Sigma detection rules, expert-reviewed

Suspicious DanaBot Updater Scheduled Task Running Rundll32 from AppData via schtasks

This rule detects creation of a scheduled task named Updater that launches rundll32.exe against a DLL staged under a per-user AppData Custom_update directory, a persistence pattern used by DanaBot when deploying IcedID. Attackers abuse task scheduler plus rundll32 proxy execution to survive reboots and blend malicious loader activity into routine update tasks.

Malicious Ntospy Network Provider DLL Registration for Credential Capture

This rule detects registration of a malicious Network Provider DLL under the credman service key, matching the Ntospy credential-stealing component used against organizations in the Middle East, Africa and the US per Unit 42. Registering a rogue authentication package as a network provider lets the actor intercept plaintext logon credentials which enables persistent credential theft.

Malicious VoidLink Pinned eBPF Map in BPF Filesystem (via file_event)

This rule detects creation of the VoidLink pinned eBPF map used to hide network connections from userspace tooling. Observed in Elastic Security Labs analysis where a pinned map at the bpf filesystem path vl_hide_tcp supports the rootkit's stealth and ICMP-based command and control.

Malicious VenomRAT Scheduled Task Masquerading as Windows Gaming Preview via process_creation

This rule detects creation of a scheduled task named Windows.Gaming.Preview that points to an executable inside the user AppData Drivers directory. The fake CVE-2023-40477 proof-of-concept lure installs VenomRAT with this masqueraded task that reruns the payload from a non-standard path, combining a benign-looking name with a wrong execution context for persistence.

Possible Check Point SmartConsole Token Redemption Endpoint Access (via proxy)

This rule detects HTTP requests to the SmartConsole /cpmws/LoginSvcRemote token redemption endpoint. Rapid7 documented abuse of this SOAP endpoint to redeem forged SSO tokens as part of the CVE-2026-16232 authentication bypass against Check Point management servers. Legitimate SmartConsole clients also reach this endpoint so alerts should be correlated with unexpected source hosts or forged application token audit events.

Suspicious Curl POST Downloading PowerShell Payload to Temp Directory (via process_creation)

This rule detects curl issuing an HTTP POST request whose output is a PowerShell script, the ingress technique used in the Axios NPM supply chain attack where cmd.exe piped a curl POST response into a .ps1 file in the Temp directory. Adversaries stage second-stage scripts this way to pull payloads from attacker infrastructure, so the combination of curl, a POST verb, and a PowerShell target file is worth alerting on.

Suspicious ASPX Webshell Written to IIS inetsrv Directory via file_event

This rule detects an fd.aspx file being written under the IIS inetsrv directory, matching the webshell dropped by the hacktivist actors for server access. Web-facing script files appearing in the IIS binaries path are a hallmark of server-side webshell deployment. This supports persistence and remote command execution on internet-facing hosts.

PowerShell In-Memory Shellcode Execution via Memory Allocation APIs (via ps_script)

This rule detects a PowerShell script block that combines GlobalAlloc VirtualProtect and CreateThread calls to allocate executable memory and run shellcode, the in-memory loading behavior of the RokRAT search.dat loader read from the public directory. Adversaries leverage reflective shellcode execution to run their payload without touching disk as a file, making early detection critical for surfacing fileless code execution before RokRAT deploys.

Malicious more_eggs Scriptlet DLL Registration via regsvr32 Action Install from AppData (via process_creation)

This rule detects regsvr32 registering a DLL from a user AppData path with the /i Action install switch, the second-stage more_eggs loader behavior in which wmiprvse.exe spawned regsvr32 to activate a payload dropped under AppData Roaming Microsoft. Adversaries use the regsvr32 /n /i scriptlet-install path to run code through a trusted binary while avoiding on-disk executables, so this pattern from a user directory is a strong loader indicator.

Malicious SAM and SYSTEM Hive Dump via reg save (via process_creation)

This rule detects use of reg.exe to save the SAM or SYSTEM registry hives to disk for offline credential extraction. This technique was observed in the APT41 intrusion targeting government IT services in Africa. Dumping these hives lets attackers recover local account password hashes and boot keys away from the host and is a strong precursor to lateral movement.

Malicious Disabling of Linux Security Modules AppArmor and SELinux

This rule detects commands that disable the SELinux and AppArmor kernel security modules on Linux hosts. The RondoDox payload deployed after CVE-2025-55182 exploitation disables these protections to run unhindered as reported by Kaspersky. Tampering with mandatory access controls is a strong defense evasion indicator that precedes further malicious activity.

Malicious Project CAV3RN DNS Configuration Recovery via cloudlanecdn.com (via dns_query)

This rule detects DNS queries to encoded subdomains of cloudlanecdn.com, a channel used by the Project CAV3RN espionage framework to recover configuration data from DNS AAAA records. The encoded label structure and attacker-controlled domain indicate covert command-and-control and data-encoding activity that should not appear in normal traffic.

Suspicious Wscript Executing UN VBS Cleanup Script via Command Line (via process_creation)

This rule detects wscript.exe executing a VBScript named UN.vbs, the cleanup component used by the Parallax RAT to remove infection artifacts. It is associated with the Parallax RAT campaign reported by Uptycs. Attackers run this script to erase traces after establishing access, so the execution is a useful indicator of post-infection cleanup activity.

Suspicious Ivanti Connect Secure License Keys-Status Command Injection Request (via webserver)

This rule detects HTTP requests to the Ivanti Connect Secure /api/v1/license/keys-status/ endpoint that embed a shell command separator followed by an interpreter reference. Actors chained a semicolon and python invocation onto this path to achieve command injection and drop reverse shells. Requests to this endpoint carrying inline command syntax indicate active exploitation.

Malicious UNC1549 MINIBIKE DLL Side-Load of secur32.dll via FileCoAuth (via image_load)

This rule detects the OneDrive-associated FileCoAuth.exe binary loading a secur32.dll from a non-system directory, the side-load path for UNC1549 MINIBIKE and MINIBUS backdoors. The suspected Iranian actor abused a trusted-looking executable to load a malicious DLL of the same name as a system library. Loading secur32.dll from outside System32 through FileCoAuth is a high-fidelity side-loading indicator.