Sigma detection rules, expert-reviewed

Suspicious Python Payload Execution from ProgramData via Pythonw (via process_creation)

This rule detects pythonw.exe executing a .pyw script staged under ProgramData, the loader behavior of the malicious PyPI packages that drop server.pyw to C ProgramData after installation. Running a windowless Python payload from ProgramData indicates supply-chain malware execution.

Suspicious SharePoint w3wp Spawning Encoded PowerShell (ToolShell Exploitation)

This rule detects the SharePoint IIS worker w3wp spawning PowerShell with an encoded command, the post exploitation activity following ToolShell webshell deployment. It matters because encoded PowerShell launched by the web server process indicates server side code execution and obfuscated attacker commands.

Malicious Software Protection Service Masquerade Outside System32 via Process Creation

This rule detects the legitimate software protection service binary name sppsvc being executed from any location other than System32 which reflects the masquerading observed in this intrusion where the process ran from a hidden ProgramData directory. The genuine service only runs from System32 so execution elsewhere indicates a masqueraded malicious process.

Suspicious Scheduled Task Masquerading as Memory Diagnostic Running Script Host

This rule detects creation of a scheduled task named RunFullMemoryDiagnostic or ProcessMemoryDiagnosticEvents whose action launches a script host, mimicking legitimate Windows memory diagnostic tasks. LitterDrifter abuses these trusted task names to blend its persistence into normal Windows components. The mismatch between the trusted name and a script host action reveals the worm persistence.

Malicious Windows Event Log Clearing via wevtutil (via process_creation)

This rule detects wevtutil.exe clearing Windows event logs which generates cleared-log events such as EventID 1102 and 104. LockBit operators wiped logs to destroy forensic evidence after exploitation and credential theft. Log clearing is a deliberate anti-forensic action rarely performed by legitimate administrators at scale.

Suspicious MSIEXEC Launching NVIDIA GeForce Experience Named Binary

This rule detects msiexec.exe launching a child process named nvidia geforce experience.exe, the delivery chain observed in the Genesis Market malicious browser extension campaign where an MSI dropped a legitimately named host binary for DLL sideloading. This sequence points to masquerading and side-loaded payload staging.

Suspicious PolarEdge Implant Connect-Back Argument Pattern (via process_creation)

This rule detects the PolarEdge QNAP implant being launched with its distinctive connect-back argument set. The backdoor uses the cw mode flag together with the quiet foreground host and execute options to establish a reverse connection to its operator. This fixed argument combination is unique to the implant and reveals active backdoor invocation.

Suspicious Process Execution from Public User Media Folders via process_creation

This rule detects executables launched directly from the Public Pictures, Music, or Documents folders. This staging location is abused by fake OpenClaw installers delivering GhostSocks to run payloads from world-writable directories that rarely host legitimate executables, helping the operator evade path-based scrutiny.

Malicious S3 Object Encryption for Ransom via SSE-C

This rule detects an S3 PutObject call that supplies a customer provided encryption key using server side encryption with customer keys, the core primitive of the AWS S3 SSE-C ransom scenario emulated by Elastic. By overwriting objects with a key only the attacker holds the adversary makes bucket data unrecoverable to the owner and demands payment. SSE-C on writes is uncommon in most environments and can indicate destructive ransom activity.

Suspicious Run Key Persistence Executing Node.js Script via MuddyWater Tsundere Botnet

This rule detects a Run key autostart entry that launches the Node.js interpreter against a JavaScript payload. This behavior is tied to the MuddyWater APT Tsundere botnet which resolves its command and control from an Ethereum smart contract using EtherHiding. Persisting node.exe via the Run key lets the operator survive reboots and maintain WebSocket beaconing.

Suspicious Password-Protected Archive Extraction of Everything64.dll by Elpaco Ransomware

This rule detects 7-Zip command-line extraction of a password-protected archive that deploys the Everything64.dll component. Elpaco ransomware, a Mimic variant, abuses the legitimate Everything search library for fast file enumeration prior to encryption. Password-protected extraction of this specific payload indicates staging of ransomware tooling on the host.

Suspicious Browser Login Data Copied to Temp File via type Command

This rule detects use of the cmd type command to copy a browser Login Data credential store into a temporary file. In SocGholish activity the stolen store was redirected into a rad prefixed tmp file for later DPAPI decryption. Copying the credential database is a precursor to bulk password theft from the endpoint.

Malicious COM Object Hijack Pointing to a User-Writable DLL (via registry_set)

This rule detects a CLSID InprocServer32 default value being pointed at a DLL in a user, temp or public directory, the hallmark of COM hijacking used for stealthy persistence and defense evasion. COM hijacking is a persistence technique profiled in the Red Canary Threat Detection Report. Detecting a COM object redirected to a user-writable payload surfaces a persistence mechanism before it is invoked.

Suspicious High Frequency Scheduled Task Creation via Schtasks

This rule detects creation of a scheduled task configured to run every few minutes which the TorNet backdoor uses to repeatedly relaunch its loader under a randomized task name. Minute interval recurring tasks are unusual for legitimate software and indicate persistence with frequent re execution.

Malicious UNC3944 Microsoft Defender Real-Time Protection Disable via Set-MpPreference (via ps_script)

This rule detects PowerShell invoking Set-MpPreference to disable Microsoft Defender real-time and behavior monitoring protections. UNC3944 disabled endpoint defenses this way to enable follow-on ransomware and tooling deployment after gaining access through SIM-swap and SMS phishing. Turning off real-time protection is a strong pre-encryption defense-evasion signal.