects HTTP requests carrying a User-Agent string that self identifies the CVE-2026-63030 exploitation tool. Attackers probe the WordPress REST batch endpoint for a UNION based SQL injection using this distinctive automated client marker.

Suspicious PowerShell Payload Extraction from PNG Polyglot via findstr

This rule detects use of the findstr utility to extract an appended PowerShell payload from a PNG image and pipe it into PowerShell for execution. This polyglot steganography technique conceals script code after the PNG end marker so it can be recovered with a native search utility and run in memory.

Suspicious Hidden PowerShell WebClient DownloadFile Cradle

This rule detects a hidden PowerShell process using the WebClient DownloadFile method to retrieve a remote file. A crypto stealer campaign uses this cradle with a hidden window to pull a decoy document and a bundled Python runtime from cloud file hosting.

Possible DarkGate Process Injection via iTunesHelper Spawning vbc.exe

This rule detects the Apple iTunesHelper binary spawning the Visual Basic command line compiler vbc.exe. DarkGate hollows out vbc.exe as a benign looking host process to execute its final shellcode after DLL sideloading, a parent child relationship that does not occur in normal iTunes operation.

Suspicious PowerShell Download Cradle with Spoofed User-Agent via MSIX

This rule detects a PowerShell download cradle that fetches and executes remote content while presenting a spoofed browser User-Agent string. A malicious MSIX package runs an obfuscated startup script that combines Invoke-WebRequest and Invoke-Expression to pull a next stage from an attacker server.

Suspicious Renamed PowerShell Copied from System32 via Batch Loader

This rule detects a command that copies the legitimate PowerShell executable from System32 to a new filename ending in exe. A multi payload batch loader clones powershell.exe under an attacker chosen name so its hidden execution of embedded base64 payloads evades name based detection.

Possible DarkGate DLL Sideloading via iTunesHelper Loading CoreFoundation

This rule detects the signed Apple iTunesHelper binary loading a CoreFoundation DLL from a non standard directory. DarkGate abuses DLL search order hijacking by placing a malicious CoreFoundation.dll next to a legitimate Apple executable to proxy execution of its packed payload.

Malicious Registry Run Key Persistence Using Scarlet Goldfinch OFFICE and DIVXX Values (via registry_set)

This rule detects creation of HKCU Run key values named OFFICE or DIVXX, the specific autorun entries Red Canary attributed to Scarlet Goldfinch for persisting its NetSupport Manager deployment. These named values are non-standard for legitimate software, so their appearance under the CurrentVersion Run path indicates adversary persistence.

Malicious PowerShell In-Memory Download Cradle via Script Block (via ps_script)

This rule detects a PowerShell download cradle that pulls a remote payload with Net.WebClient DownloadString and pipes it directly to IEX for in-memory execution, the tmp.48 stager observed in the Confluence exploit ransomware campaign by Red Canary. This pattern fetches and runs code without touching disk and is a common loader technique across intrusions.

Malicious AWS Credential Exfiltration via Curl or Wget in Process Creation

This rule detects curl or wget command lines that reference the AWS credentials file, the exfiltration step used by malicious OpenClaw agent skills to steal cloud keys. Adversaries read the .aws/credentials file and post it to attacker infrastructure, so a web client touching this path indicates active credential access and exfiltration.