Sigma detection rules, expert-reviewed

Malicious IIS Worker Process Spawning Shell for Out-of-Band Interaction via Command Line

This rule detects the IIS worker process w3wp.exe spawning a command shell that performs a DNS lookup to an oastify out-of-band domain, an indicator of web exploitation callbacks. This was seen exploiting the WS_FTP vulnerability CVE-2023-40044 to confirm code execution. Detecting the chain exposes active server-side exploitation.

Suspicious Nltest Domain Trust Enumeration via Command Line

This rule detects nltest enumerating domain trusts, a discovery step used in the Nitrogen 2.0 campaign to map Active Directory before lateral movement. While administrators occasionally use nltest, its trust enumeration is common in hands-on-keyboard intrusions. Detecting it surfaces reconnaissance ahead of privilege escalation.

Malicious Scheduled Task Masquerading as OneDrive Security Task via Command Line

This rule detects creation of a scheduled task named to impersonate a OneDrive Security Task, a masquerade used for persistence in the Nitrogen 2.0 campaign leading to BlackCat ransomware. The benign-looking name hides operator tooling relaunch. Detecting the disguised task name exposes persistence hiding among legitimate cloud sync entries.

Suspicious Restic Backup Exfiltration to Remote Repository via Command Line

This rule detects the restic backup tool being used to push a backup to a remote REST repository, a data-exfiltration technique in the Nitrogen 2.0 campaign preceding ALPHV/BlackCat ransomware. Attackers repurpose the legitimate backup utility to stage collected data offsite. Detecting restic backup commands surfaces exfiltration before encryption.

Suspicious DotNet Utility Spawned by Script Host for Process Hollowing via Command Line

This rule detects RegSvcs.exe or aspnet_compiler.exe launched by a scripting host such as wscript, cscript or PowerShell, an unusual parent-child pair the ProjFUD injector uses as a hollowing target for AsyncRAT. These .NET utilities have no reason to be started by script interpreters. Detecting the chain reveals code injection into a trusted signed binary.

Suspicious Scheduled Task Running VBScript on Short Recurring Interval via Command Line

This rule detects creation of a scheduled task that runs a VBScript on a per-minute recurring schedule, a persistence pattern used by the ProjFUD injector to relaunch AsyncRAT every couple of minutes. Legitimate tasks rarely fire a script this frequently. Detecting the registration exposes aggressive persistence and beaconing cadence.

Suspicious Msiexec Remote MSI Installation via Command Line

This rule detects msiexec installing an MSI package directly from a remote HTTP or HTTPS URL in silent mode. Fake browser update campaigns delivering LummaC, Amadey and PrivateLoader abuse this proxy-execution technique to fetch and run installers. Detecting remote silent installs surfaces the initial delivery stage.

Suspicious VirtualBox Registry Artifact Anti-VM Check via Command Line

This rule detects command-line access to the VirtualBox ACPI DSDT registry artifact used to fingerprint virtual machines. StealC probes HKLM HARDWARE ACPI DSDT VBOX to decide whether it is running in a sandbox. Detecting the probe exposes evasion behavior before the stealer proceeds.

Suspicious Anti-VM WMI Thermal Zone Temperature Query via Command Line

This rule detects a WMI query against MSAcpi_ThermalZoneTemperature, an anti-VM sandbox-evasion check that fails inside most virtual machines. StealC delivered through deceptive Google Sheets uses this probe before unpacking. Detecting the query reveals evasion logic running prior to payload execution.

Suspicious Scheduled Task Creation Running VBScript for Persistence via Command Line

This rule detects creation of a scheduled task that launches a VBScript through wscript or cscript, a persistence pattern used by the AsyncRAT loader in Operation PhantomControl. Attackers register such tasks to relaunch their loader after reboot. Catching the task registration surfaces persistence establishment early in the intrusion.

Suspicious Outbound Connection from tracerpt.exe after Process Hollowing (via network_connection)

This rule detects the trace report utility tracerpt.exe initiating outbound network traffic, a behavior produced when the Winos4.0 loader hollows this System32 binary and beacons to command and control. The genuine tracerpt tool parses local event logs and does not communicate over the network. Any external connection from tracerpt indicates injected code and staging traffic.

Suspicious Outbound Network Connection from msiexec.exe (via network_connection)

This rule detects the Windows installer msiexec.exe initiating outbound network traffic, a behavior seen when Zloader injects its Cobalt Strike stager into msiexec and beacons to command and control. Under normal conditions msiexec only reaches out to fetch packages from known distribution points. Unexpected connections from an injected msiexec process indicate hollowed execution and C2 activity.

Suspicious AddInProcess32 Outbound Connection after Process Hollowing

This rule detects the dotnet AddInProcess32 utility initiating outbound network connections which is highly unusual. Ande Loader hollowed 0bj3ctivity Stealer into AddInProcess32 so its C2 and exfiltration traffic run under a signed process. External connections from this rarely used binary indicate injected stealer activity.

Suspicious microsoftedgeupdatecore Outbound Connection from Wrong Path

This rule detects a process named microsoftedgeupdatecore running outside the legitimate Microsoft Edge program folders while initiating network connections. DarkGate hollowed a process under this Edge updater name to blend its C2 traffic with normal update activity. A legitimate name in the wrong path making external connections reveals the masquerade.

Suspicious RegAsm or AppLaunch Outbound Connection after Injection

This rule detects the RegAsm or AppLaunch dotnet utilities making outbound internet connections. AsyncRAT was injected into these signed binaries so its RC4 encrypted C2 traffic originates from a trusted image. Neither utility normally reaches external hosts so outbound traffic indicates injected malware beaconing.