Sigma detection rules, expert-reviewed

Suspicious Remote HTA Payload Execution via MSHTA

This rule detects mshta.exe launched with a remote http or https URL argument to retrieve and execute a remote HTML Application payload. Loaders such as CountLoader and Emmenhtal abuse this behavior to stage LummaStealer and other malware in memory.

Malicious Shell Payload Piped from curl to zsh

This rule detects a base64 decoded command that pipes remote content fetched with curl directly into the zsh interpreter. This fileless macOS execution technique is used by fake software advertisement campaigns to run a stealer without touching disk.

CastleLoader ClickFix PowerShell Hex Decode and Re-Execution

This rule detects a ClickFix style command that decodes a hex encoded string in PowerShell and pipes the result into a second PowerShell instance for execution. This pattern delivers CastleLoader and related payloads directly in memory.

Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32

This rule detects extrac32.exe extracting a cabinet archive that uses a deceptive vstm extension. This delivery step was observed in CastleLoader and LummaStealer fake installer campaigns to unpack staged components.

Agent Tesla Persistence via Realtek Named Scheduled Task Batch

This rule detects execution of a batch file named RealtekCodec that masquerades as an audio helper and is launched minimized from a scheduled task. This persistence method runs the Agent Tesla loader at user logon.

Suspicious DLL Execution via Regsvr32 DllInstall of dat File

This rule detects regsvr32.exe invoking the DllInstall export against a file that uses a dat extension. This signed binary proxy execution technique runs a C2 agent DLL delivered inside fake game trainers and pirated Battlefield 6 installers.

Windows Defender Tampering via Set-MpPreference and Exclusions

This rule detects PowerShell commands that weaken Microsoft Defender by disabling cloud reporting and sample submission or by adding broad ProgramData exclusion paths. RedCurl performs these steps before deploying its QWCrypt ransomware.

FTP Data Exfiltration via curl with Embedded Credentials

This rule detects curl uploading a file to an FTP server using inline username and password credentials. Unfading Sea Haze uses this method to move staged archives of stolen data to attacker controlled infrastructure.

Antivirus Check and Remote Loader Retrieval in LNK Command Chain

This rule detects a command chain that checks for the ESET kernel service with tasklist and findstr then downloads a remote payload and hands it to MSBuild for execution. This LNK based initial access is used by Unfading Sea Haze.

MSBuild Executing Non-Project File or Remote Payload

This rule detects MSBuild running a file that is not a normal project such as a log file or a payload staged in a public folder. Unfading Sea Haze abuses MSBuild to compile and execute .NET loaders in memory from these staged files.

Suspicious PowerShell Hidden Web Download via Invoke-WebRequest by CatB Ransomware

This rule detects a hidden PowerShell or cmd invocation combining Invoke-WebRequest with DownloadData to retrieve a payload, matching the ingress tool transfer behavior emulated for CatB ransomware. Running the download in a hidden window is a common defense evasion tactic for staging follow-on malware.

Malicious LSASS Memory Dump via comsvcs.dll by Salt Typhoon

This rule detects rundll32 executing comsvcs.dll against the LSASS process to extract credentials from memory, a technique used by Salt Typhoon. Dumping LSASS provides hashed or plaintext credentials for lateral movement.

Suspicious Volume Shadow Copy Deletion via PowerShell WMI by Akira Ransomware

This rule detects PowerShell deleting Volume Shadow Copies through the Win32_ShadowCopy WMI class, an inhibit-recovery step used by Akira ransomware before encryption. Removing shadow copies prevents victims from restoring files without paying.

Possible Next.js Middleware Auth Bypass via X-Middleware-Subrequest Header (CVE-2025-29927)

This rule detects HTTP requests carrying the X-Middleware-Subrequest header, which Next.js internally uses to prevent middleware recursion and which attackers forge to bypass middleware-based authentication in CVE-2025-29927 as analyzed by Assetnote. A client-supplied value for this header causes the framework to skip auth middleware and return protected content. Because legitimate external clients never send this internal header, its presence strongly indicates an exploitation attempt.

Possible Ivanti Pulse Connect Secure Auth Bypass via TOTP Backup Code Path Traversal (via webserver)

This rule detects requests to the Pulse Connect Secure TOTP user backup code API containing directory traversal sequences. This maps to the authentication bypass where traversal from the totp endpoint reaches restricted admin and system functions. An attacker uses this to bypass authentication and pivot toward remote code execution.