Sigma detection rules, expert-reviewed

Suspicious AdsExhaust Hidden Edge Search Automation via Start-Process

This rule detects PowerShell launching Microsoft Edge with a preset search query to drive automated ad clicks. AdsExhaust used Start-Process against msedge to open search result pages for click fraud revenue. Scripted browser launches tied to search terms indicate adware monetization rather than user activity.

Suspicious Persistence via PersonalizationCSP Registry Key via registry_set

This rule detects writes to the PersonalizationCSP registry key, abused by the hacktivist actors as an alternate autostart location alongside the Run key. This lock-screen personalization key can be repurposed to launch attacker binaries at logon. Non-standard autostart keys are a durable persistence signal.

Malicious CR4T C2 Beacon via TroubleShooter User-Agent (via proxy)

This rule detects outbound HTTP requests carrying the distinctive TroubleShooter User-Agent string which the CR4T implant of the DuneQuixote campaign uses when communicating with its command-and-control server.

Suspicious Masqueraded System Directory Creation with Trailing Space via cmd

This rule detects creation of a masqueraded Windows system directory containing a trailing space such as Windows -System32 using cmd. The Tangerine Turkey cryptomining campaign creates a directory that visually resembles a trusted system path to blend in XMRig components. Detecting it surfaces masquerading and defense evasion used to hide the miner from analysts.

Malicious Linux systemd Persistence miasma-monitor.service

This rule detects creation of a systemd unit named miasma-monitor.service, the Linux persistence installed by the AsyncAPI npm supply chain compromise. The service relaunches the import-time payload across reboots to keep the compromised developer host under attacker control.

Suspicious Service Persistence Masquerading as DevQueryBrokerService

This rule detects creation of a scheduled task or Windows service named DevQueryBrokerService, a masquerading persistence artifact used by the SADBRIDGE loader that delivers the GOSAR backdoor. The malware installs a service and scheduled task under this benign-looking name to survive reboots and maintain access. The masquerading service name executed through schtasks or sc indicates attacker-controlled persistence rather than a genuine Windows component.

Possible PowerShell Hidden Download Cradle via Process Creation

This rule detects PowerShell launched with hidden window and no-profile flags executing an in-memory download cradle that uses Net.WebClient DownloadString. Observed in NCC Group research on TA505 exploiting the SolarWinds Serv-U vulnerability CVE-2021-35211 for initial access. This technique stages remote payloads directly in memory to evade disk-based detection which makes it a high-value indicator.

Malicious Cloud PRT Theft via Mimikatz cloudap (via process_creation)

This rule detects Mimikatz cloudap and cloudapkd module usage that extracts the Primary Refresh Token key material used for cloud single sign-on. The cloud lateral-movement research shows this yields tokens for pivoting from a compromised host to cloud identity. These module names are tool-specific and indicate active credential theft.

Suspicious TeamViewer Remote Access DNS Resolution (via dns_query)

This rule detects DNS queries to TeamViewer infrastructure subdomains such as master, ping, router, and server nodes under teamviewer.com. Abuse of TeamViewer remote access enabled the Oldsmar water treatment facility intrusion where an operator workstation was manipulated remotely. TeamViewer is dual-use, so this detection is most valuable in ICS and OT segments where remote-access tooling should be absent or tightly controlled.

Suspicious PowerShell Spawned by Windows Script Host via Process Creation (via process_creation)

This rule detects powershell.exe spawned as a child of wscript.exe or cscript.exe, the wscript to cscript to PowerShell chain characteristic of Gootloader documented by Red Canary. Script hosts rarely need to invoke PowerShell in benign workflows, so this parent-child relationship is a high-confidence signal of staged script-based malware executing its next-stage payload.

Malicious Excel Macro Spawning Scripting Interpreter Downloader (via process_creation)

This rule detects Microsoft Excel spawning a scripting interpreter such as PowerShell, WScript, or cmd, the macro execution chain described in Deep Instinct's Regex Gone Rogue analysis. A weaponized xlsm macro uses WScript.Shell to launch PowerShell that downloads and runs a batch file. This indicates user-executed macro abuse leading to remote payload download and code execution.

Suspicious PowerShell Communication with Dropbox API (via ps_script)

This rule detects PowerShell script content that contacts the Dropbox content API file download endpoint. The DEEP#GOSU campaign abused Dropbox as a staging and exfiltration channel for encrypted payloads and stolen data.

Malicious wp2shell WordPress Web Shell via PHP Drop to Plugin Directory

This rule detects a PHP file written into a wp2shell plugin directory which is the web shell installed by the pre-auth WordPress RCE before command execution. Attackers drop the malicious plugin to gain a persistent server-side foothold. A PHP file appearing under this specific plugin path is a high-confidence web shell indicator.

Suspicious Rundll32 Execution Of DllGetClassObject Export via Process Creation

This rule detects rundll32.exe invoking the DllGetClassObjectGuid export. Cuba ransomware executes its loader DLL through rundll32 using this specific non-standard export name to proxy execution, an artifact with no known legitimate use.

Suspicious Download Cradle via Cmd Mkdir and Curl in Process Creation

This rule detects a cmd.exe one-liner that creates a Temp working directory and immediately downloads a payload with curl, a staging cradle observed ahead of remote access tool deployment. Attackers combine directory creation and a follow-on curl fetch to retrieve installers into a predictable path, so this chained command indicates payload retrieval and staging.