Sigma detection rules, expert-reviewed

Malicious Sednit COM Hijacking Persistence via InprocServer32

This rule detects COM hijacking where a per-user CLSID InprocServer32 key is pointed at the Sednit loader DLLs eapphost.dll or tcpiphlpsvc.dll used by the SlimAgent and BeardShell implants. The DLL names impersonate legitimate Windows components while the HKCU CLSID registration hijacks object loading for stealthy persistence.

Suspicious Shahmaran Autostart Masquerading as Adobe Updater

This rule detects registration of an autostart Run key value pointing to adobeupdater.exe, a persistence file name used by the BladedFeline group to launch the Shahmaran backdoor while impersonating Adobe update software. The legitimate-looking name combined with autorun persistence indicates a masqueraded implant rather than genuine Adobe tooling.

Suspicious K7Soft Autostart Persistence

This rule detects creation of a Run key or service registry value named K7Soft, a persistence mechanism used by the FamousSparrow group to survive reboots by masquerading as security software. The K7Soft name mimicking a legitimate antivirus vendor while establishing autostart execution indicates malicious persistence.

Malicious LSA Password Filter Registration via Notification Packages

This rule detects modification of the LSA Notification Packages registry value to register a rogue password filter DLL such as sasetup.dll. Operation FishMedley abused this mechanism to capture plaintext passwords during password change events via the PasswordChangeNotify export. Password filters run inside LSASS and let attackers persistently intercept credentials as users change them.

Suspicious Run Key Persistence to svcghost in Public WPSManager Path via Registry

This rule detects a Run key value that points to svcghost.exe inside the public WPSDocuments\WPSManager directory, the persistence PlushDaemon establishes after its Korean VPN supply-chain compromise. Executing a service-looking binary from a public documents path is not legitimate autostart behavior. This indicates registry Run-key persistence for the SlowStepper backdoor loader.

Suspicious Service ImagePath Pointing to ShieldNetWork Driver via Registry

This rule detects creation or modification of a service ImagePath value that references the ShieldNetWork directory, the mechanism HotPage uses to register a randomly named service that loads its vulnerable driver. Legitimate services do not install binaries under C:\Windows\ShieldNetWork. This indicates kernel-driver persistence supporting privileged ad injection and hooking.

Suspicious Scarab Service Persistence Registration via Registry (via registry_set)

This rule detects registration of the masquerading services UpdateStorServ or StorageDataServ used by the Scarab group for persistence on compromised servers. These fake storage-service names blend with legitimate system services while launching the group's backdoor at boot.

Suspicious CredSSP Encryption Oracle Remediation Weakening via Registry (via registry_set)

This rule detects setting the CredSSP AllowEncryptionOracle policy value to 2 (Vulnerable), a defense-weakening change used by the Scarab group to enable RDP connections to unpatched hosts. Lowering this protection re-exposes systems to the CVE-2018-0886 encryption oracle and signals attacker lateral-movement preparation.

Possible SPECTRALVIPER C2 Communication via Crafted Consent Cookie Values

This rule detects HTTP requests whose Cookie header simultaneously carries the euconsent-v2 and zd_cs_pm values used by the SPECTRALVIPER backdoor to smuggle command-and-control host information. The technique is tied to the OceanLotus (APT32) espionage campaign that masquerades C2 metadata inside cookies resembling GDPR consent and support tracking tokens. Identifying this combined cookie pattern matters because it exposes encrypted C2 traffic hidden inside otherwise benign-looking web requests.

Malicious Winter Vivern C2 Endpoint saveMessage via Proxy (via proxy)

This rule detects outbound HTTP requests to the /controlserver/saveMessage endpoint, the command-and-control path used by Winter Vivern after exploiting the CVE-2023-5631 Roundcube Webmail zero-day. Traffic to this endpoint indicates exfiltration of stolen webmail data to the group's C2 server.

Possible OxideHarvest Stealer Execution via Combined Short Flag Set

This rule detects a process invoked with the combined i, u, p, t and o short flags used by the OxideHarvest Rust stealer distributed alongside the Gentlemen EDR killer framework. The flag set drives credential and data harvesting stages of the stealer once security tooling has been disabled. Detecting this argument combination helps surface stealer execution, although the generic single-letter flags require corroboration to reduce noise.

Possible Firewall Rule Manipulation via netsh advfirewall by FishMonger

This rule detects use of netsh to add advanced firewall rules, an action used by the FishMonger group to weaken host defenses and allow SprySOCKS communication. The technique modifies the Windows firewall configuration to permit inbound or outbound traffic for attacker tooling. Detecting this command is useful because unexpected firewall changes on endpoints can indicate defense evasion, though it also occurs during legitimate administration.

Suspicious IntelAudioService Execution with StateRepository Arguments via SPECTRALVIPER

This rule detects execution of IntelAudioService.exe with the specific appmodel, StateRepository and Service command-line arguments used to launch the SPECTRALVIPER backdoor. The behavior is linked to the OceanLotus (APT32) espionage operation that shifted from external to domestic targeting. Detecting this masqueraded launcher pattern is important because attackers use it to covertly start their implant and blend with legitimate audio service activity.

Suspicious SearchApp Masquerading Executed Outside System Directory

This rule detects a process named SearchApp.exe running from a location other than the Windows System directories, matching the Webworm EchoCreep implant that impersonates the Windows Search application. The genuine SearchApp.exe executes only from packaged system paths, so a copy running elsewhere exposes the masqueraded malware.

Malicious Webworm MicrosoftSSHUpdate Scheduled Task Persistence

This rule detects creation of a scheduled task named MicrosoftSSHUpdate, used by the Webworm group to persist and launch its EchoCreep implant disguised as SearchApp.exe. The task name imitates a Microsoft SSH update to blend with legitimate services, so its registration signals attacker persistence.