Sigma detection rules, expert-reviewed

Possible Firewall Rule Manipulation via netsh advfirewall by FishMonger

This rule detects use of netsh to add advanced firewall rules, an action used by the FishMonger group to weaken host defenses and allow SprySOCKS communication. The technique modifies the Windows firewall configuration to permit inbound or outbound traffic for attacker tooling. Detecting this command is useful because unexpected firewall changes on endpoints can indicate defense evasion, though it also occurs during legitimate administration.

Suspicious IntelAudioService Execution with StateRepository Arguments via SPECTRALVIPER

This rule detects execution of IntelAudioService.exe with the specific appmodel, StateRepository and Service command-line arguments used to launch the SPECTRALVIPER backdoor. The behavior is linked to the OceanLotus (APT32) espionage operation that shifted from external to domestic targeting. Detecting this masqueraded launcher pattern is important because attackers use it to covertly start their implant and blend with legitimate audio service activity.

Suspicious SearchApp Masquerading Executed Outside System Directory

This rule detects a process named SearchApp.exe running from a location other than the Windows System directories, matching the Webworm EchoCreep implant that impersonates the Windows Search application. The genuine SearchApp.exe executes only from packaged system paths, so a copy running elsewhere exposes the masqueraded malware.

Malicious Webworm MicrosoftSSHUpdate Scheduled Task Persistence

This rule detects creation of a scheduled task named MicrosoftSSHUpdate, used by the Webworm group to persist and launch its EchoCreep implant disguised as SearchApp.exe. The task name imitates a Microsoft SSH update to blend with legitimate services, so its registration signals attacker persistence.

Malicious FrostyNeighbor ViberPC Renamed Rundll32 DLL Execution

This rule detects a rundll32 copy renamed to ViberPC.exe loading ViberPC.dll and invoking its SettingTimeAPI export, the execution chain used by the FrostyNeighbor PicassoLoader campaign. Renaming rundll32 and the payload to imitate the Viber messenger disguises DLL proxy execution as a trusted application.

Suspicious Rubeus Kerberos Abuse Tool Execution from Downloads

This rule detects execution of the Rubeus Kerberos abuse tool from a user Downloads folder, as observed in the DynoWiper intrusion for ticket theft and forging. Rubeus is an offensive credential-access utility, and its presence under Downloads on an endpoint indicates hands-on-keyboard Active Directory attack activity.

Malicious Rundll32 notepad2 DLL Proxy Execution

This rule detects rundll32 loading notepad2.dll and invoking its notepad export, the proxy-execution technique used by the spyware in the Pakistan dating-app campaign. Naming the malicious DLL and export after Notepad disguises code execution as a benign editor, so this specific invocation reveals the loader.

Malicious ReverseSocks5 Reverse Tunnel Execution via Command Line

This rule detects execution of the ReverseSocks5 tunneling tool by its distinctive connect and pre-shared-key command-line flags, as deployed by LongNosedGoblin for covert proxying. Establishing a reverse SOCKS5 tunnel with a PSK back to attacker infrastructure enables persistent access and traffic relaying through the victim network.

Malicious LongNosedGoblin OneDrive Reporting Task Scheduled Task Persistence

This rule detects registration of a scheduled task whose name begins with OneDrive Reporting Task-S-1-5-21-, the persistence pattern used by the LongNosedGoblin toolset against government targets. The task masquerades as a OneDrive reporting job appended with a user SID, so this naming structure reveals attacker persistence.

Malicious Kazuar DLL Side-Loading via Renamed Host Binaries

This rule detects execution of vncutil64.exe or LaunchGFExperience.exe, host binaries abused via DLL side-loading to restart the Turla Kazuar backdoor during a Gamaredon and Turla collaboration. These legitimately named executables running from non-standard locations serve as loaders for a malicious sideloaded DLL and indicate espionage backdoor activity.

Malicious Command Execution Spawned by SharePoint w3wp Worker Process

This rule detects the IIS worker process w3wp.exe spawning cmd.exe or a scripting host, behavior seen when ToolShell webshells such as spinstall0.aspx execute operating system commands on compromised SharePoint servers. A web server worker launching a command interpreter is a hallmark of webshell-driven remote command execution following exploitation.

Suspicious PowerShell Execution of TrainedDataStore Script

This rule detects PowerShell executing a script named TrainedDataStore.ps1, associated with the P.S. Olala tooling used by the BladedFeline group. Execution of this specifically named script indicates attacker PowerShell tradecraft used for command execution and post-compromise activity.

Malicious NTDS.dit Extraction via ntdsutil IFM

This rule detects use of ntdsutil.exe with Install-From-Media (IFM) arguments to create a full copy of the Active Directory database, a technique observed in RansomHub affiliate intrusions deploying EDRKillShifter. Dumping NTDS.dit exposes every domain account hash and enables domain-wide credential compromise ahead of ransomware deployment.

Malicious LSASS Memory Dump via comsvcs.dll MiniDump

This rule detects rundll32 invoking the MiniDump export of comsvcs.dll to dump the memory of the LSASS process to disk. This technique was used by the FishMonger group during Operation FishMedley to harvest credentials from compromised hosts. Extracting LSASS memory gives attackers plaintext passwords and hashes for lateral movement and privilege escalation.

Suspicious WMI Provider Host Spawning Explorer or wlrmdr via Process Creation

This rule detects WmiPrvSE.exe spawning explorer.exe or wlrmdr.exe, an execution chain MirrorFace uses in Operation AkaiRyu to launch its tooling through WMI while abusing rarely spawned Windows binaries as hosts. The WMI provider host does not normally start these processes. This indicates WMI-based execution during an espionage intrusion reviving the ANEL backdoor.