Sigma detection rules, expert-reviewed

Suspicious CurKeep Backdoor C2 API Endpoints (via proxy)

This rule detects web requests to the shell and file API endpoints used by the CurKeep backdoor for command-and-control in the Stayin Alive campaign. The fixed api shell and api file URI paths reflect the backdoor tasking channel and help surface implant traffic in proxy logs.

Malicious PowerShell Masquerading as wt.exe in ProgramData via Axios npm Compromise (via process_creation)

This rule detects a PowerShell binary renamed to wt.exe and executed from ProgramData, a masquerading technique used by the malicious postinstall payload delivered through the compromised Axios npm package. Adversaries rename PowerShell to evade name-based detection while running follow-on scripts, so a PowerShell OriginalFileName under a wt.exe in ProgramData is a strong indicator of the supply chain implant.

Suspicious WScript Spawning PowerShell From VBS Loader via wscript.exe (via process_creation)

This rule detects wscript.exe launching powershell.exe, a script host chain used by the Kimsuky campaign against Japanese organizations where a malicious VBS decoded and executed PowerShell payloads. Attackers rely on this living-off-the-land chain to stage keylogging and infostealer functionality while evading direct execution of binaries.

Malicious DLL Sideload from Public Music Directory

This rule detects loading of package.dll from the C Users Public Music directory used for DLL sideloading. This behavior matches Ivanti CVE-2025-0282 post-exploitation where operators staged package.dll in a public path to be sideloaded by a signed host process. DLLs loaded from world-writable public folders are a hallmark of sideloading based defense evasion.

Malicious Windows Defender Disable via Set-MpPreference

This rule detects Set-MpPreference being invoked to disable Microsoft Defender protection features which the Dark Pink APT uses to blind endpoint defenses before deploying its tooling. Turning off real time monitoring and scanning lets subsequent payloads run unimpeded. It is important because tampering with Defender is an early and deliberate defense evasion step.

Suspicious PowerShell Downloader Spawned by Batch Script (via process_creation)

This rule detects a batch script spawning PowerShell to download further payloads as seen in the ScarletStealer installation chain where install.bat pulls additional stealer components from an attacker server.

Suspicious Python Inline Exec Execution in STARKVEIL Chain

This rule detects the Python interpreter executing an inline exec statement passed on the command line, matching the STARKVEIL dropper chain that pivots through py.exe to decode and run staged code from fake AI-themed websites. Attackers use this living-off-the-land step to run obfuscated loaders and deploy the XWORM and FROSTRIFT backdoors.

Malicious Cryptominer Masquerading as Kubernetes pause Container

This rule detects execution of a binary named pause from the /var/tmp directory. Wiz Research observed the DERO cryptojacking campaign disguising its miner as the legitimate Kubernetes pause container while writing it to /var/tmp, so this wrong path plus trusted name combination indicates masquerading and resource hijacking.

Suspicious PowerShell Spawned by Windows Script Host from HTML Smuggling (via process_creation)

This rule detects PowerShell launched by wscript or cscript, matching the IcedID chain where HTML smuggling dropped a Windows Script File that ran VBScript and then PowerShell. The PowerShell stage downloaded and executed the IcedID loader.

Suspicious Hidden Executable Launched from Mounted Image via Shortcut (via process_creation)

This rule detects a shortcut-launched executable running with a hidden or minimized window from a non-system drive letter that typically corresponds to a mounted image. EnvyScout ships an NV.lnk shortcut that silently starts the hidden BOOM.exe from the mounted NV folder after the victim opens the ISO. Hidden execution from freshly mounted removable media is characteristic of container-delivered malware.

Suspicious macOS LaunchAgent or LaunchDaemon Plist Creation

This rule detects creation of a property list file inside the macOS LaunchAgents or LaunchDaemons directories. It maps to persistence where an attacker drops a launchd job configured with RunAtLoad and a short StartInterval to repeatedly execute a hidden payload from a temp path. Detecting new plists in these directories surfaces launchd persistence installation.

Suspicious PowerShell Reflective Assembly Load Invoking VAI Method (via process_creation)

This rule detects PowerShell reflectively loading a .NET assembly and invoking a method named VAI. This layered loader uses this in-memory technique to execute payloads decoded from steganographic images.

Suspicious Kimsuky JS Downloader Staging in Public and Templates Paths (via file_event)

This rule detects the creation of Kimsuky downloader and launcher scripts such as DefenderUpdate.js in Public Downloads or Templates.js and Templates.ps1 in the Windows Templates directory. These filenames and locations are used by the PebbleDash infection chain to stage follow on payloads.

Suspicious IIS Worker Process Spawning Command Shell via Web Shell (via process_creation)

This rule detects the IIS worker process spawning a command interpreter or WMI utility, a behavior consistent with the Phantom Taurus web shell loading IIServerCore inside w3wp.exe. Server-side web shells use the worker process to execute reconnaissance and lateral movement commands. Detecting this chain surfaces active exploitation of a public-facing web application by a Chinese-nexus APT.

Malicious Computer Account Modifying Active Directory Permissions - PrivExchange (via security)

This rule detects compromise a server with high privileges to perform permissions changes. PrivExchange attack can be detected using this rule.