Sigma detection rules, expert-reviewed

Malicious Hunters International Ransomware Execution via rundll32

This rule detects rundll32.exe executing the Hunters International ransomware encryptor DLL through its Open export with the operator flags used to target running processes. This proxy execution technique masks the ransomware payload behind a signed Windows binary immediately before mass file encryption, making it a critical late-stage indicator.

Suspicious macOS Login Keychain Access via Command Line

This rule detects command line access to the user login keychain database, which the Atomic (AMOS) Stealer copies to harvest stored credentials and secrets. Direct references to login.keychain-db from shell tooling are unusual outside of backup or security software and warrant investigation for credential theft.

Suspicious Scheduled Task BrowserOSR Masquerading as Google Corporation (via process_creation)

This rule detects creation of a scheduled task whose name begins with BrowserOSR and which spoofs the author field as Google Corporation, the persistence mechanism of the RedCurl EarthKapre APT. The task name encodes the victim hostname and the fake Google author disguises the entry among browser update tasks. This pairing of the BrowserOSR prefix with a forged Google author reveals the persistence.

Malicious JuicyPotatoNG Privilege Escalation Tool Execution from Public Directory (via process_creation)

This rule detects execution of the JuicyPotatoNG privilege escalation tool, including from the world-writable C users Public directory used as a drop location in the Telerik exploitation intrusion. The attacker stages tooling such as JuicyPotatoNG and helper batch scripts in Public before abusing token privileges to elevate. Presence of this named tool indicates hands-on privilege escalation activity.

Suspicious mshta or wscript Spawned by Explorer via ClickFix Run Dialog (via process_creation)

This rule detects mshta.exe or wscript.exe being launched directly by explorer.exe, the signature of the ClickFix social engineering technique where the victim pastes a malicious command into the Windows Run dialog. Lumma Stealer uses this flow to execute its loader without a downloaded file on disk. A script host started from explorer through the Run prompt is unusual and warrants inspection.

Suspicious Script Host Launching PowerShell from Fattura Named JScript File (via process_creation)

This rule detects wscript or cscript executing a JScript file using the Fattura naming convention and then spawning PowerShell, the first stage of the MintsLoader delivery chain. The Italian themed Fattura invoice lure drops a .js file that calls WScript Shell Run to launch an obfuscated PowerShell downloader. This script host to PowerShell handoff from an invoice named file marks the loader kickoff.

Malicious Python Execution from Hidden .pyp Directory in Lazarus InvisibleFerret Chain (via process_creation)

This rule detects the Python interpreter running from a hidden .pyp folder inside a user profile, the staging location used by the Lazarus BeaverTail and InvisibleFerret campaign to launch its backdoor and stealer components. The dot-prefixed directory hides a private Python runtime that then executes payloads such as the .sysinfo module. Running python from such a concealed per-user path is not legitimate.

Malicious macOS Keychain Credential Theft via security find-generic-password (via process_creation)

This rule detects abuse of the macOS security command to dump a Chrome keychain secret in plaintext using find-generic-password with the -ga flag. Poseidon Stealer runs this to extract the Chrome Safe Storage key so it can decrypt saved browser credentials. Scripted keychain access targeting browser entries is a reliable sign of credential theft on macOS.

Suspicious rnpkeys Execution from AppData for DLL Side-Loading (via process_creation)

This rule detects the legitimate RNP key utility rnpkeys.exe running from a user AppData Roaming path, where LummaC2 side-loads a malicious rnp.dll to gain execution. The signed binary is relocated into a fake application folder so its adjacent DLL is loaded instead of the genuine library. Execution of this developer tool from a user writable profile directory is highly abnormal.

Suspicious RegAsm Execution Spawned by Script Host for Process Hollowing (via process_creation)

This rule detects the .NET RegAsm utility being launched by a script host or PowerShell, a pattern used by AsyncRAT to hollow the trusted RegAsm.exe process with the NewPE2 injector. RegAsm is a developer registration tool and is not normally started by wscript, cscript, mshta or powershell. This parent-child relationship exposes the injection target used to run the final RAT payload.

Suspicious Virtual Machine Detection via WMI Win32_Process Query (via process_creation)

This rule detects sandbox and virtual machine evasion where a process enumerates running processes through the Win32_Process WMI class while looking for virtualization service binaries such as VboxService.exe or Vmtoolsd.exe. The D3F@ck loader performs this check to abort execution inside analysis environments. Such targeted VM discovery is a strong indicator of evasive malware.

Malicious Windows Defender Root Exclusion via Add-MpPreference (via process_creation)

This rule detects the use of Add-MpPreference to register a broad exclusion path covering an entire drive root such as C. The D3F@ck Malware-as-a-Service loader uses this technique to disable Microsoft Defender scanning of its staging locations before dropping additional payloads. Blanket root exclusions are almost always malicious and blind the endpoint to all downstream tooling.

Suspicious Self-Delete via cmd choice Timeout and Del

This rule detects the cmd choice command used as a timing delay chained with a Del to remove the launching file. Ande Loader used a choice based countdown before deleting itself to erase the dropper after 0bj3ctivity Stealer was staged. This choice plus Del idiom is an anti forensic self cleanup pattern seen across loaders.

Suspicious Python Execution from Hidden Downloads Python Folder

This rule detects a Python interpreter running scripts out of a hidden Downloads Python directory used by the Quartet loader. The campaign staged its interpreter and payloads in concealed Downloads subfolders to persist and execute the RAT quartet. Python launched from this hidden staging path is not normal developer activity.

Suspicious DarkGate AutoIt3 Script Execution from C Test Directory

This rule detects AutoIt3 executing an a3x compiled script from a non standard root path such as C test. DarkGate used a fake reader update to run its a3x from this staging directory before process hollowing. AutoIt scripts running from an unusual top level folder are a strong DarkGate loader indicator.