Sigma detection rules, expert-reviewed

Suspicious NetSupport client32 Execution from ProgramData (via process_creation)

This rule detects execution of the NetSupport Manager remote control client client32.exe from a CommunicationLayer directory under ProgramData. The JS#SMUGGLER campaign installed NetSupport RAT to this path.

Suspicious JSP Webshell Written to SAP irj work Directory (via file_event)

This rule detects JSP files being written under the SAP servlet_jsp irj work directory, the deployment location where CVE-2025-31324 exploitation dropped webshells such as forwardsap.jsp and helper.jsp. New JSP files appearing in this runtime path indicate server software component abuse. This is a reliable webshell persistence signal.

Suspicious VBA Runtime Loaded by Process from OneNote Exported Directory

This rule detects a process running from the OneNote exported attachment or temp directory loading the VBE7.dll VBA runtime, indicating macro or script execution from a weaponised OneNote embedded file. Legitimate applications rarely execute from the OneNote Exported path, so loading the VBA engine from there signals malicious code launched via a OneNote phishing lure.

Malicious Turla PNG Dropper Service Masquerading as Windows Error Reporting via Service Creation

This rule detects installation of a Windows service using names that masquerade as legitimate Windows Error Reporting components which the Turla PNG Dropper uses for persistence. Observed in NCC Group research on the returning Turla PNG Dropper which registers services such as WerFaultSvc and RegRunnerSvc to load steganographic payloads. Detecting these masquerading service installations helps catch stealthy persistence by this espionage actor.

Malicious EKS Access Policy Association Granting Cluster Admin

This rule detects CloudTrail AssociateAccessPolicy events that attach the AmazonEKSClusterAdminPolicy or AmazonEKSAdminPolicy to an EKS access entry. Wiz Research showed this new access management API can be abused to grant an attacker principal cluster administrator rights, so unexpected admin grants should be treated as potential privilege escalation.

Malicious Immutable Flag on SSH authorized_keys via chattr

This rule detects use of chattr to set or clear the immutable attribute on an SSH authorized_keys file. Linux intrusion actors inject a backdoor key and then mark authorized_keys immutable so defenders and competing actors cannot remove their persistent access.

Malicious BITS Job Notify Command Pointing To ProgramData Payload via BITSLOTH

This rule detects creation of a BITS transfer job named Microsoft Windows configured with a SetNotifyCmdLine that executes a binary staged under C:\ProgramData which is the persistence mechanism used by the BITSLOTH backdoor. Adversaries abuse the Background Intelligent Transfer Service to survive reboots and blend malicious execution into a trusted Windows service.

Malicious svcagent DLL Load From AssetMon ProgramData Directory via PHANTOMPULSE

This rule detects loading of svcagent.dll from a ProgramData AssetMon directory as used by the PHANTOMPULSE blockchain C2 RAT in Elastic research. A service agent named DLL staged under a fabricated AssetMon folder in ProgramData indicates the implant module being mapped for execution and persistence.

Suspicious UAC Bypass via ComputerDefaults Auto-Elevation (via process_creation)

This rule detects the auto-elevating ComputerDefaults.exe spawning a command interpreter or scripting host, the signature of a registry-hijack UAC bypass. PrivateLoader abuses ComputerDefaults to run elevated code without prompting the user, gaining higher privileges for installation. A trusted auto-elevated binary launching cmd or PowerShell is a well-known UAC-bypass pattern.

Possible Process Injection into Notepad via PythonRatLoader (via process_creation)

This rule detects notepad.exe being spawned by a Python interpreter, which corresponds to the PythonRatLoader chain that creates suspended notepad processes as hosts for Early Bird APC shellcode injection delivering DCRat, VenomRAT and XWorm. A Python process launching Notepad is highly abnormal on endpoints.

DSRM Password Changed - Reg via Command (via security)

This rule detects reset or synchronize with another domain account the DSRM (Directory Services Restore Mode) password in order to escalate privileges.

DLL Side-Loading of WebUI.dll via Iscrpaint Host Binary

This rule detects the iscrpaint.exe binary loading WebUI.dll, the DLL side-loading pair used to run LummaStealer under a signed host process. Loading this companion DLL from the malware staging directory indicates search-order hijacking rather than legitimate application behavior.

Malicious Office 365 Email Forwarding Rule to External Domain (via office365)

This rule detects creates a forwarding rules to a non company email in order to collect information.

Suspicious Command Processor AutoRun Persistence via Registry Set

This rule detects writes to the Command Processor AutoRun registry value, which forces a command to run whenever cmd.exe starts and was used for persistence in the Uncorking Old Wine Cobalt Strike loader. This value is rarely set by legitimate software and is a well-known event-triggered execution vector.

Possible PAN-OS Auth Bypass via Double-Encoded Path Traversal to ztp_gate (CVE-2025-0108)

This rule detects requests to the PAN-OS unauth path that use double-encoded traversal sequences to reach authenticated PHP scripts such as ztp_gate.php, matching the Nginx and Apache path confusion auth bypass for CVE-2025-0108 documented by Assetnote. The double-encoded %252e segments defeat the X-pan-AuthCheck routing and expose privileged management endpoints. This encoded traversal against ztp_gate indicates an attempt to bypass authentication on the management interface.