Sigma detection rules, expert-reviewed

Suspicious Remote File Download via Certutil URLCache via process_creation

This rule detects certutil.exe abused with the urlcache and split arguments to download remote files, an ingress technique used during Operation Jacana against a Guyanese government entity. Attackers use certutil as a trusted downloader to stage additional tooling while blending with normal certificate activity.

Malicious Lazarus DLL Side-Loading via Colorcpl from ProgramData (via process_creation)

This rule detects the signed binary colorcpl.exe executing from a ProgramData path, the vector Lazarus used to side-load a malicious colorui.dll from C ProgramData Adobe during the trojanized coding-challenge intrusion. Because colorcpl normally runs from System32, execution from ProgramData reveals a side-loaded payload launch.

Malicious Lazarus DLL Side-Loading via PresentationHost from Non-Standard Path (via process_creation)

This rule detects the signed Microsoft binary PresentationHost.exe executing from a location outside System32 or SysWOW64, the DLL side-loading vector used by Lazarus to load a malicious mscoree.dll from C ProgramShared in the trojanized coding-challenge campaign. Running this LOLBin from a writable path indicates a side-loading launch of the group's implant.

Suspicious Self-Deletion via Choice Timer and Del Command via Cmd (via process_creation)

This rule detects the self-deletion idiom that chains choice.exe as a timer with a forced Del command, used by the Deadglyph implant to remove its own components after execution. This anti-forensic cleanup destroys the dropper to hinder analysis and attribution.

Suspicious OilRig Scheduled Task Launching VBScript via Schtasks (via process_creation)

This rule detects creation of the ReminderTask scheduled task used by OilRig's Outer Space and Juicy Mix backdoors to run a VBS dropper every 14 minutes. The recurring VBScript task provides both execution and persistence for the group's downloader chain.

Suspicious Executable Run from IIS aspnet_client or Windows Tasks Directory via process_creation

This rule detects process execution from the IIS inetpub aspnet_client folder or the Windows Tasks directory, staging locations abused by Ballistic Bobcat after exploiting internet-facing servers to deploy the Sponsor backdoor. Binaries running from these web-writable or system-hidden paths strongly indicate post-exploitation persistence.

Suspicious Ballistic Bobcat Backdoor Command Output Redirection via Cmd (via process_creation)

This rule detects the Sponsor backdoor pattern of executing shell commands and redirecting their combined output to result.txt, the tasking convention of Ballistic Bobcat's scan-and-strike operations. Capturing command output to a fixed file reveals interactive attacker reconnaissance on the host.

Suspicious Jump List AutomaticDestinations Deletion via Cmd (via process_creation)

This rule detects deletion of Recent AutomaticDestinations jump-list artifacts via the command line, an anti-forensic step observed in Scarab intrusions to erase evidence of opened files and remote paths. Wiping these artifacts is used to frustrate incident responders after credential theft or data staging.

Suspicious MoustachedBouncer Scheduled Task Running Executable from SMB Share via Schtasks (via process_creation)

This rule detects creation of a scheduled task that executes the masquerading binary OfficeBroker.exe, a technique used by the MoustachedBouncer espionage group against foreign diplomats in Belarus to run a payload from an SMB share every minute. Attackers rely on scheduled tasks for stealthy execution and persistence, so catching this reveals active backdoor tasking.

Malicious XGU Pivot Named Pipe Creation by SPECTRALVIPER

This rule detects creation of a named pipe containing the XGU--Pivot marker used by the SPECTRALVIPER backdoor for internal pivoting and proxied communication. The activity is associated with the OceanLotus (APT32) espionage campaign that relays traffic between compromised hosts through named-pipe channels. Detecting this specific pipe name is important because it reveals lateral movement and internal proxy infrastructure that standard network monitoring would miss.

Suspicious Salamander Named Pipe Creation

This rule detects creation of a named pipe called salamander_pipe, an inter-process communication channel used by GhostRedirector tooling including Potato-family privilege escalation utilities. This specific pipe name is not associated with legitimate software and indicates the presence of the group's backdoor or local privilege escalation components.

Malicious Native IIS Module Loaded by w3wp Worker Process

This rule detects the IIS worker process w3wp.exe loading ManagedEngine64_v2.dll, a malicious native IIS module deployed by the GhostRedirector group as a server-side backdoor. Rogue IIS modules run inside the trusted web server process and give attackers persistent request handling and code execution on internet-facing servers.

Suspicious regcap Side-Load of lregdll via Image Load

This rule detects regcap.exe loading lregdll.dll, a DLL side-loading pair PlushDaemon uses to run the SlowStepper backdoor under a legitimate signed host binary. The lregdll.dll name is not a genuine dependency of regcap and is planted alongside it. This indicates DLL side-loading in a supply-chain espionage intrusion.

Suspicious msvc_4.dll Side-Load from Typosquatted NVIDlA Directory via Image Load

This rule detects loading of msvc_4.dll from a %ProgramData%\NVIDlA subdirectory, where the CloudScout toolset used by Evasive Panda side-loads its loader through a folder that typosquats NVIDIA by substituting a capital I for the l. Legitimate NVIDIA components do not load from this misspelled path. This indicates DLL side-loading in a cloud-session-theft operation.

Suspicious DLL Load from WPS INetCache Temp Directory via Image Load

This rule detects a DLL being loaded from the %localappdata%\Temp\wps\INetCache path, where the WPS Office exploit chain plants an attacker DLL named by MD5 hash for side-loading. Legitimate DLLs are not resolved from this cache directory. This indicates DLL search-order hijacking used by the APT-C-60 downloader.