Sigma detection rules, expert-reviewed

Malicious Interlock LNK Execution via rundll32 ShellExec_RunDLL

This rule detects rundll32.exe invoking the shell32.dll ShellExec_RunDLL function to launch a masqueraded LNK file. The Interlock KongTuke ClickFix chain used this technique to execute a dropped shortcut as part of its multi-stage loader. Proxying execution through a signed binary lets attackers run their payload while evading application controls that trust rundll32.

Suspicious csc.exe Spawned by Document Reader for Process Injection

This rule detects the C# compiler being launched by the hpreader host process, which Ghost Crypt abuses as an injection target using a debugger-based process hypnosis technique to load PureRAT. A document reader spawning csc.exe is not expected behavior and points to code injection into a benign child process.

Malicious ClickFix MSI Download and Execution via PowerShell

This rule detects PowerShell using curl to download an MSI installer to disk, the ClickFix delivery chain used to stage DeerStealer. Victims are socially engineered into pasting a Run-dialog command that fetches and installs a malicious package, so a scripted curl download of an .msi followed by installation is a high-fidelity infection indicator.

Suspicious Miner Operator Account Creation Named samsungmid

This rule detects creation of the local account name observed in the Samsung MagicINFO cryptomining intrusion, where the attacker added a persistent account and granted it administrative and remote desktop access. Creation of this specific account name is a targeted indicator of the unauthorized mining campaign establishing persistent access.

Suspicious Active Directory Enumeration via PowerShell DirectorySearcher

This rule detects PowerShell using the DirectoryServices DirectorySearcher class to enumerate Active Directory objects, a domain reconnaissance technique used by RansomHub affiliates. Scripted LDAP searching through DirectorySearcher is rarely performed by ordinary users and commonly precedes lateral movement and privilege escalation.

Suspicious Python Runtime Executed from ProgramData

This rule detects the windowless Python interpreter executing from within ProgramData, a technique RansomHub affiliates used after unpacking a portable Python archive to run tooling and scheduled tasks. A pythonw.exe process running from ProgramData rather than a standard installation directory is abnormal and often indicates attacker-deployed scripting.

Suspicious System Reconnaissance Output Redirected to Temp rad File

This rule detects cmd.exe running host and network reconnaissance commands with output redirected to a temporary rad file, a collection pattern used by RansomHub affiliates staging SocGholish activity. Piping discovery command results into a randomized rad.tmp file for later exfiltration is an early hands-on-keyboard indicator.

Suspicious PowerShell Download Cradle via Net.WebClient DownloadFile

This rule detects PowerShell invoking the Net.WebClient DownloadFile method, a download cradle used by KoiLoader shortcut droppers to retrieve secondary payloads. Scripted retrieval of remote files through the .NET web client is a common ingress technique for loaders and should be reviewed in context.

Malicious KoiLoader Persistence via Scheduled Task Running WScript

This rule detects the creation of a high-frequency scheduled task that launches WScript against a JavaScript file staged in ProgramData, the persistence mechanism used by KoiLoader. The one-minute recurrence combined with a script under ProgramData is characteristic of KoiLoader maintaining execution to fetch the KoiStealer payload.

Suspicious Local Account Creation Matching Hunters International Naming

This rule detects the creation of local accounts using names observed in Hunters International intrusions that masquerade as legitimate service or administrator accounts. Attackers created these accounts after exploiting a FortiOS authentication bypass to establish persistent privileged access, so this naming combined with account creation is a targeted persistence indicator.

Suspicious Data Exfiltration via rclone

This rule detects the rclone utility copying data to a remote destination, a technique Hunters International affiliates used alongside WinSCP to stage and exfiltrate victim data prior to encryption. rclone with configuration and copy flags in an enterprise environment is a strong sign of automated data theft to cloud storage.

Malicious Hunters International Ransomware Execution via rundll32

This rule detects rundll32.exe executing the Hunters International ransomware encryptor DLL through its Open export with the operator flags used to target running processes. This proxy execution technique masks the ransomware payload behind a signed Windows binary immediately before mass file encryption, making it a critical late-stage indicator.

Suspicious macOS Login Keychain Access via Command Line

This rule detects command line access to the user login keychain database, which the Atomic (AMOS) Stealer copies to harvest stored credentials and secrets. Direct references to login.keychain-db from shell tooling are unusual outside of backup or security software and warrant investigation for credential theft.

Suspicious Scheduled Task BrowserOSR Masquerading as Google Corporation (via process_creation)

This rule detects creation of a scheduled task whose name begins with BrowserOSR and which spoofs the author field as Google Corporation, the persistence mechanism of the RedCurl EarthKapre APT. The task name encodes the victim hostname and the fake Google author disguises the entry among browser update tasks. This pairing of the BrowserOSR prefix with a forged Google author reveals the persistence.

Malicious JuicyPotatoNG Privilege Escalation Tool Execution from Public Directory (via process_creation)

This rule detects execution of the JuicyPotatoNG privilege escalation tool, including from the world-writable C users Public directory used as a drop location in the Telerik exploitation intrusion. The attacker stages tooling such as JuicyPotatoNG and helper batch scripts in Public before abusing token privileges to elevate. Presence of this named tool indicates hands-on privilege escalation activity.