Sigma detection rules, expert-reviewed

Suspicious PowerShell Self-Delete Of Executable via Process Creation

This rule detects PowerShell used to delete an executable in a wait-and-retry loop. Rhysida ransomware removes its own binary after execution using a PowerShell routine that loops on Test-Path and Start-Sleep until the file is gone, eliminating forensic artifacts.

Suspicious Script Host Execution of JavaScript From a User-Writable Directory (via process_creation)

This rule detects wscript.exe or cscript.exe running a .js or .jse file from a user-writable location such as AppData or Temp, the delivery-and-execution pattern behind JavaScript loaders like Gootloader that arrive through SEO-poisoned downloads. Malicious script-host execution from user directories is a recurring initial-access and execution behavior in the Red Canary Threat Detection Report. Detecting it surfaces the loader stage before it fetches and runs a second-stage payload.

Suspicious Remote Script Downloaded via curl and Piped to Shell (via process_creation)

This rule detects a curl download piped directly into a shell in a single command line, the download-and-execute pattern used by the updated XCSSET malware to retrieve and run stage payloads from attacker infrastructure. Adversaries chain curl into sh to fetch and execute code without writing a script to disk, so this one-liner is a strong indicator of remote payload execution on macOS.

Suspicious File Download to tmp and Quarantine Removal via curl and xattr

This rule detects a shell command that downloads a file into the tmp directory with curl, strips the macOS quarantine attribute with xattr, marks it executable and runs it. This chain is the macOS infection path from fake Claude Code advertisements delivering an AMOS style stealer.

Malicious Logon Script Persistence via UserInitMprLogonScript

This rule detects the creation or modification of the UserInitMprLogonScript value under the user Environment key, a logon persistence technique observed in a martial-law-themed APT campaign that pointed this value at updater.exe to execute at each logon. It captures the abuse of a rarely used logon-script registry entry to survive reboots. Detecting this is important because UserInitMprLogonScript is almost never set by legitimate software and is a well-known persistence primitive.

Malicious Boot Recovery Disable via Bcdedit (via process_creation)

This rule detects bcdedit being used to disable Windows recovery or force boot into ignore-all-failures or safe mode. Ransomware alters the boot configuration so that automatic repair and recovery options cannot restore the system after encryption. Tampering with boot recovery settings from the command line is a strong impact indicator.

Malicious Fileless JavaScript Execution via Deno Data URI (via process_creation)

This rule detects the Deno runtime executing an inline base64 encoded JavaScript payload passed as a data application javascript URI, a fileless execution technique used by attackers abusing alternative runtime environments to evade disk based detection. The allow all flag combined with an inline data URI is a strong indicator of malicious in memory code execution.

TAG-144 Payload Staging via MyCustomAgent User-Agent (via proxy)

This rule detects HTTP requests using the hardcoded MyCustomAgent/1.0 user-agent that the TAG-144 loader sets when pulling staged payloads from paste services via ServerXMLHTTP. Adversaries leverage a fixed non-browser user-agent to fetch second-stage code, making this distinctive string a reliable delivery-stage indicator.

Suspicious DLL Sideloading via rundll32 Loading MSADOCG (via process_creation)

This rule detects rundll32.exe loading MSADOCG.DLL, the sideloaded module used to launch the SugarGh0st RAT payload. Sideloading a maliciously named DLL through rundll32 hides code execution behind a signed Windows utility.

Possible Path Traversal Local File Inclusion Against Exposed Cloud Function (via webserver)

This rule detects web requests containing directory traversal sequences targeting sensitive Unix files such as etc/passwd, matching the local file inclusion probes sent to exposed Cloud Function endpoints. Adversaries use these payloads to read arbitrary files and enumerate a container before escalating to remote code execution, so traversal attempts against run.app services should be reviewed.

Possible Citrix NetScaler SAML Endpoint Abuse for Pre-Auth RCE (CVE-2023-3519) (via webserver)

This rule detects requests to the NetScaler SAML processing endpoints associated with CVE-2023-3519 exploitation. This maps to abuse of the SAML login and artifact endpoints where crafted assertions trigger the memory corruption vulnerability. An attacker leverages these unauthenticated endpoints to achieve remote code execution on the gateway.

Suspicious Wininit Look-Alike Binary Execution from Windows Directory

This rule detects execution of a binary named to closely resemble the legitimate Windows initialization process which Lorenz ransomware uses for persistence from the Windows directory. Observed in NCC Group research unmasking Lorenz ransomware deploying a WinIniw.exe persistence binary. Typosquatting core system process names is a common masquerading tactic that warrants investigation.

Suspicious Active Directory Enumeration via Sysinternals AD Explorer Snapshot (via process_creation)

This rule detects Sysinternals AD Explorer being run with the accepteula and snapshot switches to dump an offline copy of Active Directory, a discovery step used by the RedCurl EarthKapre APT. A snapshot captures the full directory for later credential and target analysis. Automated AD Explorer snapshots outside a sanctioned administrative context indicate reconnaissance by an intruder.

Suspicious Vulnerable Driver EneIo Load for BYOVD (via image_load)

This rule detects the loading of the EneIo.sys driver, a known vulnerable driver abused for bring-your-own-vulnerable-driver privilege escalation. This behavior was observed in the updated MATA campaign against industrial companies to gain kernel-level access and disable defenses. Because a legitimate ENE Technology driver of this name also exists, the match should be triaged against expected motherboard and peripheral software.

Suspicious Environment File Credential Search via findstr (via process_creation)

This rule detects use of findstr or find to search for .env files, the credential-harvesting behavior of the InvisibleFerret backdoor which sweeps drives C through G for secrets. Programmatically hunting environment files across drives targets API keys and database credentials for theft.