Sigma detection rules, expert-reviewed

Suspicious PowerShell Download to Temp and In-Memory Execution via IEX (via process_creation)

This rule detects PowerShell using iwr to save content into the temp directory and then piping it to iex for in-memory execution. TA427 pasted this ClickFix command to fetch a payload to a temp file and immediately run it.

Suspicious Scheduled Task Creation with ClickFix Update Recon Name (via process_creation)

This rule detects schtasks creating a task whose name begins with Update-out-of-date, a persistence artifact TA427 used after a ClickFix lure. The actor registered these tasks to run recurring recon and payload stages every few minutes.

Suspicious MSI Installation from Public Music Directory via Msiexec (via process_creation)

This rule detects msiexec silently installing an MSI staged in the public users music directory. TA397 downloaded gfxview.msi to C\users\public\music and installed it quietly to deploy the MiyaRAT backdoor.

Suspicious System Reconnaissance Output Redirected to PDF File (via process_creation)

This rule detects command shell reconnaissance that queries installed antivirus via WMI and appends the results to a file for later exfiltration. TA397 staged tasklist and SecurityCenter2 AntiVirusProduct output into abc.pdf before uploading it.

Suspicious PowerShell Download of Bumblebee Stager Files (via process_creation)

This rule detects PowerShell referencing the stager filenames update_ver or w_ver.dat used in the Bumblebee delivery chain. These files were fetched from the download server before the Bumblebee DLL was executed.

Suspicious RegAsm Execution Spawned by Script Interpreter (via process_creation)

This rule detects the .NET RegAsm.exe utility launched by PowerShell, mshta, or cmd, an unusual parentage seen in ClickFix chains that used RegAsm to execute Base64-encoded XWorm. RegAsm is rarely started interactively by these interpreters in normal use.

Malicious HTA Payload Download and Execution via PowerShell One-Liner (via process_creation)

This rule detects a PowerShell one-liner that downloads an HTA file to disk and immediately launches it. TA571 ClickFix chains used this pattern to fetch default.hta into the public user directory and start it to install DarkGate.

Suspicious Msiexec Installation of Remote MSI from WebDAV Share (via process_creation)

This rule detects msiexec installing an MSI package directly from a remote HTTP or WebDAV location. Latrodectus delivery chains called msiexec to run an MSI from a WebDAV share which then executed the embedded loader DLL.

Suspicious Rundll32 Execution with Latrodectus Loader Exports (via process_creation)

This rule detects rundll32.exe invoking non-standard DLL export names used by the Latrodectus loader. The malware and its downloader executed embedded DLLs via exports such as scab, nail, and fin.

Suspicious PowerShell Remote TXT Payload Download Spawned by Shortcut via LNK (via process_creation)

This rule detects a PowerShell process launched from Explorer that downloads a remote text file used as a next-stage script. TA547 delivered LNK shortcuts that invoked PowerShell to retrieve and execute a hosted PowerShell payload from a .txt URL.

Suspicious In-Memory .NET Assembly Load via PowerShell Base64 Payload (via process_creation)

This rule detects PowerShell decoding a Base64 blob and reflectively loading it as a .NET assembly directly in memory. TA547 used this fileless technique to run the Rhadamanthys stealer without writing the payload to disk.

Suspicious Rundll32 Execution with IcedID Loader Export (via process_creation)

This rule detects rundll32.exe invoking the PluginInit export or referencing license.dat, artifacts of the forked IcedID loader. The loader ran its DLL through the non-standard PluginInit export and stored its bot module as license.dat.

Suspicious Script Interpreter Spawned by OneNote via Embedded Attachment (via process_creation)

This rule detects OneNote spawning a command shell, script host, or download utility, which indicates an embedded attachment was executed. Multiple actors abused OneNote .one files to launch cmd, PowerShell, wscript, mshta, or curl to retrieve AsyncRAT, XWorm, Qbot, and DOUBLEBACK.

Possible TP-Link Command Injection via WlanNetworkRpm Endpoint (via webserver)

This rule detects HTTP requests to the TP-Link WlanNetworkRpm configuration endpoint that carry shell metacharacters or download commands in the ssid1 parameter, matching exploitation of CVE-2023-33538 for unauthenticated command injection. Attackers abuse this router flaw to fetch and run Condi or Mirai IoT bot payloads.

Malicious SharePoint ToolPane Exploitation via SignOut Referer

This rule detects HTTP POST requests to ToolPane.aspx carrying a Referer header pointing at SignOut.aspx. This exact request pattern is the authentication bypass used to exploit the SharePoint ToolShell vulnerabilities. The crafted Referer combined with the ToolPane endpoint is a reliable exploitation signature.