Sigma detection rules, expert-reviewed

Suspicious CloudScout hxkz_zip Exfiltration Archive Creation via File System

This rule detects creation of files with the .hxkz_zip extension, the custom archive format CloudScout produces to stage stolen browser cookies and cloud session data before exfiltration. This extension is unique to the tooling and is not produced by legitimate software. Its presence indicates collection of session tokens for cloud-service hijacking.

Suspicious HotPage Driver Drop under ShieldNetWork Directory via File System

This rule detects file creation under C:\Windows\ShieldNetWork\, the fixed directory where the HotPage installer drops its encrypted, randomly named vulnerable driver. The ShieldNetWork path is a distinctive artifact of this signed ad-injecting driver campaign. Its appearance indicates staging of a BYOVD component intended to run privileged browser injection code.

Suspicious Lunar Backdoor State File Creation via File System

This rule detects the creation of Lunar backdoor state and configuration files with the distinctive names perfconfm.dat, content.tpl, and outlk.share. These artifacts are dropped by the LunarMail and LunarWeb implants used against European diplomatic missions. Their presence indicates active espionage tooling and stager persistence on the host.

Malicious Vulnerable Driver Load by GentleKiller BYOVD EDR Killer

This rule detects loading of known vulnerable or malicious kernel drivers abused by the GentleKiller BYOVD framework to disable endpoint security. The Gentlemen intrusion set uses these signed drivers to gain kernel access and terminate hundreds of protection processes. Detecting these specific driver names is important because a successful load precedes mass tampering with security tooling and credential theft.

Possible Gamaredon Dead-Drop C2 via Telegraph and GoFile Web Services

This rule detects DNS resolution of api.telegra.ph and gofile.io, legitimate web services abused by Gamaredon in 2025 as dead-drop resolvers and exfiltration channels through its PteroOdd and PteroEffigy tools. The group stores C2 configuration and stages stolen data on these platforms to blend with normal web traffic. Detecting these lookups is important because they reveal web-service based command-and-control and data exfiltration that evades domain reputation controls.

Possible Gamaredon C2 via Ephemeral Tunneling and Worker Services

This rule detects DNS resolution of ephemeral tunneling and serverless worker domains abused by Gamaredon in 2025 for command-and-control, including trycloudflare.com, workers.dev, devtunnels.ms and loophole.site. The group routes implant traffic through these disposable services to hide infrastructure behind trusted providers. Detecting these lookups is useful for spotting covert C2, while acknowledging that developers also use these tunneling services legitimately.

Suspicious SlowStepper DNS TXT C2 Subdomain Lookup via DNS Query

This rule detects DNS lookups to the gsm.360safe.company namespace, the command-and-control domain the SlowStepper backdoor queries over DNS TXT records after the PlushDaemon supply-chain compromise. This subdomain pattern is specific to the actor infrastructure. Its resolution indicates active DNS-based C2 communication.

Malicious OilRig OAuth Application Sign-In via Azure (via azure)

This rule detects Azure AD sign-ins from the OAuth application client ID 860b23a7-d484-481d-9fea-d3e6e129e249 hardcoded in OilRig's cloud-service-powered downloaders. The group abuses this registered application to obtain tokens for Microsoft Graph and EWS based command-and-control, so any sign-in with this AppId indicates C2 activity.

Suspicious Telerik UI RadAsyncUpload Request Indicating CVE-2019-18935 Exploitation (via webserver)

This rule detects requests to the Telerik Web UI WebResource handler with the type rau parameter that drives the RadAsyncUpload component targeted by CVE-2019-18935. Threat actors send crafted requests to this endpoint to deserialize a malicious payload and drop a DLL on the server. Traffic to this specific handler and parameter is a strong exploitation signal for vulnerable Telerik deployments.

Suspicious Microsoft Edge Native Messaging Host Registration via UNC6692

This rule detects registration of a Microsoft Edge native messaging host, the mechanism UNC6692 uses to bridge its sideloaded extension to a local Python messaging host. This channel lets the browser extension execute native code and communicate with attacker tooling. New native messaging host registrations should be validated against known browser integrations.

Malicious Kong RAT Configuration Registry Keys

This rule detects writes to the Software Kong Client registry path used by the Kong RAT distributed through a multi-stage SEO poisoning campaign against Chinese-speaking developers. The malware stores its configuration and state under this dedicated key. Presence of this key indicates an active Kong RAT implant on the host.

Suspicious Run Key Persistence Masquerading as MicrosoftUpdate via Axios npm Compromise

This rule detects a Run key persistence value named MicrosoftUpdate, a masquerade used by the SILKBELL payload delivered through the compromised axios npm package. The benign-looking value name hides a batch launcher that beacons to attacker infrastructure. Autostart entries impersonating Microsoft update services should be validated against their target executable.

Malicious UPlugPlay Service Creation Masquerading as PlugPlay

This rule detects creation of a service named UPlugPlay, the persistence service Prometei installs to masquerade as the legitimate PlugPlay service. The botnet registered an auto-start UPlugPlay service pointing at its sqhost.exe binary to survive reboots. The near-identical service name to a real Windows service is a deliberate masquerade with no legitimate counterpart.

Suspicious SyncFuture GcServices Configuration Key Creation

This rule detects writes to an HKCU Software Microsoft GcServices key, a fake Microsoft-branded configuration store used by SyncFuture malware. The actors stored year and MD5-derived values under this masqueraded key to hold implant configuration. A GcServices subkey under the Microsoft software hive does not correspond to any legitimate product and indicates implant configuration persistence.

Suspicious Startup Persistence via Registry Run Key Pointing to Script

This rule detects a registry Run key value being set to a VBScript or JScript file, a startup persistence method used by Pure Crypter alongside scheduled tasks. Run keys that launch script files at logon are a frequent malware persistence mechanism and should be validated against known good software.