Sigma detection rules, expert-reviewed

Suspicious FatalRAT Keylog File Creation in Windows Directory (via file_event)

This rule detects creation of the FatalRAT keylog artifact Fatal.key in the Windows directory. This behavior was observed in Operation SalmonSlalom where the backdoor recorded captured keystrokes to a fixed file for later collection. Detecting this artifact reveals credential and input capture activity on the host.

Malicious SUGARLOADER Configuration Masquerading as Safari Cache via File Event

This rule detects creation of a com.apple.safari.ck file in the Library Caches directory which is the RC4 encrypted configuration written by the SUGARLOADER stage of the KANDYKORN intrusion. The filename masquerades as a legitimate Safari cache to hide malware configuration on macOS hosts.

Malicious Ivanti EPMM Exploitation via appstore fob Endpoint (via webserver)

This rule detects requests to the Ivanti EPMM exploit endpoints under the appstore and aftstore fob paths, the access pattern used to trigger CVE-2026-1281 and CVE-2026-1340. Hitting these routes drives unauthenticated code paths that lead to JSP webshell deployment and reverse shells.

Suspicious rclone Masquerading as Avast Binary by The Gentlemen RaaS (via process_creation)

This rule detects execution of a binary named avastrclone.exe, the renamed rclone client The Gentlemen operators disguise as an Avast component to blend in while exfiltrating data over cloud storage. The masqueraded name combines a legitimate-looking brand with an untrusted tool. Detecting it exposes covert bulk exfiltration.

Suspicious UAT-8302 Scheduled Task Creation for Recon Tooling

This rule detects schtasks creating tasks named ReconLiteDebug or RunWhatPC, matching the UAT-8302 persistence that schedules its host-profiling and command tooling under recognizable task names. These campaign-specific task names betray the attacker even when the underlying payload is renamed. Presence of either scheduled task indicates UAT-8302 foothold and tasking.

OCSP Responder Auditing Settings Changed or Disabled (via security)

This rule detects would attempt to alter or disable OCSP responder auditing settings to evade detection and perform further escalation via ADCS vulnerabilities.

Suspicious PowMix Scheduled Task Launching LNK via Explorer

This rule detects creation of a scheduled task that runs explorer.exe against a shortcut file, matching the PowMix botnet persistence that fires a daily task at 11:00 to relaunch its malicious LNK through Explorer. Abusing explorer.exe to open an attacker LNK on a schedule masks the loader chain as ordinary shell activity. This persistence pattern indicates a PowMix foothold on the host.

Malicious Akira ESXi Encryptor Execution

This rule detects execution of the Akira ESXi encryptor identified by its distinctive virtual-machine targeting arguments. Akira operators ran the Linux ESXi encryptor with flags such as --stopvm --vmonly and --ep to shut down and encrypt virtual machines. These combined VM-control encryptor arguments indicate active hypervisor-level ransomware deployment against an ESXi host.

Malicious Remote XSL Script Execution via WMIC Squiblytwo Technique

This rule detects WMIC invoking a remote XSL stylesheet via the format switch which is the squiblytwo technique used by the Lazarus chain to execute attacker script content as analysed by NCC Group. Loading a remote XSL through a signed system binary evades application control and downloads code from adversary infrastructure.

Suspicious DLL Payload Dropped Under Non-Standard Assembly Directory (via file_event)

This rule detects the creation of a DLL under the non-standard C\assembly\tmp staging directory used by the DCOM Upload and Execute backdoor documented by Deep Instinct. The backdoor abuses the DCOM MSI install server to upload and load a managed assembly for remote code execution. Detecting this drop exposes lateral tool transfer before the payload is loaded into a victim process.

Malicious DeceptiveDevelopment Defender Exclusion for Coin Miner via PowerShell

This rule detects PowerShell adding Microsoft Defender exclusions for cryptomining components used by the DeceptiveDevelopment cluster after a ClickFix fake-interview lure. Attackers whitelist TsunamiClient and XMRig paths so the dropped miners run undetected, and matching this behavior surfaces active defense evasion before mining begins.

Suspicious COLDRIVER Fileless Payload Storage in Explorer CLSID DefaultIcon (via registry_set)

This rule detects registry writes storing encrypted payload data in the Explorer CLSID DefaultIcon subkey using the EnthusiastMode and QatItems values as done by the COLDRIVER SIMPLEFIX loader. Storing binary blobs in this location is a fileless evasion technique.

Suspicious Hidden Encoded PowerShell Launching Node.js Runtime

This rule detects PowerShell invoked with hidden window style and an encoded command that launches node.exe, a loader chain used by the Tsundere Node.js botnet. The malware uses powershell -WindowStyle Hidden -NoLogo -enc to decode and start its Node.js payload out of sight. Combining hidden execution and base64 encoding to bootstrap a Node runtime is a strong indicator of malicious loader activity.

Suspicious Service Registration Loading Vulnerable Driver

This rule detects registry service registration where the ImagePath points to a known vulnerable kernel driver filename which adversaries create to load an exploitable driver into the kernel during bring your own vulnerable driver attacks. Creation of a service that maps to these driver binaries indicates staging of a kernel level defense evasion or privilege escalation capability.

Suspicious tapiperf.dll Load by WMI Provider Host via Image Load

This rule detects wmiprvse.exe loading tapiperf.dll, which the Lunar toolset abuses through DLL replacement to gain execution inside a trusted Windows process. Legitimately tapiperf.dll is a TAPI performance counter library and is not loaded by the WMI provider host. This anomalous load points to DLL hijacking used for stealthy persistence and code execution.