Sigma detection rules, expert-reviewed

Possible Out-of-Band OAST Callback Domain Resolution via DNS

This rule detects DNS resolution of well-known out-of-band application security testing and interaction callback domains such as oast.fun, oast.pro, interact.sh, and burpcollaborator.net. These domains are used by exploitation tooling, including scanners for the BeyondTrust CVE-2026-1731 remote code execution flaw, to confirm blind vulnerabilities through out-of-band interaction. Resolution of these domains from server or internal hosts frequently signals active exploitation or reconnaissance against internet-facing services.

Suspicious DNS Query to Interactsh OAST Callback Domains

This rule detects DNS resolutions for Interactsh out-of-band application security testing domains such as oast.pro, oast.site, oast.me, oast.online, oast.fun and oast.live. These domains receive automated Nuclei and Interactsh scanning callbacks used to confirm blind vulnerabilities, so queries from production hosts indicate the host is being probed or has been compromised in a mass-exploitation campaign.

Suspicious Run Key Persistence Executing regsvr32

This rule detects a Run registry autostart value whose data invokes regsvr32, a persistence method observed in the AppleSeed triple-combo campaign that added a TripServiceUpdate entry launching regsvr32 against a malicious DLL. It captures the establishment of boot persistence combined with signed-binary proxy execution. Detecting this is important because legitimate autostart entries seldom call regsvr32 with install switches to load a DLL at logon.

Suspicious Masquerading Scheduled Task Impersonating Microsoft Edge Update

This rule detects schtasks creating a scheduled task named to impersonate a Microsoft Edge update while configured to run PowerShell with an execution-policy bypass, a persistence and masquerading technique observed in a nation-state APT campaign that registered an hourly MicrosoftEdgeUpdateVersion task to launch XenoRAT. It captures a malicious task disguised under a trusted update name. Detecting this is important because a scheduled task masquerading as a browser updater yet invoking PowerShell bypass is a clear sign of stealthy persistence.

Suspicious Obfuscated Hidden PowerShell with Encoded Command

This rule detects PowerShell launched with hidden window, no-profile, and no-logo flags together with an encoded or Base64 command argument, an execution pattern observed in a nation-state APT campaign delivering XenoRAT through LNK files that decoded a randomly named script. It captures concealed and encoded script execution used to run in-memory payloads. Detecting this is important because the combination of hidden execution and encoded commands is a strong indicator of obfuscated malicious PowerShell.

Suspicious File Concatenation via copy Binary Mode

This rule detects the command shell copy utility used in binary mode to concatenate multiple files into one, a payload-assembly technique observed in a Lumma infostealer campaign that combined an AutoIt interpreter with a script to reconstruct an executable. It captures the joining of staged fragments into a runnable payload on disk. Detecting this is important because copy /b concatenation of separate files is an established malware building technique that reassembles payloads to evade detection.

Suspicious CAB Extraction via extrac32 LOLBin

This rule detects extrac32 being used to extract cabinet archive contents, a living-off-the-land technique observed in a Lumma infostealer campaign that used extrac32 to unpack a CAB file masquerading as a document during payload staging. It captures abuse of a signed Windows utility to unpack malicious archives. Detecting this is important because extrac32 is rarely used interactively and its appearance in an attack chain often indicates covert payload deployment.

Suspicious Hidden PowerShell Launched by Batch Script

This rule detects a batch script spawning PowerShell with hidden and minimized window options, an execution pattern observed in a K-Messenger abuse campaign delivering RoKRAT where a lexus.bat file invoked PowerShell with -windowstyle hidden and -min to run fileless payload stages. It captures concealed script execution originating from a batch launcher. Detecting this is important because hidden PowerShell descending from a batch file is a frequent fileless malware loading technique.

Suspicious Command Shell Executing Batch Script from LNK Delivery

This rule detects a command shell executing a batch script through the /c switch when launched from explorer, a delivery pattern observed in an EDR analysis of LockBit ransomware where a Documentos.lnk shortcut ran a batch file to stage the attack. It captures the shortcut-to-script execution that begins the intrusion. Detecting this is important because user-facing shortcuts launching batch scripts via the shell is a common ransomware and loader initial-execution technique.

Malicious Safe Mode Boot Configuration via bcdedit

This rule detects bcdedit configuring the system to boot into Safe Mode by setting the safeboot option, a defense-impairment technique observed in an EDR analysis of LockBit ransomware that forced Safe Mode to disable security tooling before encryption. It captures tampering with boot configuration to weaken host defenses. Detecting this is important because interactive bcdedit safeboot changes are strongly associated with ransomware attempting to evade protection prior to file encryption.

Suspicious PowerShell String Concatenation Obfuscation for Batch Extension via LNK (via process_creation)

This rule detects PowerShell command lines that split the "bat" extension into concatenated string fragments to evade static detection, a technique observed in the APT37 ToyBox Story campaign delivering RoKRAT via malicious LNK files. It captures the obfuscation used to reconstruct a batch loader name at runtime so that command inspection does not reveal the dropped payload. Detecting this hidden concatenation surfaces the initial LNK-driven execution stage before the staged loaders run.

Malicious Remote Process Creation via WMI Win32_Process

This rule detects use of WMI to create a process through the Win32_Process class from wmic or a script host, an execution technique observed in a MuddyWater APT campaign targeting the Middle East to run payloads while evading direct process lineage. It captures lateral or local execution driven through the WMI provider. Detecting this is important because Win32_Process Create invocations are a frequent attacker method to launch code outside normal parent-child relationships.

Suspicious AutoIt Interpreter Launched by Script Host or Shell

This rule detects the AutoIt3 interpreter being launched by PowerShell or a command shell, a delivery pattern observed in Operation Poseidon where a ZIP to LNK to PowerShell chain executed AutoIt3.exe to load the EndRAT payload in memory. It captures abuse of the legitimate AutoIt engine to run compiled malicious scripts. Detecting this parentage is important because AutoIt3 spawned by a scripting host rather than a user-launched application is a common malware loader pattern.

Suspicious attrib Hidden and System Attribute Assignment

This rule detects the attrib command setting hidden and system attributes on files, a concealment technique observed in the Suky Castle campaign where the chain applied attrib to hide dropped artifacts before scheduling persistence. It captures the marking of files as hidden and system to keep malicious payloads out of view. Detecting this is important because interactive use of attrib to apply both hidden and system flags is uncommon and frequently tied to staging of malware.

Suspicious Office Application Spawning Script Interpreter Chain

This rule detects Microsoft Word spawning a command shell or PowerShell that in turn is associated with script-host execution, a chain observed in a WizardSpider-themed intrusion where winword launched cmd or PowerShell leading to cscript. It captures the transition from a weaponized document to interactive command execution. Detecting this parent-child relationship is important because productivity applications launching shells is a strong indicator of malicious macro or exploit activity.