Sigma detection rules, expert-reviewed

Suspicious microsoftedgeupdatecore Outbound Connection from Wrong Path

This rule detects a process named microsoftedgeupdatecore running outside the legitimate Microsoft Edge program folders while initiating network connections. DarkGate hollowed a process under this Edge updater name to blend its C2 traffic with normal update activity. A legitimate name in the wrong path making external connections reveals the masquerade.

Suspicious RegAsm or AppLaunch Outbound Connection after Injection

This rule detects the RegAsm or AppLaunch dotnet utilities making outbound internet connections. AsyncRAT was injected into these signed binaries so its RC4 encrypted C2 traffic originates from a trusted image. Neither utility normally reaches external hosts so outbound traffic indicates injected malware beaconing.

Suspicious DotNet Utility MSBuild RegAsm RegSvcs Network Beacon Indicating Hollowing

This rule detects MSBuild.exe, RegAsm.exe or RegSvcs.exe making an external network connection, the process hollowing targets used by Blind Eagle to run Remcos and njRAT with command and control over dynamic DNS. These .NET utilities have no reason to beacon outbound, so an external connection reveals injected remote access malware.

Suspicious SearchProtocolHost Network Connection Indicating Process Hollowing

This rule detects SearchProtocolHost.exe initiating an external network connection, behavior inconsistent with the Windows Search indexer and used by Pikabot as a process hollowing target for command and control. The indexer never reaches out to the internet, so an outbound connection from it points to injected malicious code.

Suspicious Microsoft Teams Message from External Tenant Impersonating Helpdesk

This rule detects one-on-one Microsoft Teams chat messages originating from external tenants where the sender identity references helpdesk, IT, or support, matching the helpdesk impersonation vishing technique tracked by eSentire. Attackers pose as internal support over federated Teams to socially engineer users into granting access, so external senders using these identities are a phishing indicator.

Suspicious Mailbox Forwarding Rule Creation Following AiTM Phishing

This rule detects the creation or modification of mailbox inbox rules that forward, redirect, or delete incoming messages, a common post-compromise action performed by operators of the Sneaky2FA adversary-in-the-middle phishing kit. After stealing session tokens attackers add hidden forwarding rules to maintain access to victim correspondence, so this activity is a key sign of business email compromise.

Malicious MpGear.dll Side-Loading by Signed Host Binary

This rule detects the load of MpGear.dll, the malicious library side-loaded by a signed Inspection Document Review executable in the SyncFuture campaign. The DLL carried a transplanted invalid Microsoft signature and ran attacker code under a trusted signed host process. The presence of this named side-loaded module indicates active SyncFuture tradecraft.

Malicious msedge_elf.dll Side-Loading from Public Libraries

This rule detects the Edge helper library msedge_elf.dll being loaded from the C:\Users\Public\Libraries directory instead of a legitimate browser install path. ChaosBot side-loaded a malicious msedge_elf.dll through identity_helper.exe placed in Public Libraries to run its Rust payload under a trusted process. A signed Microsoft DLL name loading from a world-writable staging path is a hallmark of DLL side-loading.

Suspicious DLL Sideloading by hpreader Executable from Documents

This rule detects the hpreader host executable loading a DLL from the user Documents directory, the DLL sideloading technique used by Ghost Crypt to launch PureRAT. A signed reader binary loading a masqueraded dependency from Documents rather than its install path is highly abnormal and indicates search-order hijacking.

Suspicious DLL Sideloading via EngineX Executable

This rule detects the DeerStealer loader executable side-loading its malicious companion DLL, a DLL search-order hijacking technique that runs attacker code under a benign-looking process. Loading cmdres.dll from the EngineX host binary is characteristic of the DeerStealer execution chain and indicates active compromise.

Suspicious DynamicWrapperX dynwrapx.dll Load Enabling Script Based Injection

This rule detects loading of dynwrapx.dll, the DynamicWrapperX COM helper abused in the OnlyDcRatFans chain to let a VBScript call Windows APIs and inject RemcosRAT into winhlp32.exe. This library is rarely used by legitimate software, so its presence in a script host process points to API abuse for code injection.

Malicious Kong RAT Keylogger Capture File Creation

This rule detects creation of keystroke capture files under the ProgramData Kong Keylogger path used by the Kong RAT keylogging module. The malware writes intercepted keystrokes to this fixed location before exfiltration to its MPK1 command and control. This file activity confirms active credential and input harvesting.

Suspicious Non-Wallet Process Accessing Cryptocurrency Wallet Files

This rule detects a process that is not the corresponding wallet application touching Exodus, Electrum, Coinomi or Ethereum keystore wallet files. The DarkCloud infostealer enumerated these wallet directories to steal keys and seed material for cryptocurrency theft. Access to wallet storage by an unrelated process is a strong indicator of credential and asset theft.

Suspicious Non-Browser Access to Chromium Credential Stores

This rule detects a process that is not a web browser touching the Local State and Login Data files inside a Chromium User Data directory. The ShadowCoil packed Python stealer read Chrome and Edge Local State (the encrypted master key) and Login Data SQLite databases and used DPAPI CryptUnprotectData to recover saved credentials. Attackers harvest browser-stored passwords to enable follow-on account takeover and ransomware operations.

Suspicious Modification of Windows Hosts File

This rule detects writes to the Windows hosts file, which Cyber Stealer manipulates to poison DNS resolution and redirect or block traffic such as security-vendor domains. Because the hosts file is rarely changed on managed endpoints, modifications outside of controlled administration are a meaningful sign of network defense tampering.