Sigma detection rules, expert-reviewed

Suspicious GHOSTPULSE DLL Side-Loading via Signed Binary

This rule detects the signed application Crysta_X64.exe loading the attacker-supplied DllXDownloadManager.dll, the DLL side-loading pair used to launch the GHOSTPULSE loader. Adversaries abuse this trusted executable to proxy execution of malicious code while evading application controls before deploying the ARECHCLIENT2 stealer.

Suspicious DLL Side-Loading by Microsoft.Http.Api.exe via HTTPService.dll

This rule detects Microsoft.Http.Api.exe loading HTTPService.dll from a user AppData directory as part of the SHELBY backdoor DLL side-loading chain. The signed decoy executable is abused to load an attacker-controlled DLL that stages further payloads. This behavior indicates DLL search-order hijacking used to evade application controls and establish execution.

Suspicious Google Workspace OAuthLogin From Node.js Client via Tycoon 2FA

This rule detects Google Workspace OAuth token issuance for the reserved client that requests the accounts OAuthLogin scope from Node.js user agents as used in Tycoon 2FA adversary in the middle attacks in Elastic research. This pattern reflects an attacker minting long lived login tokens after phishing the session rather than legitimate browser authentication.

Malicious TELEPUZ DLL Persistence via Masqueraded Loader in User Path

This rule detects TELEPUZ writing its loader DLLs with system-sounding names into user-writable AppData or ProgramData locations. Legitimate components with these names live under System32, so the same filenames in a profile directory signal masquerading. This combination of trusted-looking name and wrong path exposes the DLL persistence.

Suspicious Modification of etc passwd Following Linux Kernel Exploit

This rule detects writes to etc passwd by a non package management process as seen in post exploitation of the Copy Fail and DirtyFrag Linux page cache bugs in Elastic research. Corrupting or appending to passwd is used to inject a privileged account after a kernel primitive grants arbitrary write, indicating successful escalation.

Malicious BADIIS Driver Dropped to System32 Drivers Directory (via file_event)

This rule detects the BADIIS malicious kernel driver payloads being written into the System32 drivers directory under masquerading filenames. Observed in Elastic Security Labs analysis of the global SEO poisoning campaign where WUDFPfprot.sys, WppRecorderpo.sys, and WppRecorderrt.sys are dropped to establish a stealthy foothold.

Suspicious NANOREMOTE Execution Log File Creation

This rule detects creation of a pe_exe_run.log file inside a Log subdirectory, an artifact the NANOREMOTE backdoor writes into its execution directory when running payloads. This distinctive log path helps identify hosts where the implant has executed additional binaries.

Suspicious TOLLBOOTH IIS Module Files in Windows Temp

This rule detects file creation under the C:\Windows\Temp\AcpLogs staging directory used by the TOLLBOOTH native IIS module for its configuration and log files. Persistent IIS module artifacts written to a temp directory indicate a covert web server implant.

Malicious Shai-Hulud Workflow File Creation

This rule detects creation of a shai-hulud-workflow.yml file, the malicious GitHub Actions workflow dropped by the Shai-Hulud npm supply-chain worm to establish persistence and propagate through developer repositories. The distinctive filename is a reliable indicator of compromise.

Suspicious APT Or YUM Package Manager Hook Configuration Created

This rule detects creation of configuration files in the APT or YUM package manager hook directories which adversaries abuse to execute arbitrary commands whenever the package manager runs. Planting a hook under apt.conf.d or the yum plugin configuration grants stealthy privileged persistence tied to routine system maintenance.

Suspicious Systemd Service Unit Creation In System Directory

This rule detects creation or modification of a systemd service unit file under the system unit directories which is a common Linux persistence mechanism where an ExecStart directive is pointed at a reverse shell or malicious payload. Adversaries install rogue systemd units so their code runs automatically at boot with elevated privileges.

Suspicious REMCOS Screenshot Capture File via file_event

This rule detects creation of screenshot image files matching the REMCOS RAT naming convention that prefixes captures with time_ followed by a timestamp and a jpg extension. The malware periodically captures the victim screen for surveillance and stores images using this pattern. Discovery of such files indicates active spyware collection.

Suspicious Meterpreter Host Discovery File Reads on Linux via file_event

This rule detects a process reading the host machine identifier together with the kernel network routing table, a discovery pattern exhibited by Meterpreter payloads on Linux during post-exploitation. This combination is used to fingerprint the host and enumerate network configuration before further action. Access to both of these uncommon paths by the same process is a strong indicator of in-memory implant activity.

Malicious Fseventsd Masquerade in Users Shared Directory via File Event

This rule detects creation of a hidden fseventsd named file inside the Users Shared directory which the macOS pirate ship campaign drops to masquerade its payload as a legitimate filesystem events daemon artifact. The genuine fseventsd store does not live in Users Shared so this file placement is a defense evasion masquerade.

Suspicious EAGERBEE Configuration File Created in Public User Directory via File Event

This rule detects creation of an iconcache.mui file in the public user directory which the REF5961 EAGERBEE backdoor uses as its configuration store. The masqueraded cache filename in a world-writable directory is a defense evasion technique to hide malware configuration in plain sight.