Sigma detection rules, expert-reviewed

Suspicious Microsoft.NodejsTools.PressAnyKey LOLBAS Proxy Execution

This rule detects execution of Microsoft.NodejsTools.PressAnyKey.exe, a living-off-the-land binary abused by WorkersDevBackdoor to proxy execute an arbitrary command passed as its argument. This signed helper is rarely present outside Visual Studio Node.js debugging, so its use to spawn other processes indicates malicious proxy execution.

Suspicious RegAsm Spawned as Process Hollowing Target

This rule detects RegAsm.exe launched as a child of script hosts such as wscript, cscript or powershell, a process hollowing target abused by SwaetRAT and Ande Loader to run injected code under a signed .NET utility. RegAsm normally runs during development, so execution from a scripting parent indicates injection rather than legitimate assembly registration.

Suspicious Antivirus Product Discovery via WMIC SecurityCenter2 Query

This rule detects use of wmic to query the SecurityCenter2 AntiVirusProduct namespace to enumerate installed security tooling, a reconnaissance step observed in DanaBot to IcedID intrusions. Attackers profile endpoint defenses before dropping later stages so they can select an evasion path.

Malicious Rundll32 Loading Update DLL from AppData Custom_update with scab Export

This rule detects rundll32.exe loading an Update DLL from a user AppData Custom_update directory and calling the scab export, the loader execution used by DanaBot to run IcedID. This proxy execution runs the malicious module under a trusted signed binary to evade application controls.

Suspicious Double Extension Executable Execution via Command Line

This rule detects execution of a file with a doubled .exe.exe extension, a naming anomaly used by Parallax RAT for its startup executable to appear legitimate at a glance. No normal software ships a binary ending in .exe.exe. Detecting it exposes a disguised persistence dropper.

Malicious NetSupport Client Executed from Masqueraded VMware ProgramData Path

This rule detects the NetSupport remote-access client32.exe running from a ProgramData path disguised as VMware Tools, a masquerade used to deploy NetSupport RAT in the Parallax intrusion. The legitimate NetSupport binary never installs into a fake VMware folder under ProgramData. Detecting the wrong-context execution exposes abused remote-access tooling.

Suspicious SearchIndexer Process Started by Non-Service Parent for Hollowing

This rule detects SearchIndexer.exe launched by a parent other than services.exe, an anomaly SolarMarker creates when hollowing the Windows search binary to host its payload. Legitimately SearchIndexer is started only by the service control manager. Detecting an unexpected parent exposes code injection into a trusted process.

Suspicious Browser Updater Binary Spawned by AutoIt for Process Hollowing

This rule detects legitimate browser updater executables such as GoogleUpdate, BraveUpdate, MicrosoftEdgeUpdate or ielowutil being launched by Autoit3.exe, the hollowing target pattern used by DarkGate to run injected code under a trusted signed process. Updaters are never started by the AutoIt interpreter in normal operation. Detecting the pairing exposes process hollowing into signed binaries.

Suspicious AutoIt3 Executing Script from User Writable Path via Command Line

This rule detects Autoit3.exe running an .au3 script, the loader mechanism DarkGate uses after staging a renamed curl download. The compiled AutoIt interpreter runs attacker script to unpack and inject the payload. Detecting the execution exposes the DarkGate loader stage.

Suspicious UAC Bypass via Fodhelper or Eventvwr Auto-Elevated Process

This rule detects fodhelper.exe or eventvwr.exe spawning a command interpreter, the hallmark of a registry-hijack UAC bypass used by NetWire RAT to gain elevated execution. These auto-elevating binaries should not launch shells. Detecting the parent-child pair exposes privilege escalation attempts.

Malicious Rundll32 Executing Svchost-Masquerading DLL via Command Line

This rule detects rundll32 executing a DLL named to typosquat svchost with a Start export, an execution technique following WS_FTP CVE-2023-40044 exploitation. The doubled-t filename svchostt.dll disguises malicious code as a system component. Detecting it exposes DLL-based payload execution on the host.

Malicious IIS Worker Process Spawning Shell for Out-of-Band Interaction via Command Line

This rule detects the IIS worker process w3wp.exe spawning a command shell that performs a DNS lookup to an oastify out-of-band domain, an indicator of web exploitation callbacks. This was seen exploiting the WS_FTP vulnerability CVE-2023-40044 to confirm code execution. Detecting the chain exposes active server-side exploitation.

Suspicious Nltest Domain Trust Enumeration via Command Line

This rule detects nltest enumerating domain trusts, a discovery step used in the Nitrogen 2.0 campaign to map Active Directory before lateral movement. While administrators occasionally use nltest, its trust enumeration is common in hands-on-keyboard intrusions. Detecting it surfaces reconnaissance ahead of privilege escalation.

Malicious Scheduled Task Masquerading as OneDrive Security Task via Command Line

This rule detects creation of a scheduled task named to impersonate a OneDrive Security Task, a masquerade used for persistence in the Nitrogen 2.0 campaign leading to BlackCat ransomware. The benign-looking name hides operator tooling relaunch. Detecting the disguised task name exposes persistence hiding among legitimate cloud sync entries.

Suspicious Restic Backup Exfiltration to Remote Repository via Command Line

This rule detects the restic backup tool being used to push a backup to a remote REST repository, a data-exfiltration technique in the Nitrogen 2.0 campaign preceding ALPHV/BlackCat ransomware. Attackers repurpose the legitimate backup utility to stage collected data offsite. Detecting restic backup commands surfaces exfiltration before encryption.