Sigma detection rules, expert-reviewed

Suspicious Rename of Text File to Script via Move Command

This rule detects a command shell renaming a .txt file into a .vbs script using the move command, a defense-evasion trick observed in a WizardSpider-themed chain where adb.txt was converted into adb.vbs prior to execution with cscript. It captures the staging step that disguises a script payload as a benign text file. Detecting this matters because legitimate workflows rarely rename plain text files into executable script extensions from the command line.

Suspicious rundll32 Control_RunDLL DLL Execution

This rule detects rundll32 invoking a DLL through the Control_RunDLL entry point, a technique observed in a WizardSpider-themed intrusion chain to proxy execution of a malicious DLL named adb.dll. It captures signed-binary proxy execution used to blend malicious code with legitimate control-panel handling. Detecting this is important because Control_RunDLL is frequently abused to run attacker DLLs while evading application controls.

Malicious Ransomware Payload Execution via HWP Word Processor Spawning Executable from Temp

This rule detects the Hancom HWP word processor spawning an executable file from the user AppData Local Temp directory, a behavior observed in an EDR-analyzed ransomware campaign delivered through malicious HWP documents. It captures the initial code-execution stage where a lure document drops and launches a payload leading to file encryption. Detecting this parent-child anomaly is important because office document processors should not launch arbitrary executables from temporary folders.

Possible EndRAT C2 Communication via Distinctive Client Identifier

This rule detects network traffic containing the EndRAT-specific identifiers endServer9688 or endClient9688, string markers observed in Operation Poseidon where the AutoIt-delivered EndRAT implant used these tokens to communicate with its command-and-control server. It captures the beaconing of a specific remote-access trojan by its protocol constants. Detecting this is important because these identifiers are unique to the malware family and provide a high-confidence signal of active compromise.

Malicious RoKRAT Staged Loader Files in Temp via LNK (via file_event)

This rule detects the creation of the sequentially named toy01.dat, toy02.dat and toy03.bat loader files inside the user Temp directory as staged by the APT37 ToyBox Story campaign. These files form the multi-stage loader chain that ultimately decrypts and executes the RoKRAT payload on disk. Alerting on these campaign-specific staged artifacts catches the delivery step where the loaders are written before execution.

Suspicious Creation of MuddyWater Log-Named Payload Files

This rule detects the creation of files named ManagerProc.log or PhotoAcq.log, distinctive artifact names observed in a MuddyWater APT campaign where malicious components were dropped under a log file guise. It captures the staging of implant files disguised with benign logging names. Detecting this is important because these specific filenames are tied to the campaign and their appearance strongly indicates targeted intrusion activity.

Suspicious Ousaban Persistence via Financeiro Run Registry Value (via registry_set)

This rule detects the Ousaban banking trojan establishing autostart persistence by creating a Run key value named Financeiro under the CurrentVersion Run key that launches its payload from a hardcoded path. The Portuguese value name is specific to this Iberian campaign. Any such value indicates the trojan.

Suspicious UAC Weakening via ConsentPromptBehaviorAdmin Disable by Winos (via registry_set)

This rule detects the Winos 4.0 implant weakening User Account Control by setting ConsentPromptBehaviorAdmin and PromptOnSecureDesktop to zero under the system policy key. This silences elevation prompts to allow silent privilege escalation. Setting these values to zero is rarely legitimate on managed hosts.

Malicious Winos 4.0 Configuration and Shellcode Storage in Registry (via registry_set)

This rule detects the Winos 4.0 implant storing configuration, encrypted plugin DLLs and shellcode under registry keys named with the campaign identifier B118D5E900008F7A in the HKCU hive. The malware reads these keys to reload modules in memory. Presence of this identifier in a registry path is a strong indicator.

Possible FDMTP Implant C2 Cluster Registration via HTTP (via proxy)

This rule detects the QuickFox FDMTP implant contacting its command and control cluster using a distinctive registration request. The implant issues a GetCluster request carrying the DotNet-TcpFDMTP protocol tag to obtain live C2 nodes. This URI pattern is unique to the FDMTP framework.

Possible TrickBot Anchor DNS C2 Registration via HTTP URI (via proxy)

This rule detects command and control traffic from the Anchor DNS variant of TrickBot which prefixes its registration and task URIs with the /anchor_dns/ path. The bot embeds the victim hostname and hardware identifier within this path during check in. The literal /anchor_dns/ marker is a strong indicator of Anchor activity.

Suspicious Cloud Instance Metadata Credential Access via curl to IMDS (via process_creation)

This rule detects the Shai Hulud intrusion harvesting IAM role credentials from a compromised Jenkins runner by querying the instance metadata service at 169.254.169.254 with curl. Requests to the security credentials metadata path are a common cloud credential theft technique. The stolen role was escalated to administrator.

Suspicious .NET Utility Spawned by AutoHotkey Loader for Process Hollowing (via process_creation)

This rule detects the AsyncRAT loader hollowing legitimate .NET Framework utilities such as AddInProcess32.exe, AppLaunch.exe and aspnet_compiler.exe launched from the Windows Sound Diagnostics staging folder. These binaries are injected with the final remote access trojan. A parent located in that package path spawning these utilities indicates hollowing.

Suspicious AutoHotkey Execution Masquerading as Realtek Audio in Sound Diagnostics Path (via process_creation)

This rule detects the AI themed AsyncRAT campaign running AutoHotkey binaries renamed to Realtek audio components from the Windows Sound Diagnostics package folder. The renamed interpreters execute .ahk orchestration scripts that perform process hollowing. Execution of an .ahk script from this staging path is highly suspicious.

Suspicious PowerShell Spawned by WScript With Hidden Bypass via PureLogs Loader (via process_creation)

This rule detects the PureLogs phishing chain in which a malicious JavaScript file executed by wscript.exe spawns PowerShell with an execution policy bypass and a hidden window to run a dropped script from a temp folder. This parent child relationship between the script host and PowerShell is a strong loader signal. The staged script then hollows a .NET binary.