Sigma detection rules, expert-reviewed

Suspicious PowerShell Execution of TrainedDataStore Script

This rule detects PowerShell executing a script named TrainedDataStore.ps1, associated with the P.S. Olala tooling used by the BladedFeline group. Execution of this specifically named script indicates attacker PowerShell tradecraft used for command execution and post-compromise activity.

Malicious NTDS.dit Extraction via ntdsutil IFM

This rule detects use of ntdsutil.exe with Install-From-Media (IFM) arguments to create a full copy of the Active Directory database, a technique observed in RansomHub affiliate intrusions deploying EDRKillShifter. Dumping NTDS.dit exposes every domain account hash and enables domain-wide credential compromise ahead of ransomware deployment.

Malicious LSASS Memory Dump via comsvcs.dll MiniDump

This rule detects rundll32 invoking the MiniDump export of comsvcs.dll to dump the memory of the LSASS process to disk. This technique was used by the FishMonger group during Operation FishMedley to harvest credentials from compromised hosts. Extracting LSASS memory gives attackers plaintext passwords and hashes for lateral movement and privilege escalation.

Suspicious WMI Provider Host Spawning Explorer or wlrmdr via Process Creation

This rule detects WmiPrvSE.exe spawning explorer.exe or wlrmdr.exe, an execution chain MirrorFace uses in Operation AkaiRyu to launch its tooling through WMI while abusing rarely spawned Windows binaries as hosts. The WMI provider host does not normally start these processes. This indicates WMI-based execution during an espionage intrusion reviving the ANEL backdoor.

Suspicious Headless conhost Spawned by Firefox via Process Creation

This rule detects firefox.exe spawning conhost.exe in headless mode, an anomalous chain RomCom produces when its scheduled task launches Firefox to run hidden console activity after zero-day exploitation. A browser process starting a headless console host is not normal behavior. This indicates hidden command execution during a RomCom intrusion.

Suspicious Embargo Service irnagentd Creation via Process Creation

This rule detects creation of a Windows service named irnagentd via sc.exe, a persistence and execution artifact of the Embargo ransomware written in Rust. The service is used to run the ransomware payload with elevated privileges. This indicates service-based persistence in a ransomware intrusion.

Malicious Removal of Defender Safe Mode Service Registration via Process Creation

This rule detects reg.exe deleting the SafeBoot registration for WinDefend, which the Embargo ransomware performs so that Microsoft Defender does not start after it reboots the host into safe mode. Removing a security service from the SafeBoot key is a deliberate tampering action. This indicates impairment of defenses ahead of encryption.

Malicious WPS Office ksoqing Protocol Handler Exploitation via Process Creation

This rule detects promecefpluginhost.exe launched with a ksoqing:// argument, the custom URI handler that APT-C-60 abuses to achieve arbitrary code execution through WPS Office vulnerabilities. A weaponized document triggers this handler to load attacker code without user interaction beyond opening the file. This indicates active exploitation and downloader delivery.

Suspicious Evasive Panda Scheduled Task Persistence via Schtasks (via process_creation)

This rule detects creation of scheduled tasks named netsvcs or Demovale used by Evasive Panda for logon persistence in the campaign leveraging the Monlam Festival against Tibetans. The netsvcs name masquerades as a Windows service group to disguise the group's downloader task.

Suspicious Windows Defender Weakening via MpPreference (via process_creation)

This rule detects PowerShell disabling Microsoft Defender sample submission with Set-MpPreference SubmitSamplesConsent or adding folder exclusions with Add-MpPreference ExclusionPath, defense-evasion steps used by the NSPX30 implant to avoid detection. Weakening Defender lets the AitM-enabled backdoor persist and run unscanned.

Suspicious PyPI Backdoor Scheduled Task Running VBScript via Schtasks (via process_creation)

This rule detects creation of the MicrosoftWinRaRUtilityTaskB scheduled task used by malicious PyPI packages to run a VBE payload every five minutes. The masquerading task name imitates a Microsoft utility while providing persistence for the supply-chain backdoor.

Malicious NTDS Database Dump via Ntdsutil IFM (via process_creation)

This rule detects ntdsutil.exe invoked with the Install-From-Media create full option to dump the Active Directory NTDS database, a credential-theft step performed during Operation Jacana. Exporting NTDS.dit yields all domain password hashes and enables full domain compromise.

Suspicious Domain Admins Group Membership Addition via Net (via process_creation)

This rule detects use of net.exe to add an account to the Domain Admins group, a privilege-escalation and persistence action taken during Operation Jacana. Granting Domain Admins membership hands an attacker full control of the Active Directory environment.

Suspicious Remote File Download via Certutil URLCache via process_creation

This rule detects certutil.exe abused with the urlcache and split arguments to download remote files, an ingress technique used during Operation Jacana against a Guyanese government entity. Attackers use certutil as a trusted downloader to stage additional tooling while blending with normal certificate activity.

Malicious Lazarus DLL Side-Loading via Colorcpl from ProgramData (via process_creation)

This rule detects the signed binary colorcpl.exe executing from a ProgramData path, the vector Lazarus used to side-load a malicious colorui.dll from C ProgramData Adobe during the trojanized coding-challenge intrusion. Because colorcpl normally runs from System32, execution from ProgramData reveals a side-loaded payload launch.