Sigma detection rules, expert-reviewed

Possible Linux Hardware Reconnaissance via Dmidecode Baseboard Query

This rule detects execution of dmidecode requesting baseboard information, a host-fingerprinting step used by the Prometei botnet alongside reads of /proc/cpuinfo. Malware profiles infected systems this way before cryptomining. While inventory tools may use dmidecode, its use by unexpected parents warrants review.

Suspicious Quick Assist Spawning Command Interpreter or Download Tooling via Process Creation

This rule detects the Quick Assist remote assistance tool spawning a command interpreter or download utility, a technique used in social engineering attacks where operators abuse Quick Assist to run scripted downloads. Storm-1811 leveraged this to fetch Qakbot and Cobalt Strike leading to Black Basta ransomware, so a legitimate support binary launching cmd, PowerShell or curl warrants investigation.

Malicious curl Insecure Download to AppData or Temp

This rule detects curl.exe writing a downloaded file into the AppData or Temp directory using the insecure flag, the ClickFix installation pattern used in OpenClaw brand-lure campaigns to fetch infostealer payloads before immediate execution. Attackers instruct victims to paste a terminal command that curls the payload to a user writable path. Downloading executables into AppData or Temp with certificate checks disabled is a strong staging indicator.

Suspicious Defender Exclusion for Public Controller Path (via process_creation)

This rule detects PowerShell adding a Microsoft Defender exclusion for a Controller folder under C:\Users\Public as done by the Efimer Trojan to protect its payload. Whitelisting an attacker-controlled directory in a world-writable location lets the malware run and update without being scanned. This combination of Add-MpPreference and a public path is rarely legitimate.

Suspicious CTFMON Masquerade Persistence via Run Key (via registry_set)

This rule detects a Run key value referencing a ctfmon.bat script, a persistence mechanism used by the SugarGh0st RAT that masquerades as the legitimate CTFMON input service. The batch launcher re-executes the malware at logon while blending in with expected process names.

Suspicious Script Execution from Alternate Data Stream via WScript

This rule detects wscript executing content stored in an alternate data stream, seen when an APT targeting Vietnamese human rights defenders hid a PowerShell scheduler in a log.txt ADS. Execution from a colon-delimited stream path conceals the payload from casual file inspection. ADS-hosted scripts are a defense evasion technique used to stage hidden persistence.

LegionLoader Process Hollowing via SysWOW64 explorer.exe Self-Invocation (via process_creation)

This rule detects explorer.exe launched with explorer.exe passed as its own argument, the anomalous invocation used by the LegionLoader shellcode to spawn a SysWOW64 explorer.exe target for process hollowing. Legitimate Windows shell launches never pass the binary name as a command-line argument, so this pattern surfaces the injection host before LegionLoader is mapped into memory.

Suspicious Run Key Persistence Pointing to Temp or Public Folder

This rule detects creation of autorun registry values whose payload path resides in a temporary or public user writable directory which Phobos ransomware uses to survive reboots. Legitimate software rarely persists from these transient locations so this pattern is a reliable indicator of malicious persistence.

Suspicious PowerShell Download of scrss or ekrn Masquerading Scripts

This rule detects PowerShell referencing scrss.ps1 or ekrn.ps1, downloader script names used in the Gamaredon and Turla collaboration to fetch and stage further payloads. The script names imitate the legitimate csrss and ESET ekrn processes, and their presence in PowerShell activity indicates masqueraded ingress tooling and command execution.

Obfuscated Firewall Deactivation - Modern Command (via process_creation)

This rule detects disabled the Windows Firewall to evade defense.

Suspicious Encoded PowerShell Command Execution (via process_creation)

This rule detects PowerShell invoked with an encoded command payload passed through the EncodedCommand parameter. Adversaries base64-encode PowerShell to obscure their commands from casual inspection and simple content filters. While some administrative tooling encodes commands, encoded PowerShell on user endpoints is a frequent execution and obfuscation indicator worth reviewing.

Suspicious Disabling of Linux Audit or System Logging (via process_creation)

This rule detects commands that stop or clear auditd or rsyslog, a defense-impairment technique used to blind host logging before further attacker activity on Linux. Disabling audit and system logging is tracked in the Red Canary Threat Detection Report. Detecting these commands surfaces telemetry being cut.

Malicious VoidLink Kernel Module Load via Insmod (via process_creation)

This rule detects loading of the VoidLink rootkit kernel modules via insmod or modprobe under masquerading and rootkit names. Observed in Elastic Security Labs analysis where vl_stealth.ko or a fake amd_mem_encrypt.ko module installs ftrace syscall hooks and eBPF-based hiding to conceal the framework.

Malicious DLL Sideloading of screen_retriever_plugin via TCLBANKER Loader

This rule detects the signed logiaipromptbuilder executable loading a screen_retriever_plugin DLL used to sideload the TCLBANKER banking trojan in Elastic research. Abusing a trusted host binary to load an attacker controlled DLL of this name lets the trojan execute under a legitimate process context.

Suspicious Process Injection via mavinject INJECTRUNNING

This rule detects mavinject.exe injecting a DLL into a running process via the INJECTRUNNING flag, a living-off-the-land process injection technique observed in Lancefly intrusions to load the Merdoor backdoor.