Sigma detection rules, expert-reviewed

Suspicious PowerShell Remote Download of PhantomPulse Stager

This rule detects PowerShell using Invoke WebRequest or Start BitsTransfer to retrieve the PhantomPulse stager scripts and syncobs executable documented in Elastic research on Obsidian abuse. Fetching a remote first stage over web requests inside a script block indicates the loader phase of the RAT infection.

Malicious AMSI and ETW Bypass via In-Memory Patching (via ps_script)

This rule detects PowerShell in-memory tampering with AMSI and ETW to blind endpoint defenses, used by the MIMICRAT loader. Observed in Elastic Security Labs analysis where amsiInitFailed forcing, EventProvider m_enabled zeroing, and ScanContent Marshal.Copy patching disable scanning and telemetry before staging the RAT.

Malicious DYNOWIPER PowerShell Loader Execution (via ps_script)

This rule detects execution of the DYNOWIPER PowerShell loader scripts that stage and launch the destructive wiper against Poland's energy sector. Observed in Elastic Security Labs telemetry where dynacon_update.ps1 or exp.ps1 orchestrate dropping and running the wiper binary, indicating imminent data destruction.

Malicious ClickFix Clipboard Command Execution via PowerShell

This rule detects PowerShell command lines that download remote content with Invoke-WebRequest and immediately pipe it into Invoke-Expression, a pattern used by ClickFix social-engineering lures. This tradecraft was observed delivering GHOSTPULSE and the ARECHCLIENT2 information stealer, where victims are tricked into pasting a clipboard command into the Run dialog to fetch and run a next-stage payload in memory.

Suspicious PowerShell AMSI or ETW Tampering

This rule detects PowerShell script content that patches or disables the Antimalware Scan Interface (AMSI) or Event Tracing for Windows (ETW), a defense-evasion technique used to blind in-memory scanning and telemetry before executing malicious payloads. Such tampering is a hallmark of offensive tooling that seeks to run undetected in memory.

Suspicious Contagious Interview Exfiltration via Axios Upload User Agent

This rule detects HTTP uploads carrying the pinned axios/1.18.1 user agent to an /upload endpoint which the Contagious Interview RAT uses to exfiltrate stolen data to its controller. The fixed client library version paired with the upload path distinguishes implant traffic from normal browsing. It flags collected developer credentials leaving the host.

Malicious MIMICRAT C2 HTTP Request Pattern (via proxy)

This rule detects the distinctive HTTP request URIs used by MIMICRAT to communicate with its HTTPS command and control fronted through a content delivery network. Observed in Elastic Security Labs analysis where GET intake organizations events and POST discover pcversion metrics with mimicked telemetry parameters carry beacon traffic.

Malicious NANOREMOTE C2 Beacon by User-Agent

This rule detects outbound HTTP traffic carrying the NanoRemote User-Agent string used by the NANOREMOTE backdoor when beaconing to its command-and-control server. The hardcoded agent value combined with the /api/client request path is a distinctive fingerprint of this implant.

Suspicious BLOODALCHEMY Command and Control URI Pattern via Proxy

This rule detects outbound HTTP requests carrying the Inform logger URI path used by the BLOODALCHEMY backdoor for command and control. The distinctive URI structure is a network side indicator of the backdoor checking in with its server.

Suspicious Malformed DONNECT HTTP Method in Proxy Logs via Proxy

This rule detects the malformed DONNECT HTTP verb observed in REF5961 command and control traffic which is a typographical artifact of the tooling rather than a valid HTTP method. Legitimate clients never emit DONNECT so its presence in proxy logs is a strong indicator of the intrusion set beaconing through a proxy.

Suspicious AI Agent Compromise via Web Worker Spawning Shell or Network Tool

This rule detects an application worker such as gunicorn, uvicorn, celery or a python or node runtime spawning curl, wget or a shell which mirrors the AI agent abuse seen in the Hugging Face breach. Attackers who reach an exposed AI service pivot to shell and network utilities to pull tooling and exfiltrate data. Web worker parents launching these processes warrant investigation for server-side compromise.

Malicious wp2shell WordPress RCE via Web Server Spawning Shell Recon

This rule detects a web server process spawning a shell that runs identity and host reconnaissance which is the post-exploitation step of the wp2shell pre-auth WordPress RCE. After dropping a malicious plugin the attacker executes id, whoami and hostname to orient on the compromised server. A web daemon parenting these recon commands strongly indicates code execution through the vulnerability.

Malicious Contagious Interview RAT via Masqueraded Service Binary in User Path

This rule detects execution of service-sounding binaries dropped by the Contagious Interview toolkit from a user profile directory rather than a system location. The North Korean operators name their implants to imitate host, print and DHCP services to blend in. Running such a binary out of a user path is a strong masquerading indicator of the second-stage RAT.

Suspicious SCMBanker Toolkit Staging via Bitsadmin to Public Directory

This rule detects bitsadmin transferring a remote file into the world-writable C\Users\Public directory which SCMBanker uses to stage its fraud toolkit after initial access. Living-off-the-land BITS transfers evade download monitoring and blend with legitimate update traffic. The public staging path is a strong indicator of malicious payload delivery.

Suspicious Batch Fake Installer Spawning PowerShell Downloader via OXLoader

This rule detects a batch script masquerading as an installer that spawns PowerShell to download a remote executable as used by the OXLoader loader chain delivering CASTLESTEALER in Elastic research. A cmd hosted bat launching PowerShell with a download command is an early stage indicator of the fake installer social engineering lure.