Sigma detection rules, expert-reviewed

Malicious Run Key Persistence Pointing to Renamed PowerShell via Axios Compromise

This rule detects a CurrentVersion Run key value whose data references the renamed wt.exe interpreter or a script staged in ProgramData or TEMP as used by the Axios supply chain RAT for persistence. Attackers register the masqueraded PowerShell to re establish the implant at logon, ensuring durable access to the compromised host.

Suspicious Task Manager Disabled via DisableTaskMgr Registry Value

This rule detects the DisableTaskMgr policy value being set to 1, which blocks users from opening Task Manager. The NOVABLIGHT infostealer applies this change to hinder analysts and users from inspecting or terminating its running processes.

Suspicious Image File Execution Options Debugger Hijack

This rule detects the creation of a Debugger value under an Image File Execution Options subkey, which causes an attacker-chosen program to launch whenever the named executable runs. This technique enables both persistence and injection into a targeted process as described in the process injection survey.

Suspicious AppCertDlls Registry Modification for DLL Injection

This rule detects creation or modification of AppCertDlls registry values, which load a specified DLL into any process that calls the Win32 process-creation APIs. Attackers abuse this key for stealthy code injection and persistence across newly spawned processes.

Suspicious AppInit_DLLs Registry Modification for DLL Injection

This rule detects modification of the AppInit_DLLs registry value, which forces the listed DLLs to load into every process that links user32.dll. Adversaries set this value to achieve system-wide DLL injection and persistence, as surveyed in Elastic's review of common process injection techniques.

Possible SHELBY Backdoor Persistence via Run Key Referencing AppData HTTPApi

This rule detects creation of a CurrentVersion Run key value that points to the HTTPApi staging folder under AppData, the autorun persistence used by the SHELBY backdoor. A Run key referencing a per-user AppData executable indicates malware ensuring execution at logon.

Suspicious PowerShell Persistence via Registry Run Key

This rule detects creation of a Run key value that launches PowerShell at user logon, matching the RegistryPersistence Beacon Object File demonstrated in Elastic testing of Cobalt Strike detection gaps. Adversaries write a PowerShell payload to the CurrentVersion Run key so their implant re-executes on every startup. A Run entry that invokes PowerShell is a common autostart persistence pattern worth reviewing.

Suspicious Service Registration via Svchost netsvcs Registry Modification

This rule detects modification of the Svchost netsvcs registry value, abused by the SADBRIDGE loader to register a malicious service that is hosted by svchost.exe and delivers the GOSAR backdoor. Adding an entry to the netsvcs service group lets the attacker run code inside a trusted host process for stealthy persistence. Changes to this value outside of software installation warrant investigation.

Malicious UAC Disable via EnableLUA Registry Modification via registry_set

This rule detects modification of the EnableLUA policy value to zero under the system policies key, which disables User Account Control. The REMCOS RAT performs this change to weaken host defenses and enable silent privilege escalation. Disabling UAC system-wide is rarely legitimate and represents a significant defense evasion action.

Suspicious Run Key Persistence Pointing to Test Executable via Registry Set

This rule detects a CurrentVersion Run key being set to launch an executable dropped inside a Test subdirectory which is the autostart persistence used by the BLOODALCHEMY backdoor. A run key value referencing this staging path indicates malware establishing boot persistence.

Suspicious PowerShell WMI Video Controller Sandbox Evasion Check via OXLoader

This rule detects PowerShell querying the WMI Win32 VideoController class to inspect display refresh rate as a sandbox and virtualization check used by the OXLoader loader in Elastic research. Malware probes video controller properties to detect analysis environments before deploying the CASTLESTEALER payload, so this query in a script block signals evasion logic.

Suspicious PowerShell Outlook COM Automation for Mail Access via TCLBANKER

This rule detects PowerShell attaching to a running Outlook instance through the COM automation interface as used by the TCLBANKER trojan to read victim mail in Elastic research. Using GetActiveObject on the Outlook Application object allows the malware to harvest messages and monitor the inbox for banking interactions.

Suspicious PowerShell Remote Download of PhantomPulse Stager

This rule detects PowerShell using Invoke WebRequest or Start BitsTransfer to retrieve the PhantomPulse stager scripts and syncobs executable documented in Elastic research on Obsidian abuse. Fetching a remote first stage over web requests inside a script block indicates the loader phase of the RAT infection.

Malicious AMSI and ETW Bypass via In-Memory Patching (via ps_script)

This rule detects PowerShell in-memory tampering with AMSI and ETW to blind endpoint defenses, used by the MIMICRAT loader. Observed in Elastic Security Labs analysis where amsiInitFailed forcing, EventProvider m_enabled zeroing, and ScanContent Marshal.Copy patching disable scanning and telemetry before staging the RAT.

Malicious DYNOWIPER PowerShell Loader Execution (via ps_script)

This rule detects execution of the DYNOWIPER PowerShell loader scripts that stage and launch the destructive wiper against Poland's energy sector. Observed in Elastic Security Labs telemetry where dynacon_update.ps1 or exp.ps1 orchestrate dropping and running the wiper binary, indicating imminent data destruction.