Sigma detection rules, expert-reviewed

Possible DCOM MSI Install Server Execution via Msiexec Embedding (via process_creation)

This rule detects msiexec.exe launched with the -Embedding switch as a child of the DCOM launcher service, the execution pattern abused by the DCOM Upload and Execute backdoor described by Deep Instinct. Attackers invoke the MSI install server DCOM object remotely to run code without PsExec-style services. This can indicate lateral movement over DCOM using a signed Windows binary.

Suspicious Scheduled Task Masquerading as Office Update via Process Creation

This rule detects creation of a scheduled task named Office Automatic Updates 2.0 by a parent other than the legitimate OfficeClickToRun updater, the SYSTEM-level persistence disguise used in the SHIM Me What You Got technique. Adversaries mimic a trusted Office task name to blend malicious persistence with routine update tasks.

Malicious DLL Injection via Mavinject Process Creation

This rule detects mavinject being used with the INJECTRUNNING option to inject a DLL into a running process, the injection primitive abused in the SHIM Me What You Got technique. Outside of App-V, this signed living-off-the-land binary is rarely used, making the injection flag a strong malicious indicator.

Malicious Shadow Copy Deletion and Boot Recovery Tampering via Process Creation

This rule detects deletion of volume shadow copies via vssadmin or removal of the safeboot boot configuration value via bcdedit, the recovery-inhibition steps BlackSuit ransomware runs before encryption. Adversaries destroy backups and disable safe-mode recovery to maximize impact and hinder restoration.

Malicious BlackSuit Ransomware Execution via Process Creation

This rule detects the distinctive command-line flags of BlackSuit ransomware combining virtual machine termination, full-file encryption, and a victim identifier. This flag combination is unique to the BlackSuit encryptor and signals an active encryption run.

Malicious Regsvr32 Loading Masqueraded VPN DLL via Process Creation

This rule detects regsvr32.exe registering a DLL named vpn.sessings, a Cobalt Strike loader masquerading as a Cisco AnyConnect component in the Uncorking Old Wine campaign. Adversaries proxy DLL execution through regsvr32 with a benign-looking VPN filename to evade application controls.

Possible Atera or Tactical RMM Agent Execution via Process Creation

This rule detects execution of the Atera or Tactical RMM agents, remote management tools MuddyWater abused in the DarkBeatC2 campaign for persistent operator access. Because these agents are also used by legitimate IT teams, unexpected installs on non-managed hosts should be validated.

Suspicious PowerShell Interaction with ProgramData SysInt Log via Process Creation

This rule detects PowerShell reading or writing the C ProgramData SysInt.log file that MuddyWater's DarkBeatC2 uses as a staging and command buffer in its multi-stage poll loop. The specific ProgramData filename combined with PowerShell indicates the DarkBeatC2 implant rather than legitimate logging.

Suspicious Child Process Spawned by WinRAR via Process Creation

This rule detects WinRAR spawning a command interpreter or script host, the exploitation pattern of CVE-2023-38831 in which a trailing-space filename trick causes WinRAR to execute an attacker .cmd, as leveraged by UAC-0099 against Ukrainian targets. Such child processes indicate archive-borne code execution rather than normal extraction.

Suspicious Execution from Hidden Diagnostic Directory via Process Creation

This rule detects execution of binaries from a hidden directory named .end or of the Diagnostic.exe and Windows.Diagnostic.Document.EXE loaders used in the MuddyWater eN-Able chain launched from an LNK attachment. Adversaries hide payloads in dot-prefixed folders and use benign-looking diagnostic filenames to evade casual inspection while a decoy window distracts the user.

Possible Remote Monitoring and Management Tool Execution via Process Creation

This rule detects execution of the SimpleHelp or Advanced Monitoring Agent remote management tools, which MuddyWater deployed in the eN-Able spear-phishing operation to gain hands-on-keyboard control of victim hosts. Adversaries abuse legitimate RMM software for stealthy remote access that survives endpoint controls, so unexpected installs warrant review.

Suspicious Scheduled Task Creation from XML Definition via Process Creation

This rule detects creation of a scheduled task from an external XML definition file via schtasks.exe, the persistence mechanism used by Operation Rusty Flag to keep its Rust implant resident. Adversaries stage task XML on disk to register persistence with fine-grained triggers while blending with legitimate task provisioning.

Suspicious BlackSuit Ransomware Note and Encrypted File Artifacts via File Event

This rule detects creation of the readme.blacksuit.txt ransom note or files renamed with the .blacksuit extension, the on-disk artifacts left by BlackSuit ransomware during encryption. Their appearance across a host or share indicates an in-progress or completed encryption event.

Possible C2 Beacon to Dynamic DNS Provider via DNS Query

This rule detects DNS resolution of dynamic-DNS domains under ddns.net, serveirc.com, and hopto.org, the fast-flux infrastructure MuddyWater used for MuddyC2Go beacons. Adversaries favor dynamic DNS to rotate C2 endpoints cheaply, so resolutions to these providers from server or non-consumer hosts merit correlation with process activity.

Suspicious Salesforce Bulk Query by External App with Python-urllib Agent

This rule detects an external Salesforce application issuing bulk record queries using a Python-urllib user agent, the data theft pattern of the Klue supply chain attack. The actor drove QueryMore bulk reads against the query API from an external application client using a scripted urllib agent rather than a browser. Bulk querying of Salesforce objects by an external app with a scripting user agent indicates automated data exfiltration.