Sigma detection rules, expert-reviewed

Suspicious Removable Media Spread via My Pictures Executable (via process_creation)

This rule detects execution of a binary named My Pictures.exe which VenomRAT copies onto removable drives to spread across hosts in the RevengeHotels campaign. The lure name mimics a familiar folder to trick users into launching it from a USB device. An executable using this decoy name is indicative of USB-based propagation.

Malicious NTDS Credential Theft via Volume Shadow Copy via process_creation

This rule detects volume shadow copy creation with vssadmin or direct references to the ntds.dit Active Directory database used to steal domain credentials. Stately Taurus used vssadmin and NTDS.dit access on a compromised domain controller to harvest the credential store, a high-confidence sign of domain-wide credential access.

Suspicious Run Key Persistence Launching Headless Deno Runtime via TAG-150

This rule detects a Run key persistence value that launches the Deno runtime through a headless conhost wrapper. TAG-150 uses this technique across its DinDoor, DenoRAT, and NightshadeC2 tooling to silently reload JavaScript backdoors at logon. The headless conhost prefix suppresses the console window while maintaining autostart command and control.

Suspicious Data Exfiltration to Anonymous File Sharing Services (via dns_query)

This rule detects DNS lookups for the anonfiles and bayfiles anonymous file sharing services, which the Cyclops stealer uses to upload harvested victim data over web services. Exfiltration to anonymous upload endpoints lets the attacker collect stolen credentials and documents while evading corporate data controls.

Suspicious CMD Script Dropped in Startup Folder for Persistence

This rule detects creation of a .cmd batch file inside the user Startup folder. The Lampion loader plants a command script in the Startup directory so it runs automatically at each logon. Batch scripts appearing in the Startup folder are an uncommon and high-value persistence indicator.

Masquerading Blank Grabber Payload Decoding via Certutil Decode Flag (via process_creation)

This rule detects certutil being run with its decode flag to convert a base64-encoded file back into an executable payload, the deobfuscation step Blank Grabber uses to reconstruct its loader while masquerading the data as a certificate. Adversaries leverage certutil as a trusted LOLBin to decode staged payloads and evade content controls, making early detection critical for catching the loader before execution.

Suspicious HTTP Beacon Using Rare MyIE User Agent (via proxy)

This rule detects outbound HTTP traffic carrying the uncommon MyIE user agent string used by the MemFun implant in a suspected China-based espionage operation against military targets in Southeast Asia. The hardcoded user agent identifies the malware's beaconing channel, so matching traffic to external hosts indicates active command and control.

Suspicious Error 524 Decoy Smishing Phishing Endpoint Access (via proxy)

This rule detects access to the single-page phishing endpoints used by the Error 524 decoy smishing campaign, including getApp application-id lookups and WebSocket uuid exfiltration paths. The campaign hides credential and card data theft behind fake Cloudflare Error 524 pages. Detecting these URIs reveals victims interacting with the phishing infrastructure.

Malicious Named Pipe REDSUN Created by Nightmare-Eclipse Tooling

This rule detects creation of a named pipe called REDSUN, a hardcoded inter-process channel used by Nightmare-Eclipse tooling observed in a real-world Huntress intrusion. The agent relies on this fixed pipe name for command relay between its components. Because the pipe name is a distinctive tool-specific constant, its presence is a high-confidence indicator of the framework.

Malicious Windows Defender Real-Time Monitoring Disabled via PowerShell

This rule detects use of Set-MpPreference to disable Windows Defender real-time monitoring. In the WithSecure Catching Lazarus research the actor turns off real-time protection before dropping and running further tooling. Attackers disable defensive agents to run payloads without antivirus detection.

Suspicious PowerShell Download From catbox.moe (via process_creation)

This rule detects PowerShell referencing the catbox.moe file-sharing service, abused in the Cascading Shadows campaign to deliver later stages of a multi-step loader chain. Retrieving payloads from this public host lets the attacker stage malware while blending with legitimate file-sharing traffic.

Suspicious Hidden PowerShell Retrieving VBScript from mcdir.me by Millenium RAT (via process_creation)

This rule detects hidden PowerShell fetching a VBScript stager from the mcdir.me delivery host used in the Millenium RAT malware-as-a-service infection chain launched from a malicious LNK. The script downloads and runs the next-stage executable while showing the victim a decoy PDF. Detecting the download cradle interrupts the RAT installation early.

Renamed Computer Account Renamed Without a Trailing $ - CVE-2021-42278/42287 (via security)

This rule detects spoof the SAM account name of a a domain controller in order to impersonate it. Vulnerability comes from that computer accounts should have a trailing $ in their name (i.e. sAMAccountName attribute) but no validation process existed until the patch was released. During the offensive phase, attacker will create and rename the sAMAccountName of a computer account to look like the one of a domain controller. Once the attack is done, attacker will rollback the sAMAccountName to its original name.

Possible FortiWeb Authentication Bypass via Path Traversal to fwbcgi (via webserver)

This rule detects HTTP requests to the FortiWeb management CMDB admin API that traverse into the internal fwbcgi CGI handler. This request pattern corresponds to CVE-2025-64446 which lets unauthenticated attackers create administrator accounts. Legitimate API clients do not reach cgi-bin through path traversal.

Malicious Lazarus DLL Side-Loading of ualapi.dll via spoolsv.exe (via image_load)

This rule detects the Windows Print Spooler process spoolsv.exe loading a ualapi.dll from a directory other than System32. In the Lazarus SIGNBT campaign the actor plants a rogue ualapi.dll that is side-loaded by spoolsv.exe to gain execution and persistence, so a ualapi.dll load from an unusual path indicates print-processor abuse and hijacked system code.