Sigma detection rules, expert-reviewed

Malicious Credential Hive Dump via Reg Save

This rule detects use of reg save to export the SAM registry hive which the REF0657 intrusion used to steal local account password hashes for offline cracking. Saving the SAM hive is a credential access action with no benign use case in normal administration.

Malicious Windows Event Log Clearing via Wevtutil

This rule detects use of wevtutil to clear Windows event logs which the REF0657 actors performed against the System and Security logs to destroy evidence of their activity. Clearing event logs is a deliberate anti-forensic action that rarely has a legitimate operational reason.

Malicious SQL Server Command Execution Spawning Download Utilities via Process Creation

This rule detects the SQL Server service process spawning download capable utilities such as certutil bitsadmin powershell or cmd which in the REF0657 financial services intrusion followed xp_cmdshell abuse to pull tooling onto a compromised database server. The database engine launching these binaries indicates command execution through SQL and should not occur in normal operation.

Malicious UAC Bypass via Eventvwr Execution Hijack via Process Creation

This rule detects the Event Viewer binary spawning a child process other than the Microsoft Management Console which indicates a registry hijack UAC bypass abusing the eventvwr auto-elevation to run an attacker controlled elevated process. Filtering the expected mmc child keeps focus on the abusive execution.

Malicious UAC Bypass via Fodhelper or ComputerDefaults Execution Hijack via Process Creation

This rule detects child processes spawned by the auto-elevating fodhelper or computerdefaults binaries which is the hallmark of a registry based UAC bypass where an attacker hijacks the shell open command to launch an elevated process without a consent prompt. Any child of these settings handlers should be treated as suspicious elevation.

Suspicious KANDYKORN Python Loader Execution via Process Creation

This rule detects execution of the Watcher and testSpeed Python scripts used in the DPRK KANDYKORN macOS intrusion to bootstrap the malware. These distinctively named loader scripts are run through the Python interpreter to fetch and stage later stages of the implant.

Suspicious GPG Decryption of Downloaded Payload via GPG

This rule detects batch mode GPG decryption on Windows endpoints which GHOSTPULSE uses to decrypt a downloaded tar gpg payload with a preset passphrase supplied on a file descriptor. Non-interactive gpg decrypt invocations are uncommon on typical workstations and here signal payload staging and defense evasion.

Malicious REF5961 PsExec-Style Remote Service Execution from Windows Help Directory via Process Creation

This rule detects PsExec-style remote execution that runs a payload as a service from the Windows help directory as seen in the REF5961 intrusion set deploying RUDEBIRD, where an actor uses the accepteula system service flags together with a help directory path to move laterally and run code under a masqueraded location for stealth.

Malicious PIPEDANCE Named Pipe Command and Control Channel via Pipe Created

This rule detects creation of the hardcoded PIPEDANCE named pipe used as an inter-process SMB command and control channel where the pipe name doubles as the RC4 key u0hxc1q44vhhbj5oo4ohjieo8uh7ufxe. PIPEDANCE uses this pipe to relay operator commands for shellcode injection and token hijacking so its presence indicates active backdoor communication.

Suspicious kworker Masquerade Process Initiating Network Connection on Linux

This rule detects a process masquerading as a kernel kworker thread that initiates an outbound network connection as observed with Linux rootkit implants in Elastic research. Genuine kworker kernel threads never open network sockets, so a userland process using this name to beacon indicates a hidden implant.

Suspicious Outbound Network Connection from explorer.exe

This rule detects explorer.exe initiating an outbound network connection to an external host, anomalous behavior consistent with the DOUBLELOADER backdoor injecting into explorer.exe and beaconing to command-and-control. explorer.exe does not normally make direct external connections, so this pattern indicates process injection and covert C2.

Suspicious Network Connection from fsutil or Defender Client via network_connection

This rule detects outbound network connections from fsutil.exe or the Defender client rmclient.exe, processes that do not normally initiate network traffic. The REMCOS watchdog component injects into these binaries to maintain a covert command-and-control channel. Such connections indicate likely process injection and should be investigated.

Malicious Libcurl DLL Side-Loading by Paint Backdoor (via image_load)

This rule detects the BRUSHWORM paint.exe backdoor side-loading a malicious libcurl.dll from a non-standard directory. Observed in Elastic Security Labs analysis where DLL search order hijacking of libcurl.dll executes attacker code under a benign-looking process against financial services.

Malicious BADIIS Native IIS Module Loaded by Worker Process (via image_load)

This rule detects the IIS worker process loading the BADIIS native module DLL registered under the default application pool for SEO poisoning. Observed in Elastic Security Labs analysis where WsmRes64.dll is loaded by w3wp.exe to intercept and manipulate web traffic as a malicious IIS component.

Suspicious GHOSTPULSE DLL Side-Loading via Signed Binary

This rule detects the signed application Crysta_X64.exe loading the attacker-supplied DllXDownloadManager.dll, the DLL side-loading pair used to launch the GHOSTPULSE loader. Adversaries abuse this trusted executable to proxy execution of malicious code while evading application controls before deploying the ARECHCLIENT2 stealer.