Sigma detection rules, expert-reviewed

Suspicious .NET Utility Launched as Process Injection Target (via process_creation)

This rule detects MSBuild.exe or RegAsm.exe running without any project, solution or assembly argument, the state in which FakeBat IDAT loader and Payk RunPE hollow these signed .NET utilities to host SectopRAT. Legitimate invocations reference a build file or assembly, so argument-less execution indicates process hollowing. This is the injection stage of Google Ads malvertising via MSIX.

Malicious PsExec SYSTEM Interactive Shell Execution (via process_creation)

This rule detects PsExec spawning an interactive SYSTEM-level command shell via the -i -s cmd.exe pattern, used by attackers for privileged lateral movement during ransomware precursor activity. Running cmd.exe as SYSTEM interactively is characteristic of hands-on intrusion rather than legitimate administration. This activity accompanied Cobalt Strike staging on the network.

Suspicious Credential Dump Attempt via Task Manager (via process_creation)

This rule detects Task Manager launched with the /4 switch, used during ransomware precursor activity to create a process memory dump for credential harvesting. Interactive Task Manager use does not normally include this command-line flag, making it a strong indicator of scripted credential access. It was part of a hands-on-keyboard intrusion via a compromised vendor account.

Suspicious Encoded JScript Execution via WScript (via process_creation)

This rule detects Windows Script Host executing an encoded JScript file with the .jse extension, matching the Fenix botnet chain where a .url shortcut launches rfc.jse to stage a .NET loader. Encoded .jse files are rare in legitimate enterprise activity and are used here to hinder analysis before shellcode is injected into AuthHost.exe. This catches the early execution stage of the LATAM banking malware.

Malicious XRed Backdoor Execution from ProgramData Synaptics Path (via process_creation)

This rule detects execution of Synaptics.exe from the ProgramData\Synaptics directory, the drop location used by the XRed backdoor bundled inside trojanized InstantView software. A genuine Synaptics touchpad driver never runs from ProgramData, so this path is a strong false-context indicator. The backdoor provides remote command execution, screen capture, keylogging and SMTP exfiltration.

Suspicious File Hiding via attrib Plus H in Java RAT Persistence Setup

This rule detects attrib.exe setting the hidden attribute on files spawned from a Java process, the concealment step used by the tax scam Java RAT after copying itself for Startup and Run key persistence. Marking dropped files hidden keeps the malware out of sight from users browsing their own directories.

Suspicious Per-Minute Scheduled Task Persistence via schtasks

This rule detects schtasks creating a task that runs every minute, the aggressive persistence and re-execution cadence used by Blind Eagle to keep its loader alive. A minute interval schedule is unusual for legitimate software and typically indicates malware ensuring rapid respawn.

Suspicious Ping Loopback Delay Followed by File Deletion for Evasion

This rule detects a cmd chain that pings the loopback address with a repeat count to sleep and then deletes a file, the self cleanup and timing evasion used in the Blind Eagle campaign. Using ping as a sleep before deleting the dropper stalls sandboxes and removes artifacts after execution.

Malicious XMRig GhostRider Coinminer Execution with Mining Pool Arguments

This rule detects execution of an XMRig based miner using the ghostrider algorithm and a zpool mining endpoint, the resource hijacking payload deployed on the compromised Tomcat server. Mining command line flags for algorithm and pool are a reliable indicator of unauthorized cryptomining consuming host resources.

Suspicious Remote Script Download Piped to Shell via Wget or Curl on Linux

This rule detects wget or curl output piped directly into a shell interpreter on Linux, the initial execution used to deliver a coinminer after exploiting a vulnerable Tomcat server. Piping a downloaded script straight into sh runs attacker code in memory without ever writing an inspectable file to disk.

Suspicious NetSupport client32 Execution from User Writable Path

This rule detects the NetSupport Manager client32.exe running from a user writable directory such as AppData, Temp or ProgramData, the deployment pattern used by SmartApeSG to run NetSupport RAT for remote control. Legitimate NetSupport installs live under Program Files, so execution from a staging folder indicates malicious remote access tooling.

Suspicious Script Host Spawning PowerShell from Fake Browser Update JS

This rule detects wscript or cscript executing a JScript file and spawning PowerShell, the delivery chain used by SmartApeSG fake browser update lures to pull a base64 encoded NetSupport payload. A JavaScript file launching PowerShell is a strong sign of a drive by download rather than legitimate scripting.

Suspicious Curl Download of DAT Payload Followed by Rundll32 Execution

This rule detects curl.exe retrieving a file with a DAT extension, the payload staging step used by Pikabot before renaming it to a DLL and loading it with rundll32. Attackers use a benign looking data extension to slip the loader past extension based controls.

Suspicious Remote Process Creation and Admin Share Copy via WMIC and Xcopy

This rule detects wmic process call create and xcopy operations targeting an administrative C dollar share, the lateral movement pattern used by WorkersDevBackdoor to stage and launch payloads on remote hosts. Copying to admin shares and invoking remote process creation lets attackers spread without dropping new remote access tooling.

Suspicious Microsoft.NodejsTools.PressAnyKey LOLBAS Proxy Execution

This rule detects execution of Microsoft.NodejsTools.PressAnyKey.exe, a living-off-the-land binary abused by WorkersDevBackdoor to proxy execute an arbitrary command passed as its argument. This signed helper is rarely present outside Visual Studio Node.js debugging, so its use to spawn other processes indicates malicious proxy execution.