Sigma detection rules, expert-reviewed

Suspicious Renamed MySQL Binary Executed from Temp via ClickFix (via process_creation)

This rule detects a binary named mysql.exe running from a temporary directory with a hardcoded password argument, matching the HarborWatch RAT payload which is renamed to mysql.exe and requires a fixed pass value to execute. Genuine MySQL clients do not run from user temp folders.

Malicious Matanbuchus Persistence via regsvr32 Silent Install with User Context (via process_creation)

This rule detects execution of regsvr32 with the no-register and user-context install flags to invoke a DLL entry point, the persistence and execution behavior run every five minutes by the Matanbuchus 3.0 EventLogBackupTask scheduled task. Adversaries leverage regsvr32 as a signed LOLBin to load a malicious DLL through its DllInstall path while bypassing DllRegisterServer monitoring, making early detection critical for surfacing loader persistence before payload deployment.

Suspicious Offensive Recon and Credential Tools Execution (via process_creation)

This rule detects execution of the fscan network scanner and the SharpDecryptPwd credential extraction utility. The SLOW#TEMPEST campaign used these tools for internal reconnaissance and browser credential theft.

Suspicious Curl Download to Windows Temp via PowerShell (via process_creation)

This rule detects PowerShell invoking curl with follow-redirect to download a payload into the Windows Temp directory, a staging step in the SILENTCONNECT campaign delivering ScreenConnect. Observed in Elastic Security Labs telemetry where an execution-policy-bypassed PowerShell retrieves the next-stage installer for remote access.

Malicious System Recovery Inhibition via bcdedit Boot Configuration Changes (via process_creation)

This rule detects bcdedit disabling Windows recovery by setting recoveryenabled to No or bootstatuspolicy to ignoreallfailures, a recovery-inhibition behavior used by the Hunters International ransomware group per Group-IB. Adversaries alter the boot configuration to block automatic repair before encryption, making this a reliable pre-impact signal.

Suspicious COOKIE SPIDER macOS Data Exfiltration via curl Archive Upload (via process_creation)

This rule detects curl uploading an archive named out.zip on macOS. The SHAMOS stealer delivered by COOKIE SPIDER collects credentials and wallet files and exfiltrates them in an out.zip archive via curl. A curl invocation referencing this archive name is a high-fidelity exfiltration indicator.

Linux: Detect modprobe-based authencesn crypto module auto-load via kmod

Flags modprobe/kmod processes loading the authencesn crypto module when command lines contain "crypto-authencesn(".

Suspicious Cmd Using Curl to Download and Execute Payload (via process_creation)

This rule detects a cmd.exe command line that sets a small console mode, downloads a file with curl, and immediately starts it. This pattern matches loaders built with the MisterioLNK open-source builder.

Malicious rundll32 Executing w32analytics DLL Export (via process_creation)

This rule detects rundll32 loading w32analytics.dll and invoking its dll_u export, the execution stage of the loader observed in recent unusual malware. Proxying execution through rundll32 with a named DLL export runs attacker code under a trusted signed Windows utility.

Malicious NTDS.dit Access via esentutl Database Copy (via process_creation)

This rule detects esentutl.exe operating on the ntds.dit Active Directory database file, an operation used during this intrusion to copy or process the domain credential store extracted from a volume shadow copy. Adversaries leverage the esentutl LOLBin to handle the locked database and recover hashes, making detection of ntds.dit in its command line a strong credential-access signal.

Malicious Empyrean Stealer Run Key Persistence (via registry_set)

This rule detects creation of an autostart Run key named empyrean which the Empyrean information stealer uses to persist on the host. The stealer harvests browser credentials and Discord tokens and re-executes at every user logon through this value.

Malicious PDF Editor Update Script Execution via PowerShell (via process_creation)

This rule detects PowerShell executing the named update scripts used by the trojanized PDF editor cluster (ConvertMate and PDFClick) that infiltrated environments through malicious ads. Adversaries run these scripts to register scheduled tasks and pull further payloads, making execution of the specific update script names a direct campaign indicator.

Suspicious ADNotificationManager Execution for netutils.dll Side-Loading (via process_creation)

This rule detects the Adobe ADNotificationManager.exe binary running from a user writable directory rather than its installed Adobe program path, where the RedCurl EarthKapre APT side-loads a malicious netutils.dll. Relocating the signed executable lets the attacker force loading of an attacker controlled library beside it. Execution of this Adobe component from a temporary or profile path is a strong side-loading indicator.

WebDAV Remote Payload Retrieval via Rundll32 DavSetCookie

This rule detects rundll32.exe calling davclnt.dll with the DavSetCookie export followed by a remote host, a WebDAV based download and execution technique used by the Andromeda Gamarue cluster. This pattern pulls a remote payload over WebDAV while hiding behind a signed Windows binary.

Malicious Scheduled Task Named CorelDefrag Under Windows Defrag Path

This rule detects the creation of a scheduled task named CorelDefrag placed inside the legitimate Windows Defrag task folder. The eScan supply chain attack persisted its implant with a task under Microsoft Windows Defrag CorelDefrag as reported by Kaspersky. Placing a rogue task inside a trusted system task path indicates masquerading persistence.