Sigma detection rules, expert-reviewed

Suspicious Windows Terminal Binary Masquerade From ProgramData via Axios npm Compromise

This rule detects a process named wt.exe executing from the ProgramData directory. The legitimate Windows Terminal binary ships under WindowsApps, so a wt.exe copy in ProgramData is the SILKBELL loader masquerading through the axios npm supply chain compromise. Placing a renamed payload in a trusted-sounding location evades name-based allowlisting.

Suspicious PowerShell Host and Locale Reconnaissance via MuddyWater Tsundere Botnet

This rule detects PowerShell enumerating the video controller hardware together with the installed UI culture in a single command. This combined host and locale fingerprinting is used by the MuddyWater Tsundere botnet to profile victims and filter sandboxes before staging its Ethereum-based command and control. Such reconnaissance precedes payload delivery and warrants investigation.

Suspicious node.exe Spawning tasklist Process Enumeration

This rule detects a Node.js process spawning tasklist with CSV no-header output, the process-enumeration recon used by OmniStealer to identify security tooling. The malware parsed the CSV process list to hash and match process names before attempting to terminate defenders. A node.exe parent running tasklist in this scripted format indicates automated host reconnaissance by the RAT.

Suspicious node.exe Spawning PowerShell Get-Clipboard

This rule detects a Node.js process spawning PowerShell to run Get-Clipboard, the clipboard-theft behavior of the North Korean DEV#POPPER RAT. The malware, launched from a weaponized developer repository, harvested clipboard contents to steal secrets and seed phrases. A node.exe parent invoking Get-Clipboard is a strong indicator of the DEV#POPPER collection stage.

Suspicious Disabling of WinRM Service via sc config

This rule detects the sc command setting the WinRM service start type to disabled, an impair-defenses step observed in the Prometei intrusion. Disabling WinRM reduces remote management and logging capabilities that defenders rely on during response. While admins occasionally disable WinRM, doing so alongside other malware activity is a meaningful defense-evasion signal.

Suspicious netsh Firewall Rule Masquerading as SSTP HTTP

This rule detects netsh adding a firewall rule named after the Secure Socket Tunneling Protocol, the masquerade Prometei used to allow its sqhost.exe binary through the firewall. The botnet created an inbound allow rule with an SSTP-themed name to blend its C2 access into normal-looking firewall configuration. This masqueraded rule name combined with netsh firewall additions indicates malicious network enabling.

Malicious Enabling of Test Signing Mode via bcdedit

This rule detects bcdedit enabling testsigning mode on the system, a step in the SyncFuture espionage chain to load unsigned or improperly signed drivers. The actors turned on test signing so their transplanted-signature driver components would load despite failing normal signature checks. Enabling testsigning is a rare, high-impact defense-evasion action with almost no legitimate production use.

Malicious PowerShell StreamReader WebRequest Download Cradle

This rule detects PowerShell constructing an IO.StreamReader over a Net.WebRequest response stream and executing it, the fileless NetSupport RAT ClickFix cradle. The loader used this in-memory download-and-execute technique to pull its next stage without writing a script to disk. Reflective download cradles built from StreamReader and WebRequest are almost exclusively malicious.

Suspicious PowerShell UTF8 OutputEncoding Command Wrapper

This rule detects PowerShell command lines that set OutputEncoding to a UTF8 encoding object before running an inline command, the wrapper ChaosBot used for every shell command it executed. The Rust bot prefixed all remote commands with this OutputEncoding assignment to reliably capture and exfiltrate output over Discord. While some scripts set encoding, this exact inline pattern combined with remote command execution is suspicious.

Malicious UAC Bypass via HKCU Environment windir Hijack

This rule detects reg add writing a windir value under the HKCU Environment key, the environment-variable hijack half of the SilentCleanup UAC bypass used by NightshadeC2. The botnet set windir to its payload path so an auto-elevating scheduled task would launch its code with high integrity. Poisoning the windir user environment variable is a well-known privilege-escalation technique with no legitimate use.

Suspicious Data Exfiltration via Rclone Remote Copy

This rule detects rclone-style command lines that reference a config file and copy data to a remote destination, matching the Sinobi exfiltration step. The actors ran rclone with a custom config to copy victim data to attacker-controlled cloud storage before encryption. Bulk copy to a remote target via rclone flags is a common precursor to double-extortion ransomware.

Suspicious Service binPath Hijack Followed by System Reboot

This rule detects the sc command rewriting a service binPath in the same command line that triggers shutdown /r, matching the Sinobi tactic of hijacking a security service to run a dropped binary after reboot. The actors repointed the cbdefense service to a ProgramData executable and immediately forced a restart to load it. Combining a service binary reconfiguration with a reboot is a strong indicator of persistence and defense evasion.

Malicious Account Added to Domain Admins via net localgroup

This rule detects a local user being added to the Domain Admins group using net localgroup. Sinobi operators created an account and elevated it into privileged groups including Domain Admins after abusing compromised SonicWall SSL VPN credentials. Adding a fresh account to Domain Admins is a high-confidence sign of privilege escalation and preparation for domain-wide ransomware deployment.

Malicious PowerShell Clipboard Script Execution via ScriptBlock Create

This rule detects PowerShell reading the clipboard and executing it through ScriptBlock Create, the core of the Interlock ClickFix lure. Victims were tricked into pasting a command that pipes a downloaded payload to the clipboard and then runs Get-Clipboard as a script block. This clipboard-to-execution pattern lets attackers gain code execution while hiding the real command from the user.

Suspicious rundll32 Execution of PNG File as DLL

This rule detects rundll32.exe being pointed at a file with a .png extension and a start export, which loads the image as a DLL. Interlock masqueraded its DLL payloads with .png and other benign extensions to bypass file-type inspection and defender expectations. Executing a renamed DLL through rundll32 is a defense-evasion technique used to stage the next loader stage.