Sigma detection rules, expert-reviewed

Suspicious Toshiba Binary Sideloading toshdpapi.dll

This rule detects the legitimate Toshiba toshdpdb.exe loading a malicious toshdpapi.dll from its directory, a DLL sideloading chain used to run a PlugX variant in China-linked espionage intrusions that also deployed RA World ransomware.

Possible DLL Search Order Hijack of httpapi.dll Outside System32 (via image_load)

This rule detects the Windows httpapi.dll being loaded from a directory other than System32 or SysWOW64 which indicates DLL search order hijacking. Abuse of a writable agent directory to plant httpapi.dll was used to escalate privileges to SYSTEM against the Delinea Privilege Manager agent.

Suspicious COLDRIVER Logon Script Persistence via UserInitMprLogonScript (via process_creation)

This rule detects a reg add command creating the UserInitMprLogonScript value under HKCU Environment to run a hidden PowerShell stager at logon as performed by the COLDRIVER SIMPLEFIX chain. This logon script value is a well known but rarely legitimate persistence location.

Uncommon Print Spooler Exploitation Spawning a Child Process (via process_creation)

This rule detects the print spooler service (spoolsv.exe) spawning a command shell, script interpreter or a process from a user-writable path, behavior consistent with PrintNightmare-style spooler exploitation for code execution or privilege escalation. Print spooler abuse is a privilege-escalation technique noted in the Red Canary Threat Detection Report. Detecting anomalous spooler children surfaces exploitation of the service.

Suspicious SharePoint ToolPane Endpoint Request via ToolShell (via webserver)

This rule detects HTTP requests to the SharePoint ToolPane.aspx endpoint carrying the DisplayMode Edit parameter, the exploitation vector for ToolShell (CVE-2025-53770). Attackers send crafted requests to this endpoint to bypass authentication and achieve remote code execution. Requests to this endpoint with an edit display mode are a strong indicator of exploitation attempts.

Suspicious SystemSettings DLL Sideload from Non-System Path via image_load

This rule detects SystemSettings.exe loading a SystemSettings.dll from a path outside the System32 directory, the DLL sideloading technique used to launch SharkLoader in the StrikeShark campaign. The genuine binary only loads its companion DLL from System32. A matching name loaded from elsewhere indicates a sideloading proxy execution.

Malicious Zhong Stealer Loader and Log Artifacts

This rule detects creation of TASLoginBase.dll or TASLogin.log, host artifacts written by the Zhong Stealer during execution and inventory logging. These filenames are unique to the Zhong Stealer toolkit targeting fintech support channels.

Suspicious PowerShell Download to AppData Intel Path

This rule detects PowerShell using DownloadFile to stage a payload into an AppData Intel directory as seen in the Foxit PDF exploitation chain. The attacker hides downloaded miner and RAT payloads under an Intel named folder in the user profile. Detecting the download cradle exposes remote payload retrieval.

Suspicious Node Payload Drop in Local Share Directory (via file_event)

This rule detects creation of a sync.js payload under a hidden NodeJS local-share directory. The M-Red-Team AsyncAPI supply-chain compromise dropped this file after a GitHub Actions pwn-request to stage its second stage. A JavaScript payload written to this unusual location is a strong indicator of implant staging.

Malicious Equation Editor Child Process Execution via process_creation

This rule detects the Microsoft Equation Editor EQNEDT32.EXE spawning any child process which almost always indicates exploitation of the CVE-2017-11882 memory corruption vulnerability. SideWinder delivered RTF documents that exploited Equation Editor to launch mshta.exe and fetch a remote HTA payload against maritime and nuclear targets. Equation Editor never legitimately creates child processes so this is a high confidence exploitation signal.

Malicious secur32.dll Sideload From Color Profile Directory (via image_load)

This rule detects a secur32.dll being loaded from the printer spool color drivers directory rather than System32. ShadowPad was deployed via DLL sideloading using signed hosts such as WindowsUpdate.exe loading a malicious secur32.dll from spool drivers color. A trusted system DLL name loaded from an unexpected writable path indicates search-order hijacking and stealthy backdoor execution.

Malicious Microsoft Defender Tampering via PowerShell MpPreference

This rule detects PowerShell disabling Microsoft Defender real-time monitoring or adding scan exclusions, the defense-evasion step performed by The Gentlemen ransomware before deploying its payload. Tampering with Defender protection settings is a high-confidence indicator of an adversary preparing to run malware unhindered.

Suspicious Shell Spawned by Gogs Git Server on Linux

This rule detects the Gogs Git service process spawning a command shell which indicates exploitation of the CVE-2025-8110 remote code execution used in the wild to deploy Supershell reverse-SSH C2 payloads. A Git hosting service launching an interactive shell is not expected behavior and signals active post-exploitation.

Suspicious PowerShell Download of updserc Archive to AppData via ClickFix

This rule detects PowerShell downloading an archive named updserc.zip into the local AppData directory. This activity is part of a ClickFix phishing chain abusing Booking.com themed lures to stage the PureRAT loader. Pulling a named archive into AppData through PowerShell is an early loader step that precedes DLL side-loading and in-memory execution.

Suspicious High-Privilege Microsoft Graph Application Role Grant via Azure Audit (via azure)

This rule detects the assignment of high-privilege Microsoft Graph application roles such as AppRoleAssignment.ReadWrite.All, Directory.ReadWrite.All, or RoleManagement.ReadWrite.Directory to a service principal, an escalation path into Azure highlighted by Red Canary. Granting these permissions lets an app rewrite directory roles and grant itself further access, making it a powerful and stealthy persistence mechanism that should be tightly controlled.