Sigma detection rules, expert-reviewed

Malicious Lazarus DLL Side-Loading of ualapi.dll via spoolsv.exe (via image_load)

This rule detects the Windows Print Spooler process spoolsv.exe loading a ualapi.dll from a directory other than System32. In the Lazarus SIGNBT campaign the actor plants a rogue ualapi.dll that is side-loaded by spoolsv.exe to gain execution and persistence, so a ualapi.dll load from an unusual path indicates print-processor abuse and hijacked system code.

Suspicious DLL Written to Explorer IconCache Path

This rule detects a DLL written to the Explorer icon cache directory using an iconcache prefixed name with a numeric suffix. In Operation ForumTroll a LNK triggered PowerShell chain dropped a payload DLL named iconcache_<4digits>.dll to this location as reported by Kaspersky. Legitimate icon cache files use the .db extension so a .dll in this path is a strong masquerading and payload staging indicator.

Suspicious MSBuild Execution from Writable Directory (via process_creation)

This rule detects MSBuild being launched with a project file located in a user-writable directory such as ProgramData, AppData, Temp or Downloads. Following CVE-2025-31324 exploitation adversaries abuse MSBuild as a trusted developer utility to compile and execute inline payloads, so MSBuild running from a staging directory indicates defense evasion.

Suspicious Anomalous OpenSSH 0.3 Banner Indicating ZIPLINE Backdoor (via network)

This rule detects SSH connections advertising an SSH-2.0-OpenSSH_0.3 style banner that does not correspond to any real OpenSSH release. The ZIPLINE passive backdoor on compromised Ivanti appliances hijacks the accept() call and keys off this anomalous banner as a trigger. An impossible OpenSSH version string is a reliable fingerprint of this passive implant.

Malicious Modification of a Fake Domain Controller SPN - DCshadow (via security)

This rule detects updates the Service Principal Name (SPN) of a fake domain controller account in order to perform DCshadow attack.

Suspicious CherryLoader Execution via Encrypted Stage Arguments (via process_creation)

This rule detects execution of the CherryLoader binary invoked with its encrypted stage-two and privilege-escalation payload file arguments. CherryLoader passed NuxtSharp.Data and Spof.Data as arguments to decrypt and run embedded PrintSpoofer and JuicyPotatoNG modules.

Suspicious Imjp14k DLL Side-Loading From Non-System Path

This rule detects a process loading imjp14k.dll from a path outside the standard Windows System32 directory. APT41 abused DLL side-loading of imjp14k.dll to launch ShadowPad on a compromised Taiwanese network. Side-loading a system-named DLL from a writable non-system directory is a hallmark of hijack execution used to run malicious code under a trusted host process.

Malicious Lazarus ScoringMathTea WordPress C2 URL Path

This rule detects HTTP requests to the compromised WordPress command-and-control path used by the ScoringMathTea RAT in the Lazarus UAV-sector campaign. The RAT beacons to a theme functions file at inc/functions/function-hand.php, and this structured path is a durable network indicator of the malicious channel.

Malicious Chisel Tunneling Tool Masquerading as Microsoft Binary (via process_creation)

This rule detects the Chisel tunneling utility renamed to Microsoft-themed filenames such as MsChSoft.exe or MicrosoftExchange32.exe while running with client, server, or reverse forwarding arguments, a tunneling technique used by the Seashell Blizzard subgroup during the BadPilot access operation. Adversaries deploy renamed Chisel to establish persistent encrypted tunnels into compromised networks, and the mismatch between a Microsoft-styled name and tunneling arguments is a strong compromise indicator.

Malicious BRUSHWORM Persistence via Scheduled Task (via process_creation)

This rule detects scheduled task creation using the BRUSHWORM masquerading task names targeting financial services. Observed in Elastic Security Labs analysis where schtasks registers MSGraphics or MSRecorder tasks to persist the paint.exe backdoor and its keylogging component.

Suspicious Run Key Persistence Referencing SharePoint Executable via Registry Set

This rule detects a Run or RunOnce registry value pointing to an executable named SharePoint.exe, a masquerading persistence technique used by the Iranian actor Peach Sandstorm to launch its Tickler malware at logon. The use of a benign-sounding Microsoft product name in an autostart key helps the payload blend in and survive reboots.

Suspicious Renamed MonitoringHost Binary Indicating DLL Side-Loading

This rule detects execution of the signed Microsoft MonitoringHost binary under a renamed file name, a technique used by the SADBRIDGE loader to deploy the GOSAR (Golang QUASAR) backdoor. SADBRIDGE renames MonitoringHost.exe to DevQueryBroker.exe and abuses DLL search order hijacking to side-load a malicious HealthServiceRuntime.dll. Detecting a mismatch between the original file name and the on-disk image name surfaces this masquerading and side-loading activity for triage.

Possible Noodlophile Persistence via Run Key Launching Python Through cmd (via registry_set)

This rule detects a Registry Run key whose value launches a Python interpreter through cmd.exe, the persistence behavior used by the evolved Noodlophile stealer to re-run its Python payload at logon after DLL-sideloading delivery. Adversaries leverage a Run key that chains a command shell into an interpreter so the stealer survives reboots, making detection useful for surfacing persistence before repeated credential and browser-data theft.

Suspicious Web Service Spawning Bash Reverse Shell on Ivanti via Exploitation

This rule detects the Ivanti Connect Secure uwsgi web process spawning a Bash shell that reads a staged payload from a temporary path. This chain was uncovered through memory forensics of exploited Ivanti Connect Secure appliances. Web service processes launching interactive shells indicate successful remote code execution.

Suspicious Security Software Discovery via tasklist and findstr (via process_creation)

This rule detects tasklist output piped into findstr to search for antivirus process names such as Bitdefender, ESET, Quick Heal and Sophos. The Lumma infostealer enumerates running security products this way to fingerprint defenses and adjust its behavior before credential theft.