Sigma detection rules, expert-reviewed

Malicious D3f@ck Loader C2 via Java User-Agent Ready Beacon (via proxy)

This rule detects D3F@ck loader command-and-control traffic identified by the hardcoded Java/1.8.0_101 user-agent combined with an event=ready status parameter in the request URI. This loader reports staged status values such as ready, downloaded and finished to its C2. The fixed Java user-agent from a non-Java host is a strong indicator of the loader beacon.

Suspicious Telegraph-Hosted Encrypted Payload Retrieval (via proxy)

This rule detects retrieval of .gpg or .dat files from telegra.ph, the abused public publishing service used by the FakeBat Payk RunPE arsenal to host second-stage encrypted payloads. Legitimate Telegraph articles do not serve encrypted binary blobs, so this pattern indicates staged malware delivery. It follows MSIX-based malvertising infections.

Suspicious Tycoon Phishing-as-a-Service Credential Exfiltration Path (via proxy)

This rule detects HTTP POST requests to the /web6/info endpoint used by the Tycoon Phishing-as-a-Service platform to exfiltrate harvested credentials, cookies and MFA tokens from voicemail-themed phishing pages. The /web6/ path structure is served alongside XOR-obfuscated JavaScript and a Cloudflare Turnstile evasion prompt. This adversary-in-the-middle flow enables session and 2FA bypass.

Suspicious Scheduled Task With Cyrillic Autorun Name via UNC6692

This rule detects creation of a scheduled task whose name contains the Cyrillic word for autorun. UNC6692 names its persistence task with this Cyrillic label followed by a GUID after Quick Assist based intrusion. Scheduled task names in Cyrillic on predominantly English endpoints are a strong anomaly indicating this actor.

Suspicious ClickFix PowerShell Download Cradle via TAG-150 Tradecraft

This rule detects a PowerShell download cradle that pipes a fetched script directly into Invoke-Expression using the wget alias. TAG-150 delivers its Griffin20 loader through this ClickFix one-liner that pulls and runs the next stage in memory. In-memory execution of a downloaded script is a strong indicator of fileless staging.

Malicious PowerShell Base64 Exfiltration to save.php via EKZ Stealer

This rule detects PowerShell posting data with UploadString to a save.php endpoint, the exfiltration channel used by the EKZ Stealer following Fortinet exploitation. Base64-encoded stolen data including credentials is sent to the attacker web handler. Outbound UploadString calls to a save.php target strongly indicate data theft over the C2 channel.

Malicious PowerShell Download of FortiEndpoint Patch Masquerade via EKZ Stealer

This rule detects PowerShell using WebClient DownloadFile to retrieve a payload named FortiEndpoint_Patch.exe into ProgramData. This masquerade is used after exploitation of Fortinet CVE-2026-35616 to stage the EKZ Stealer while posing as a security patch. Downloading a fake endpoint patch via PowerShell indicates active post-exploitation tooling.

Suspicious Quick Assist Remote Tool Launched by Explorer via Nimbus RAT Lure

This rule detects the Quick Assist remote assistance tool being launched from Explorer, the entry point in the Nimbus RAT campaign where actors impersonate IT support over Microsoft Teams. Attackers guide victims to start Quick Assist to gain hands-on-keyboard access before dropping the Java RAT. Because Quick Assist has legitimate support uses this warrants correlation with unexpected external sessions.

Suspicious Registry Import of Nimbus RAT Configuration via Regedit

This rule detects regedit.exe silently importing an InboxCorePro registry file, a step the Nimbus RAT uses to apply its configuration and persistence keys. The reg file is dropped alongside the Java payload in the ProgramData install directory. Automated registry imports referencing the malware family name indicate implant setup.

Malicious Nimbus RAT Java Archive Execution From ProgramData

This rule detects javaw.exe running the InboxCorePro Java archive used by the Nimbus RAT that is delivered through Microsoft Teams social engineering and Google Drive staging. The malware installs under ProgramData InboxCorePro and executes its Java payload silently. This launch confirms the Java remote access trojan is active on the endpoint.

Suspicious Delayed Expansion Command Obfuscation Building PowerShell via Amatera Stealer

This rule detects cmd.exe using delayed variable expansion to concatenate fragmented strings that reassemble the word powershell at runtime. The Amatera Stealer 4.0.2 loader splits pow and ershell across set commands to defeat static string matching before invoking an encoded PowerShell stage. This command-line obfuscation is a strong indicator of staged stealer execution.

Suspicious Scheduled Task Creation for Kong RAT Persistence

This rule detects creation of a scheduled task whose name begins with SimpleActivityScheduleTimer, a fixed prefix used by the Kong RAT for persistence in the SEO poisoning campaign. The randomized GUID suffix varies while the descriptive prefix remains constant. Scheduled tasks matching this naming scheme reestablish the implant across reboots.

Suspicious Windows Terminal Binary Masquerade From ProgramData via Axios npm Compromise

This rule detects a process named wt.exe executing from the ProgramData directory. The legitimate Windows Terminal binary ships under WindowsApps, so a wt.exe copy in ProgramData is the SILKBELL loader masquerading through the axios npm supply chain compromise. Placing a renamed payload in a trusted-sounding location evades name-based allowlisting.

Suspicious PowerShell Host and Locale Reconnaissance via MuddyWater Tsundere Botnet

This rule detects PowerShell enumerating the video controller hardware together with the installed UI culture in a single command. This combined host and locale fingerprinting is used by the MuddyWater Tsundere botnet to profile victims and filter sandboxes before staging its Ethereum-based command and control. Such reconnaissance precedes payload delivery and warrants investigation.

Suspicious node.exe Spawning tasklist Process Enumeration

This rule detects a Node.js process spawning tasklist with CSV no-header output, the process-enumeration recon used by OmniStealer to identify security tooling. The malware parsed the CSV process list to hash and match process names before attempting to terminate defenders. A node.exe parent running tasklist in this scripted format indicates automated host reconnaissance by the RAT.