Sigma detection rules, expert-reviewed

Malicious Zardoor Backdoor Execution via rundll32 (via process_creation)

This rule detects rundll32.exe invoking the MainEntry export of zar32.dll or zor32.dll, the core execution modules of the Zardoor backdoor. These components provide command-and-control and reverse-proxy capability during long-term espionage operations.

Malicious Service Creation Masquerading as nslookup (via process_creation)

This rule detects creation of a Windows service whose binary is named nsIookup.exe, a homoglyph masquerade of nslookup used by Lazarus for persistence in Operation Blacksmith. Naming the service payload after a trusted networking tool helps it evade casual review.

Volume Shadow Copy Deletion via vssadmin or wmic

This rule detects deletion of Volume Shadow Copies through vssadmin or wmic, an anti-recovery step performed by Phobos ransomware deployed by the 8Base group. Removing shadow copies prevents victims from restoring encrypted files without paying. This inhibit-recovery behavior almost always precedes or accompanies ransomware encryption.

Malicious Inhibit System Recovery via Backup and Shadow Copy Deletion (via process_creation)

This rule detects deletion of volume shadow copies and backup catalogs and disabling of recovery via native tools, a destructive precursor observed in Phobos ransomware affiliate activity. Removing recovery options prevents victims from restoring data without paying, increasing the impact of the subsequent encryption.

Explorer WebDAV UNC Download Using At-Port Syntax

This rule detects explorer.exe launched with a UNC path that embeds an HTTP port using the WebDAV at-port syntax such as \\\\host@80\\. Qakbot-affiliated actors distributing Ransom Knight abused LNK files to run explorer against a remote WebDAV share like 89.23.96.203@80 to fetch information.exe. This at-port UNC form is a hallmark of WebDAV-based payload retrieval and rarely appears in legitimate use.

Interactive Service Creation Executing cmd via sc.exe

This rule detects use of sc.exe to create a service whose binary path launches cmd with an interactive start command. Lazarus created a service named WindowsNotification with an interactive binpath of cmd /K start to execute QuiteRAT. Registering a service that spawns an interactive command shell is a persistence and privilege abuse technique rarely seen in legitimate administration.

Curl Downloading Executable to Public User Directory

This rule detects curl.exe fetching a remote file and writing an executable into the C:\\Users\\Public directory. Lazarus operators used curl to download a payload as notify.exe into the public user folder after exploiting a ManageEngine vulnerability. Staging a downloaded binary in a world-writable public path is a common precursor to persistence and execution.

Suspicious svchost.exe Execution From AppData Roaming Directory

This rule detects svchost.exe running from a user AppData Roaming path instead of the System32 directory. The customized Yashma ransomware dropped a malicious svchost.exe copy into %AppData%\\Roaming to masquerade as the legitimate Windows service host. Attackers abuse this trusted name and wrong path to blend malicious execution into normal process activity and evade defenders.

Malicious Self-Signed TLS Certificate With Exploit Subject via Zeek X509

This rule detects TLS certificates whose subject or issuer contains the literal exploit organizational value used by the self-signed certificate in the UAT-7810 ORB-network campaign reported by Cisco Talos. The DOGLEASH and LONGLEASH implants wrap their reverse-shell and proxy traffic in this hardcoded certificate. Matching the certificate subject reveals encrypted command-and-control channels regardless of the rotating C2 IP addresses.

Malicious StyleSmuggler (CVE-2026-75650) Web Shell Dropped In Magento Product Image Cache (via file_event)

Detects creation of a PHP web shell under the Magento product image cache using the ss_<10hex>/sync_<10hex>.php naming pattern. The web shell was dropped by a second threat actor observed exploiting StyleSmuggler (CVE-2026-75650), separate from the operator deploying the Rust implant. The shell returns 404 unless the request carries the expected X-Cache-Token header and executes arbitrary PHP supplied in the task parameter.

Malicious StyleSmuggler (CVE-2026-75650) Post-Exploitation Implant Process (via process_creation)

Detects execution of the Rust backdoor deployed on Magento and Adobe Commerce servers after successful exploitation of StyleSmuggler (CVE-2026-75650). The implant masquerades as a kernel thread ([kworker/u:8:0]) or as legitimate system binaries (fc-cache, chronyd, gvfsd-user) running from temporary or hidden home-directory paths. Kernel threads are never created through exec, so a kworker-like command line in a process creation event indicates masquerading; genuine fc-cache and chronyd binaries do not run from these paths.

Suspicious Network Connection From wabmig.exe (Turian Injection)

This rule detects the Windows Contacts import utility wabmig.exe initiating outbound network connections. The Turian backdoor injects into wabmig.exe, an application with no legitimate need for network communication, to mask its command-and-control traffic. Outbound connections from this process strongly indicate process injection and active C2.

Malicious Evilginx AiTM Phishing Proxy Default TLS Certificate

This rule detects TLS certificates carrying the Evilginx default issuer strings Evilginx Signature Trust Co. or Evilginx Super-Evil Root CA. These constants are baked into the Evilginx reverse-proxy adversary-in-the-middle framework used in this MFA-bypass phishing campaign to relay victim sessions, so observing them indicates an active AiTM proxy harvesting credentials and session cookies.

Suspicious LucidRook DismCore.dll Side-Load into Browser Process

This rule detects the DISM component DismCore.dll being loaded by msedge.exe, matching the LucidRook side-loading chain where a renamed DISM host loads a trojanized DismCore.dll. Microsoft Edge has no legitimate reason to load DISM servicing libraries, so this pairing reveals DLL search-order hijacking. The load indicates the LucidRook implant is being activated.

Malicious BadIIS Module Load into IIS Worker Process by UAT-8099

This rule detects the IIS worker process loading one of the BadIIS native module DLLs used by UAT-8099. The actor deploys modules such as iis32.dll and iis64.dll to passively backdoor Internet-facing web servers. A worker process loading these attacker-specific DLLs indicates a malicious IIS module is active.