Sigma detection rules, expert-reviewed

Suspicious javaw.exe Executing JAR From Masqueraded Roaming Directory via Interlock Ransomware (via process_creation)

This rule detects the Interlock Windows ransomware which runs through a legitimate javaw.exe copied into Roaming subfolders that impersonate FortiClient, VMware or a Welcome application to execute its JAR payload. Java runtimes staged under these AppData paths are not normal on endpoints. This execution indicates ransomware deployment.

Malicious Browser Credential Theft via rundll32 Loading move.dll (via process_creation)

This rule detects the Interlock custom infostealer move.dll executed through rundll32.exe with a start argument, a DER key file and a target host to collect browser credential stores. The stolen data is written per host as a CSV file. This rundll32 invocation of move.dll with a key file is characteristic of the stealer.

Suspicious Scheduled Task With TimeSync Masquerade via Interlock RAT (via process_creation)

This rule detects Interlock RAT persistence which registers scheduled tasks using deceptive time synchronization names such as TimeSyncDrive and TimeSyncroDriver. These names imitate legitimate Windows time services to blend in. Creation of tasks with these exact names indicates the RAT.

Malicious Inhibit System Recovery via Native Backup and Shadow Copy Deletion (via process_creation)

This rule detects the multi stage campaign destroying recovery options by disabling the Windows Recovery Environment with reagentc, deleting the backup catalog with wbadmin and removing volume shadow copies with vssadmin before ransomware deployment. Executing these recovery inhibiting commands together is a strong pre encryption signal.

Malicious Inhibit System Recovery via bcdedit Boot Policy Change by Chaos Ransomware (via process_creation)

This rule detects Chaos C++ ransomware disabling Windows recovery by running bcdedit to ignore all boot failures and to turn off the recovery environment prior to encryption. These bcdedit modifications remove the user ability to recover the system. They are a reliable pre encryption indicator.

Suspicious DLL Download via curl to User Profile by Confucius Loader (via process_creation)

This rule detects the Confucius LNK loader using curl launched from PowerShell to fetch side loading DLLs such as python313.dll and mapistub.dll into the user profile alongside a decoy PDF. Downloading these specific DLL names with curl is characteristic of the actor. The DLLs are then side loaded by copied system binaries.

Suspicious Winos Persistence Binary Created as ProgramData BITTS2.exe (via process_creation)

This rule detects the Winos 4.0 implant establishing persistence by copying itself to ProgramData as BITTS2.exe and executing it. This hardcoded path and file name are unique to the campaign. Execution of this binary indicates an active infection.

Suspicious Python Interpreter Execution From Downloads Directory via PureHVNC Loader (via process_creation)

This rule detects the PureHVNC loader which extracts a portable Python environment into a hidden folder under the user Downloads directory and runs Python files carrying RC4 encrypted shellcode. A Python interpreter executing scripts from Downloads is unusual on endpoints. This stage decrypts and runs shellcode.

Suspicious search-ms Protocol Handler Abuse for Remote Payload via PureHVNC (via process_creation)

This rule detects the PureHVNC delivery chain abusing the search-ms URI protocol handler to present a remote malicious LNK disguised with a PDF icon from a WebDAV share. Command lines invoking the search-ms protocol are a known phishing staging technique. This step precedes the Python multi stage loader.

Suspicious Ousaban Installation Marker maisum.dat Created (via file_event)

This rule detects the Ousaban banking trojan dropping its empty installation marker file maisum.dat whose creation time records the infection timestamp alongside the payload directory. Creation of this specific marker file indicates a successful install. The trojan then persists through a Run key.

Malicious Ransom Note and Encrypted Extension via Hakuna Matata Variant (via file_event)

This rule detects the ransomware stage of the multi stage campaign which appends the @NeverMind12F extension to encrypted files and drops a ransom note that carries a distinctive Cyrillic file name. Creation of files with this extension or note name indicates encryption in progress. The variant derives from the Hakuna Matata family.

Suspicious Defendnot Antivirus Disabling Component Dropped in ProgramData (via file_event)

This rule detects the multi stage campaign deploying the Defendnot tool which drops defendnot.dll and defendnot-loader.exe into ProgramData and injects into Taskmgr.exe to deregister Microsoft Defender. Creation of these named components indicates an attempt to blind endpoint protection. This precedes the RAT and ransomware stages.

Malicious NailaoLocker Ransom Note and Encrypted File Creation (via file_event)

This rule detects file system artifacts of NailaoLocker which writes the ransom note unlock_please_view_this_file.html and appends the .locked extension to encrypted files. The locker also drops a lock.log progress file under ProgramData. Creation of these named artifacts indicates active encryption.

Suspicious RondoDox Botnet Persistence via init.d Script and Contact File (via file_event)

This rule detects the RondoDox botnet establishing persistence on Linux hosts by creating an init script named rondo under etc init.d and writing a contact file to the tmp directory. Creation of these named artifacts indicates infection. The bot also links the init script into the runlevel start directory.

Possible TrickBot DNS Tunneling C2 to westurn.in (via dns_query)

This rule detects DNS based command and control from the analyzed TrickBot variant which tunnels XOR encrypted commands as hex encoded labels beneath the westurn.in domain. Queries embed data in long subdomains separated every sixty three characters. Any resolution of this domain indicates the tunneling channel.