Sigma detection rules, expert-reviewed

Antivirus signatures matching APT malware naming patterns

Flags Antivirus alerts when malware signatures reference APT-style naming patterns and family name substrings.

Suspicious Failed DNS Server Zone Transfer for Enumeration Purposes (via dns-server)

This rule detects exploit DNS server missconfiguration to trigger a DNS zone transfer and enumerate list of valid IP and hostnames.

Suspicious GPINFO Data Store in ODBC Registry Key by Diplomatic Specter

This rule detects registry writes to a GPINFO value under the WOW6432Node ODBC hive, a location the Operation Diplomatic Specter actor abuses to stash configuration and collected data away from common inspection paths. Reusing a benign-looking ODBC key hides operational state within normal software structures. Detecting this write exposes covert data staging tied to the espionage campaign.

Suspicious Termination of Security Tooling via taskkill or sc delete

This rule detects taskkill or sc.exe being used to stop or delete Sysmon, SentinelOne, or other endpoint security services, matching the impairment activity in the Defence Impairment intrusion. Adversaries kill and remove EDR and monitoring agents to operate without detection before credential theft and lateral movement. Targeting named security services with process or service control utilities is a high-confidence evasion signal.

Suspicious Run Key Persistence Referencing Public or Default User Path

This rule detects creation of a CurrentVersion Run registry value whose data points to an executable staged under C:\Users\Public or the Default User profile. Ryuk ransomware drops its payload into these world-accessible directories and registers autorun persistence pointing there. Legitimate software rarely autoruns binaries from these locations, making this combination a high-confidence indicator.

Possible Rclone MEGA Exfiltration via DNS Query to MEGA Storage Endpoint

This rule detects DNS resolution of MEGA cloud storage upload endpoints used by Rclone during exfiltration. NCC Group observed Rclone transferring stolen data to MEGA userstorage endpoints. Traffic to consumer cloud storage from server or workstation contexts often indicates unauthorized data movement out of the environment.

Suspicious Windows Defender Exclusion Added via Add-MpPreference

This rule detects use of Add-MpPreference to register Microsoft Defender exclusion paths extensions or processes which the TorNet backdoor campaign performs to prevent detection of its payloads before execution. While administrators occasionally set exclusions attacker driven exclusion changes are a common defense evasion step that should be validated against change management.

RunningRAT Service Persistence via svchost NETSYSDDL Group (via process_creation)

This rule detects svchost.exe launched with the NETSYSDDL service group used by RunningRAT to load its malicious DLL under a masqueraded service. Adversaries leverage the svchost hosting model so the RAT executes as a service and survives reboots while blending into legitimate host processes.

Suspicious Mshta Remote HTA Execution via process_creation

This rule detects mshta.exe executing a command line that contains a web URL which indicates it is fetching and running a remote HTML Application. SideWinder used mshta.exe to pull a remote HTA that ran JavaScript through mshtml RunHTMLApplication and WScript Shell. Remote HTA execution is a well known proxy execution technique used to bypass application controls.

EchoGather Backdoor Components Dropped to User Windows Profile Directory (via file_event)

This rule detects creation of the EchoGather backdoor and its PowerShell loaders inside the roaming Microsoft Windows profile directory used by the Paper Werewolf campaign. Writing these specific filenames into a user profile path reflects the backdoor being staged for persistence after the malicious XLL executes.

Malicious FortiClient Process Spawning PowerShell Downloader (via process_creation)

This rule detects the FortiClient fortitray.exe or ipsec.exe process spawning a command shell or PowerShell. Exploitation of CVE-2026-35616 in FortiClient EMS delivered the EKZ infostealer through this process chain disguised as a Fortinet endpoint patch.

Suspicious Service BinPath Set to Command Interpreter or Account Creation

This rule detects use of sc.exe to set a service binary path to a command interpreter or a local account creation command, the service-abuse primitive used in the CVE-2019-1322 Update Orchestrator Service escalation to add a local administrator as SYSTEM. Pointing a service binPath at cmd or a net user add command is a common hijack for privilege escalation and persistence.

Suspicious Remote Archive Retrieval via mshta in Malware Distribution Ecosystem

This rule detects mshta.exe invoked with an HTTP or HTTPS URL pointing to a .7z archive, the delivery step used by the click-hijacking and TDS ecosystem to fetch stager payloads such as navy.7z. mshta retrieving a remote archive is a living-off-the-land proxy-execution behavior seldom seen in benign use.

Malicious Bun Runtime Payload Dropped by Shai Hulud npm Supply Chain Attack

This rule detects creation of the setup_bun.js or bun_environment.js files associated with the Shai Hulud 2.0 npm supply-chain worm. A malicious preinstall script drops setup_bun.js which installs the Bun runtime and stages the large bun_environment.js payload for credential theft and self-propagation. These distinctive filenames written during package installation indicate the worm establishing execution.

SharePoint spinstall Webshell Deployment after ToolShell Exploitation (via webserver)

This rule detects requests to spinstall or related aspx webshells dropped after ToolShell exploitation of SharePoint CVE-2025-53770, which extract the ValidationKey and DecryptionKey machine key material from the server. Adversaries retrieve these keys to forge authentication and regain access even after patching.