Sigma detection rules, expert-reviewed

Suspicious PIF Payload Assembly via copy /b Binary Concatenation

This rule detects the cmd copy command using the b binary flag to concatenate files into a pif output. An NSIS delivered Industries batch used copy /b to rebuild an AutoIt pif payload before AsyncRAT injection. Binary concatenation into a pif reassembles a split malicious executable to evade static delivery detection.

Suspicious AdsExhaust Batch Persistence in AppData wespmail Folder

This rule detects execution of backup or update batch scripts staged in an AppData Local wespmail directory. The AdsExhaust adware masquerading as the Oculus installer dropped these batch files and scheduled them for persistence. The distinctive folder and script names mark the adware footholding on the host.

Suspicious regsvr32 Registering DLL from User AppData

This rule detects regsvr32 registering a DLL located in a user AppData path. In More_eggs intrusions a WMI launched process fetched a numbered dll that regsvr32 then registered to load the backdoor. Executing DLLs from user writable directories via regsvr32 is a common proxy execution technique for staged malware.

Suspicious More_eggs ie4uinit Copy to AppData Microsoft Folder

This rule detects the signed ie4uinit binary being executed from a user AppData Microsoft folder rather than System32. More_eggs fake job applicant lures copy ie4uinit alongside an attacker written ieuinit inf to abuse its inf handling. Running the LOLBIN from the wrong path enables execution of attacker controlled directives under a trusted name.

Malicious Renamed Python Interpreter svchostc Executing Script (via process_creation)

This rule detects execution of svchostc.exe, a renamed Python interpreter used by FIN7 to run its svchostc.py loader while impersonating the legitimate Windows svchost service host. The genuine binary is svchost.exe, so the trailing character is a masquerade meant to blend into process listings. This executes the FIN7 payload staged from a spoofed brand MSIX.

Malicious FIN7 SYSTEM Scheduled Task Masquerading as Windows Updater (via process_creation)

This rule detects creation of a per-minute SYSTEM scheduled task placed under the Microsoft\Windows\Updater path, the FIN7 persistence mechanism that runs a renamed Python interpreter as SYSTEM. Nesting a custom task inside the Microsoft\Windows tree masquerades as a built-in maintenance job while the minute interval and SYSTEM context reveal malicious intent. This sustains the NetSupport RAT foothold.

Suspicious Pastebin Raw Content Retrieval via curl (via process_creation)

This rule detects curl fetching raw content from pastebin.com, the technique the D3F@ck loader batch uses to retrieve a follow-on download URL into url.txt. Pulling raw Pastebin text via curl on an endpoint is a common staging pattern for loaders and is atypical of normal user activity. This drives the loader's ingress of the 125.exe payload.

Suspicious PowerShell Spawned from PyInstaller MEI Extraction Folder (via process_creation)

This rule detects powershell.exe spawned by a process running from a PyInstaller _MEI extraction folder under the user Temp directory, matching SolarMarker's shift to PyInstaller-packed loaders. The bundled Python script decodes base64 and invokes PowerShell with a hidden window, so a PowerShell child of a _MEI process is anomalous. This stages the SolarMarker backdoor.

Suspicious Double-Extension PDF JavaScript Lure via WScript (via process_creation)

This rule detects Windows Script Host executing a file whose name uses a .pdf .js double extension, the lure format in the XWorm tax scam where Tax-docs-2023.pdf .js masquerades as a PDF. The trailing .js reveals it as a script rather than a document, and wscript execution launches the PowerShell downloader. This is the initial-execution stage of the campaign.

Suspicious VBScript Execution from Public User Directory (via process_creation)

This rule detects Windows Script Host running a VBScript dropped into the C\Users\Public directory, matching the tax-themed GuLoader chain where a .lnk uses PowerShell to save Fjoua.vbs to Public before execution. The Public folder is an atypical location for legitimate scripts and is chosen to evade per-user monitoring. This stages GuLoader to deliver the Remcos RAT.

Malicious Koi Loader Scheduled Task Masquerading as Firefox Agent (via process_creation)

This rule detects creation of a scheduled task named Firefox Default Browser Agent that launches wscript, the persistence trick used by Koi Loader to run agent.js under a legitimate-sounding Mozilla task name. The genuine Firefox task executes default-browser-agent.exe rather than a script host, so a wscript action is false context. Koi Loader is a precursor to the Koi Stealer.

Suspicious .NET Utility Launched as Process Injection Target (via process_creation)

This rule detects MSBuild.exe or RegAsm.exe running without any project, solution or assembly argument, the state in which FakeBat IDAT loader and Payk RunPE hollow these signed .NET utilities to host SectopRAT. Legitimate invocations reference a build file or assembly, so argument-less execution indicates process hollowing. This is the injection stage of Google Ads malvertising via MSIX.

Malicious PsExec SYSTEM Interactive Shell Execution (via process_creation)

This rule detects PsExec spawning an interactive SYSTEM-level command shell via the -i -s cmd.exe pattern, used by attackers for privileged lateral movement during ransomware precursor activity. Running cmd.exe as SYSTEM interactively is characteristic of hands-on intrusion rather than legitimate administration. This activity accompanied Cobalt Strike staging on the network.

Suspicious Credential Dump Attempt via Task Manager (via process_creation)

This rule detects Task Manager launched with the /4 switch, used during ransomware precursor activity to create a process memory dump for credential harvesting. Interactive Task Manager use does not normally include this command-line flag, making it a strong indicator of scripted credential access. It was part of a hands-on-keyboard intrusion via a compromised vendor account.

Suspicious Encoded JScript Execution via WScript (via process_creation)

This rule detects Windows Script Host executing an encoded JScript file with the .jse extension, matching the Fenix botnet chain where a .url shortcut launches rfc.jse to stage a .NET loader. Encoded .jse files are rare in legitimate enterprise activity and are used here to hinder analysis before shellcode is injected into AuthHost.exe. This catches the early execution stage of the LATAM banking malware.