Sigma detection rules, expert-reviewed

Suspicious DLL Sideloading via csmonitor.exe Loading Microsoft.ServiceHosting.Tools.dll (via image_load)

This rule detects the QuickFox supply chain implant loading a trojanized Microsoft.ServiceHosting.Tools.dll through the legitimate Azure Compute Emulator binary csmonitor.exe. The FDMTP loader relies on DLL search order hijacking to run inside a trusted signed process. Loading this Azure tooling DLL outside its normal SDK context is highly anomalous.

Malicious SparrowDoor Process Hollowing of colorcpl.exe

This rule detects execution of the legitimate colorcpl.exe utility with the numeric command line argument 11, a pattern used by the FamousSparrow group to launch a hollowed process hosting the SparrowDoor backdoor. colorcpl.exe is a color management applet that does not normally accept such arguments, so this invocation indicates process hollowing for defense evasion.

Suspicious Hidden Local Account via SpecialAccounts UserList Registry Value (via registry_set)

This rule detects a UserList value written under Winlogon SpecialAccounts to hide a local account from the Windows sign-in screen, a defense-evasion behavior MuddyWater uses after creating a covert admin account. Adversaries leverage this registry hiding so their persistent account stays invisible to interactive users.

Suspicious PHP Webshell Access under WordPress Cache Directory

This rule detects HTTP requests to a PHP file located in the WordPress wp-content cache directory. Legitimate WordPress caching stores static HTML and never executable PHP, so a PHP file served from this path indicates a dropped webshell used for post exploitation command execution.

Suspicious TightVNC Server Installation as a Service

This rule detects the TightVNC server tvnserver.exe installed with the -service argument, an unattended remote access mechanism observed in a Huntress-tracked Tiflux campaign that deployed stealth VNC tooling for persistent control. Registering the VNC server as a service enables silent boot-time remote access. Service installation of hidden VNC tooling on endpoints is characteristic of attacker remote access rather than sanctioned support software.

Malicious IIS Worker Process Spawning Command Shell via SharePoint ToolShell (via process_creation)

This rule detects the SharePoint IIS worker process w3wp.exe spawning command interpreters or scripting hosts, a hallmark of web shell execution. Exploitation of CVE-2025-53770 (ToolShell) drives w3wp to launch cmd or PowerShell for post-exploitation, indicating server-side remote code execution.

Suspicious Linux Host Reconnaissance via Whoami and Uname by UAT-7290

This rule detects a shell one-liner echoing the current user together with kernel and machine details from uname. UAT-7290 uses this command to profile compromised Linux hosts during initial access. Combined user and system enumeration is a common precursor to deploying tailored malware.

Suspicious Active Directory LDAP Reconnaissance via ADSearch (via process_creation)

This rule detects execution of the ADSearch tool using its search and LDAP-filter arguments to query Active Directory for users, groups and computers. ADSearch is a discovery utility observed in intrusions profiled by the Red Canary Threat Detection Report, used to map the directory ahead of privilege escalation and lateral movement. Detecting its query invocation surfaces adversary reconnaissance regardless of the binary name.

Suspicious AutoIt Script Execution of Compiled a3x Payload

This rule detects the AutoIt interpreter executing a compiled a3x script from a user writable location. Loaders such as DarkGate drop a renamed AutoIt binary alongside an obfuscated a3x script to decrypt and run shellcode while blending in with legitimate automation tooling.

Firewall Rule Manipulation via AuthorizedApplications Registry List

This rule detects modification of the firewall AuthorizedApplications List registry key, the technique the Phorpiex downloader uses to whitelist its own binary for outbound access. Adding a program to this legacy firewall exception list enables command-and-control while evading network defenses.

Malicious Pikabot Rundll32 Loading DLL with Enter Export

This rule detects rundll32.exe loading a DLL and calling the Enter export, the loader execution used by Pikabot after a downloaded DAT payload is renamed to a DLL. Running the module through rundll32 proxy execution hides the malicious code under a trusted signed binary.

Suspicious Kimsuky RDP Wrapper Keylogger Output in ProgramData (via file_event)

This rule detects the creation of keylogger output files named joeLog.txt or jLog.txt directly under ProgramData as used by the Kimsuky RDP Wrapper campaign. These fixed filenames in the ProgramData root are strong indicators of the keystroke capture component.

Antivirus Remote Access Tool Signature Matches Known RAT Names

Alerts on antivirus detections referencing multiple known RAT family signature names in the event signature field.

Antivirus signatures matching APT malware naming patterns

Flags Antivirus alerts when malware signatures reference APT-style naming patterns and family name substrings.

Suspicious Failed DNS Server Zone Transfer for Enumeration Purposes (via dns-server)

This rule detects exploit DNS server missconfiguration to trigger a DNS zone transfer and enumerate list of valid IP and hostnames.