Sigma detection rules, expert-reviewed

Suspicious Run Key Persistence With Masqueraded System Binary by Millenium RAT (via registry_set)

This rule detects a CurrentVersion Run key pointing to a binary named svchost.exe or MsEdgeUpdate.exe located under a user-writable AppData, Temp, or Public path, matching the Millenium RAT persistence and masquerading technique. Legitimate copies of these binaries never run from those locations, so the wrong path plus a trusted name is a strong tell. Detecting it exposes RAT persistence.

Suspicious Autostart Persistence via Run Key Pointing Outside Program Files (via registry_set)

This rule detects creation or modification of a Run or RunOnce registry value whose data points to an executable outside the Program Files directories, a persistence-hunting heuristic from Group-IB Hunting Rituals. Adversaries register autostart entries that launch payloads from user-writable locations to survive reboot, so Run values referencing non-standard paths warrant review.

Suspicious Modification of Service ImagePath or ServiceDll

This rule detects modification of a service ImagePath or ServiceDll value in the registry. Adversaries alter these values to hijack existing services or point them at malicious binaries for persistence and SYSTEM-level execution. Review changes for unsigned or unusual target paths, as legitimate updates also touch these keys.

Malicious Windows Defender Real-Time Protection Disabled via Registry

This rule detects registry modifications that disable Windows Defender real-time and behavior monitoring. Bundled malware sets DisableRealtimeMonitoring and DisableBehaviorMonitoring to one to blind the built-in antivirus. Turning off protection precedes deployment of stealers and remote access payloads.

Suspicious Logon Script Persistence via UserInitMprLogonScript

This rule detects a value written to the UserInitMprLogonScript key which the Dark Pink APT abuses together with forfiles.exe to autorun a payload at every user logon. This environment key is almost never set legitimately so its modification is a strong persistence signal. It is important because logon script persistence survives reboots and is frequently overlooked.

Malicious Winlogon Shell Hijack Loading MSBuild

This rule detects the Winlogon Shell value being altered to reference MSBuild which the Dark Pink APT uses to persist and proxy execute code at logon through a trusted developer binary. The Shell key should only launch explorer.exe so any MSBuild reference signals abuse. It matters because it combines stealthy persistence with signed binary proxy execution.

Suspicious RunOnce Persistence Relaunching Payload with Safe Mode Flag

This rule detects a RunOnce registry value configured to relaunch a binary with a safe mode argument which BlackMatter ransomware sets to resume encryption after rebooting the host into Safe Mode. Running in Safe Mode disables security tooling while the RunOnce entry guarantees the payload restarts. It is important because this combination signals an in-progress ransomware detonation.

Suspicious HTTP Beacon with Java Agent User-Agent (via proxy)

This rule detects outbound HTTP requests carrying the anomalous Java/Agent User-Agent string associated with the Group-IB XMRig covert Linux PAM abuse campaign command and control channel. The value mimics a legitimate Java runtime User-Agent but is malformed and specific to the tooling. Flagging this string helps surface miner command and control or payload retrieval traffic on the network.

Suspicious AdaptixC2 Beacon Status Request by JadeProx TriBack Loader (via proxy)

This rule detects HTTP POST requests to the AdaptixC2 status endpoint used by the JadeProx TriBack loader for command-and-control beaconing, distinguished by the X-Beacon-Id header on the api/v1/status path. The framework tags each implant with a beacon id in that header. Detecting the endpoint and beacon header exposes AdaptixC2 command-and-control traffic.

Malicious RedHook Android RAT C2 REST Endpoint Access (via proxy)

This rule detects HTTP requests to the RedHook Android RAT command-and-control REST endpoints addDevicePassword and addsKeyboardInput used to upload stolen device credentials and keylogged input. These distinctive server paths identify infected mobile devices beaconing to attacker infrastructure. Detection reveals active data theft from compromised Android hosts.

Suspicious Telegram Bot API getUpdates Polling for C2 by Millenium RAT (via proxy)

This rule detects requests to the Telegram Bot API getUpdates method, the command-and-control channel Millenium RAT uses to poll operator instructions through api.telegram.org. Abusing Telegram bot infrastructure lets the RAT blend C2 traffic with legitimate services. Repeated polling from workstation processes warrants investigation.

Malicious Phishing Data Exfiltration to SheetBest API by GitBait Campaign (via proxy)

This rule detects HTTP POST requests to the api.sheetbest.com sheets endpoint used by the GitBait phishing campaign to exfiltrate stolen banking credentials from GitHub Pages lures. The campaign abuses the SheetBest Google Sheets API as a low-cost data drop for harvested victim data. Detecting these calls surfaces active credential exfiltration.

Malicious GTFire Phishing Credential Exfiltration to All-in-1.php Backend (via proxy)

This rule detects credential-harvesting requests to the GTFire phishing backend script All-in-1.php carrying the user and pass parameters used to capture victim logins, as documented by Group-IB. Adversaries transmit stolen credentials to this fixed backend URI over HTTP, so requests matching the path and parameter structure indicate active credential theft.

Possible GoldFactory GoldPickaxe Mobile Trojan C2 API Calls

This rule detects requests to the GoldFactory API paths such as savevideo2 savesms getfrpconfig and getBPackageUrl which the GoldPickaxe and GoldDigger mobile trojans use for command and control. These endpoints exfiltrate victim facial video, SMS messages and fetch reverse proxy configuration. Detecting them exposes devices harvesting biometric and financial data for the operators.

Possible Godfather Android Banking Trojan C2 Endpoints

This rule detects HTTP requests to the fafa.php sender_new.php and mp4_recorder.php endpoints which are the command and control and data collection URIs of the Godfather Android banking trojan. These paths deliver injection targets and receive stolen credentials, SMS and screen recordings. Detecting them on the network surfaces infected devices communicating with Godfather infrastructure.