Sigma detection rules, expert-reviewed

Suspicious Startup Persistence via Registry Run Key Pointing to Script

This rule detects a registry Run key value being set to a VBScript or JScript file, a startup persistence method used by Pure Crypter alongside scheduled tasks. Run keys that launch script files at logon are a frequent malware persistence mechanism and should be validated against known good software.

Suspicious Winos4.0 Configuration Registry Keys under HKCU Console IpDate (via registry_set)

This rule detects creation of the Winos4.0 configuration values stored under HKCU Console IpDate and HKCU Software IpDates_info during the CleverSoar campaign. The malware abuses the Console registry branch to persist shellcode and staging data using these distinctive value names. Legitimate software does not write IpDate style keys into the Console hive, making this a precise indicator of the online module component.

Suspicious Zloader Configuration Registry Key under HKCU Microsoft hcdg (via registry_set)

This rule detects creation of the unusual hcdg subkey under HKCU Software Microsoft, a location Zloader uses to store its encrypted configuration and campaign state. The key name does not correspond to any legitimate Microsoft product and its placement under the trusted Microsoft branch is meant to blend in. Detection of this specific key exposes Zloader persistence and configuration storage.

Suspicious Fodhelper UAC Bypass ms-settings Command Registry Modification

This rule detects creation of the HKCU ms-settings shell open command key used to hijack fodhelper.exe for a UAC bypass, a technique used in the Ducktail PowerShell chain to gain elevation. Attackers stage a payload path in this key so that auto-elevated fodhelper executes it without a consent prompt.

Suspicious File Association Shell Command Handler Hijack via Registry

This rule detects modification of a shell open command handler under the user Classes hive, a file-association hijack SolarMarker uses to trigger its payload when a document type is opened. Redirecting the open command executes attacker code transparently. Detecting the change exposes execution-hijack persistence.

Suspicious User Shell Folders Startup Redirect for Persistence via Registry

This rule detects modification of the User Shell Folders Startup value, redirecting the startup directory to an attacker-controlled path for persistence. This registry hijack was seen in fake browser update infections chaining LummaC and Amadey. Detecting the redirect exposes a stealthy autostart mechanism outside the normal Startup folder.

Suspicious Archive Expansion into Public User Directory via PowerShell (via ps_script)

This rule detects PowerShell Expand-Archive activity that extracts content into the C users Public directory, a world-writable staging location abused by the AsyncRAT infostealer chain. Combined with the BITS download of the original archive this reveals payload unpacking prior to execution. Legitimate software rarely unpacks archives into the Public profile.

Suspicious PowerShell .NET Extraction from JPG with Base64 Marker

This rule detects PowerShell reading a jpg image and carving an embedded payload delimited by a base64 start marker. Ande Loader hid an AES encrypted .NET assembly inside a new image jpg between BASE64_START markers before hollowing AddInProcess32. Extracting executable code from an image file this way is a steganography style loader technique.

Malicious Whole-Drive Defender Exclusion via Add-MpPreference (via ps_script)

This rule detects a PowerShell command adding the entire C drive as a Microsoft Defender exclusion path via Add-MpPreference, the defense-evasion step used by the D3F@ck MaaS loader before dropping payloads. Excluding the whole system drive from scanning is never a legitimate administrative action and effectively blinds Defender. This precedes RegAsm.exe injection of Raccoon Stealer.

Suspicious BeaverTail C2 Download over Non-Standard Port 1224 (via proxy)

This rule detects HTTP requests to the BeaverTail command and control endpoint that serves the next stage over TCP port 1224 with a pdown download path. The Lazarus loader retrieves its encoded Python downloader from this fixed port and URI pattern. The combination of the unusual high port and the pdown resource distinguishes this beacon from ordinary web traffic.

Malicious FIN7 DiceLoader C2 via Placeholder User-Agent (via proxy)

This rule detects command-and-control traffic carrying the literal placeholder user-agent myUserAgentHere, left hardcoded in the FIN7 DiceLoader beacon to cdn*.space infrastructure. No legitimate software presents this developer placeholder string, making it a high-confidence C2 indicator. It surfaces active FIN7 post-exploitation communication.

Malicious D3f@ck Loader C2 via Java User-Agent Ready Beacon (via proxy)

This rule detects D3F@ck loader command-and-control traffic identified by the hardcoded Java/1.8.0_101 user-agent combined with an event=ready status parameter in the request URI. This loader reports staged status values such as ready, downloaded and finished to its C2. The fixed Java user-agent from a non-Java host is a strong indicator of the loader beacon.

Suspicious Telegraph-Hosted Encrypted Payload Retrieval (via proxy)

This rule detects retrieval of .gpg or .dat files from telegra.ph, the abused public publishing service used by the FakeBat Payk RunPE arsenal to host second-stage encrypted payloads. Legitimate Telegraph articles do not serve encrypted binary blobs, so this pattern indicates staged malware delivery. It follows MSIX-based malvertising infections.

Suspicious Tycoon Phishing-as-a-Service Credential Exfiltration Path (via proxy)

This rule detects HTTP POST requests to the /web6/info endpoint used by the Tycoon Phishing-as-a-Service platform to exfiltrate harvested credentials, cookies and MFA tokens from voicemail-themed phishing pages. The /web6/ path structure is served alongside XOR-obfuscated JavaScript and a Cloudflare Turnstile evasion prompt. This adversary-in-the-middle flow enables session and 2FA bypass.

Suspicious Scheduled Task With Cyrillic Autorun Name via UNC6692

This rule detects creation of a scheduled task whose name contains the Cyrillic word for autorun. UNC6692 names its persistence task with this Cyrillic label followed by a GUID after Quick Assist based intrusion. Scheduled task names in Cyrillic on predominantly English endpoints are a strong anomaly indicating this actor.