Sigma detection rules, expert-reviewed

Malicious DcRAT Loader Execution via rundll32 from Microsoft-Activation-Scripts Directory (via process_creation)

This rule detects rundll32 loading a DLL from a Microsoft-Activation-Scripts directory, the staging path used by Sandworm to execute the DcRAT loader disguised as KMS activation tooling. Exporting a function from a DLL placed in this masquerading folder is not legitimate Windows behavior. This indicates hands-on-keyboard payload execution.

Malicious Latrodectus DLL Execution via rundll32 from AppData Roaming (via process_creation)

This rule detects rundll32 executing the vierm_soft_x64 DLL from AppData Roaming, the Latrodectus payload LUNAR SPIDER disguised as a legitimate NVIDIA file. The malicious DLL is dropped by an MSI installer and launched from a user profile directory. This combination indicates loader execution ahead of Brute Ratel deployment.

Suspicious DLL Download to ProgramData via Start-BitsTransfer (via process_creation)

This rule detects PowerShell Start-BitsTransfer downloading a DLL into ProgramData, the ingress technique used against East Asian semiconductor firms to stage the ChargeWeapon loader module. BITS transfers of DLLs into ProgramData blend malicious downloads with a trusted service. This combination is a strong staging indicator.

Suspicious cmd Execution of .ucp Payload from System Volume Information (via process_creation)

This rule detects cmd.exe executing a .ucp file staged inside System Volume Information, a hiding technique used in the Mustang Panda PlugX chain. The renamed executable is launched from a directory normally reserved for restore points and shadow data. Execution of arbitrary payloads from this path is highly abnormal.

Malicious ChargeWeapon DLL Side-Loading via mcods.exe (via image_load)

This rule detects the McAfee mcods binary loading mcvsocfg.dll, the side-loading pair used to deliver the ChargeWeapon downloader in the semiconductor espionage campaign. The malicious loader reads an encrypted configuration and injects shellcode when loaded by the signed binary. This host and module combination is a reliable side-loading indicator.

Malicious HyperBro DLL Side-Loading via vfhost.exe (via image_load)

This rule detects the CyberArk vfhost binary loading VFTRACE.dll, the side-loading pair used to deploy the HyperBro implant against semiconductor targets. The malicious DLL decrypts and injects Cobalt Strike shellcode when loaded by the signed host process. This specific host and module pairing indicates HyperBro side-loading.

Suspicious Nmap Scanner Probe URIs in HTTP Requests (via webserver)

This rule detects HTTP requests to characteristic Nmap probe paths used by NSE scripts to fingerprint web servers and Hadoop or application endpoints. Requests for these signature URIs indicate automated scanning and service discovery against exposed infrastructure. Catching the probe paths reveals reconnaissance even when the scanner user-agent has been altered.

Malicious TALONITE GUP.exe Proxy Masquerading as Notepad++ Updater (via process_creation)

This rule detects execution of GUP.exe from any location outside the legitimate Notepad++ installation directory. TALONITE deploys a malicious proxy binary named GUP.exe to impersonate the genuine Notepad++ updater and blend into normal host activity. A GUP.exe running from a user, temp, or unexpected path indicates a masquerading C2 proxy rather than the real updater.

Suspicious Instant Messenger Client Spawning Script Interpreter (via process_creation)

This rule detects Discord or Telegram desktop clients spawning command shells and scripting interpreters as child processes. Adversaries abuse instant messaging platforms for command and control, using the legitimate client as a launch point for follow-on execution. A messaging application spawning cmd, PowerShell, or scripting hosts is anomalous and indicates malicious tooling masquerading as chat software.

Malicious VOLTZITE Netsh Portproxy Port Forwarding via Command Line (via process_creation)

This rule detects use of netsh.exe to create an interface portproxy rule that forwards network traffic between hosts. VOLTZITE leverages this native binary to relay traffic and pivot deeper into critical infrastructure networks. Attackers rely on portproxy forwarding to tunnel access through compromised systems while evading network segmentation controls.

Suspicious EKANS Ransomware Payload Dropped to Drive Root (via file_event)

This rule detects creation of the file update.exe directly in the root of the C drive, a staging behavior of EKANS ransomware prior to encryption of ICS environments. EKANS drops its payload and ransom note to the drive root and user desktop before terminating industrial and database processes. Writing an executable named update.exe to the drive root is highly unusual and warrants immediate investigation.

Suspicious PowerShell Script Fetching Remote Batch File From Paste Site (via ps_script)

This rule detects PowerShell script blocks that reference a paste site alongside a batch file extension, matching the download-and-execute behavior in Deep Instinct's Regex Gone Rogue analysis. The macro-launched PowerShell retrieves and runs a .bat file hosted on Pastebin. This indicates staged remote payload delivery and execution through a living-off-the-land interpreter.

Suspicious PowerShell Download of Payload From Pastebin (via process_creation)

This rule detects PowerShell invoked with a command line referencing pastebin.com, the delivery channel described in Deep Instinct's Regex Gone Rogue analysis where an Excel macro fetches a batch payload from Pastebin. Attackers stage second-stage scripts on paste sites to evade domain reputation controls. This indicates remote payload retrieval during the execution stage.

Possible DCOM MSI Install Server Execution via Msiexec Embedding (via process_creation)

This rule detects msiexec.exe launched with the -Embedding switch as a child of the DCOM launcher service, the execution pattern abused by the DCOM Upload and Execute backdoor described by Deep Instinct. Attackers invoke the MSI install server DCOM object remotely to run code without PsExec-style services. This can indicate lateral movement over DCOM using a signed Windows binary.

Suspicious Scheduled Task Masquerading as Office Update via Process Creation

This rule detects creation of a scheduled task named Office Automatic Updates 2.0 by a parent other than the legitimate OfficeClickToRun updater, the SYSTEM-level persistence disguise used in the SHIM Me What You Got technique. Adversaries mimic a trusted Office task name to blend malicious persistence with routine update tasks.