Sigma detection rules, expert-reviewed

Suspicious Process Creation via wmic Call Create

This rule detects the wmic.exe process call create syntax used to spawn new processes, optionally against a remote host via /node. Adversaries abuse WMI to execute payloads locally and laterally while evading process-tree scrutiny. Interactive wmic process creation is uncommon in normal operations.

Suspicious Legacy at.exe Scheduled Job Creation

This rule detects use of the deprecated at.exe utility to schedule jobs. Modern Windows administration relies on schtasks, so at.exe execution is uncommon and often tied to adversary persistence or lateral movement. Its rarity in legitimate use makes it a useful hunting signal.

Suspicious Scheduled Task Creation via schtasks

This rule detects creation of scheduled tasks via schtasks.exe with the /create flag. Adversaries frequently register scheduled tasks for persistence and execution, dropping task XML under System32\Tasks. Because administrators also create tasks legitimately, this should be triaged for unexpected task names and payload paths.

Suspicious Executable Launched from PerfLogs Directory by Estate Ransomware

This rule detects executables running from the C:\PerfLogs directory, an unusual location abused by Estate Ransomware to stage the LB3 LockBit payload. PsExec deploys the binary here to evade attention on the endpoint. Execution from PerfLogs is anomalous and strongly suggests malicious staging.

Suspicious Rogue VeeamBkp Account Creation by Estate Ransomware

This rule detects creation of a rogue local account named VeeamBkp via net user, used by Estate Ransomware operators. The account impersonates a Veeam backup service identity to blend into the environment and retain access. Creation of this disguised account indicates hands-on-keyboard intrusion.

Malicious Scheduled Task Masquerading as svchost by Estate Ransomware

This rule detects creation of a scheduled task named or pointing at svchost.exe, used by Estate Ransomware for daily persistence. Naming the task after a core system process disguises the malicious autostart. A user-created task masquerading as svchost is a strong indicator of compromise.

Malicious LSASS Memory Dump via PowerShell

This rule detects PowerShell dumping the LSASS process memory to harvest credentials. During the Christmas Miracle incident the actor used PowerShell to create an LSASS memory dump for offline credential extraction. Access to LSASS memory yields plaintext and hashed credentials for lateral movement.

Malicious AppleScript Execution of curl-Fetched Shell Payload via osascript (via process_creation)

This rule detects the RustyAttr execution chain where a shell payload fetched with curl is run through osascript do shell script, a macOS technique used by Lazarus per Group-IB to launch remotely retrieved commands. Adversaries combine command substitution with AppleScript to execute downloaded scripts in memory, so this pattern surfaces hands-on payload execution.

Suspicious Rclone Data Exfiltration to Mega Cloud Storage (via process_creation)

This rule detects rclone transferring data to Mega cloud storage, the exfiltration channel used by RansomHub affiliates to stage stolen data before ransom deployment per Group-IB analysis. Adversaries abuse rclone to bulk-upload archived files to attacker-controlled cloud storage, making this a strong signal of double-extortion exfiltration.

Malicious RansomHub Encryptor Execution via amd64.exe Path and Pass Flags (via process_creation)

This rule detects the RansomHub encryptor launched as amd64.exe with the -path drive-targeting and -pass flags observed in Group-IB RansomHub RaaS intrusions. Adversaries run this binary to encrypt mounted drives across the host for impact, so catching the distinctive command line surfaces the deployment stage before encryption completes.

Suspicious High-Frequency Scheduled Task Persistence via schtasks

This rule detects creation of a scheduled task that runs on a per-minute interval via schtasks /SC MINUTE /MO. Malware bundles use this rapid re-execution schedule to guarantee their payload keeps running. A minute-cadence task is unusual for legitimate software and suggests persistence abuse.

Suspicious Copy of System mshta.exe into ProgramData by SideWinder APT

This rule detects a command copying the System32 mshta.exe binary into ProgramData, as used by SideWinder to stage a disguised HTA runner. The relocated copy is later renamed and used to execute a remote HTA payload. Copying a system LOLBin out of System32 is a hallmark of masquerading.

Malicious Renamed mshta.exe Execution by SideWinder APT

This rule detects mshta.exe being executed under a renamed binary such as ProgramData\jkli.exe by matching the original filename metadata while the on-disk name differs. SideWinder copies System32 mshta.exe to a disguised path to run a remote HTA payload. A renamed system LOLBin strongly indicates defense evasion.

Suspicious Scheduled Task Executing Binary from User-Writable Directory

This rule detects the scheduled-task engine taskeng.exe repeatedly launching binaries from user-writable directories such as ProgramData, AppData or Public. Adversaries use scheduled tasks to relaunch side-loaded payloads from these non-standard locations. Execution of tasks from writable paths is anomalous and warrants review.

Malicious DarkMe COM Object Execution via rundll32 CLSID

This rule detects rundll32.exe instantiating the DarkMe malware COM object by its hardcoded CLSID EA6FC2FF-7AE6-4534-9495-F688FEC7858C. This chain is used by actors exploiting the WinRAR CVE-2023-38831 zero-day to load GuLoader and Remcos. Executing malicious code through a COM CLSID abuses a trusted binary to evade detection.