Sigma detection rules, expert-reviewed

Suspicious VS Code Tunnel Establishment for Covert Access (via process_creation)

This rule detects code.exe creating a remote tunnel while auto-accepting the server license terms. Phantom Goblin abuses VS Code tunnels to maintain covert remote access and command channels.

Suspicious Curl Download From Sysinternals Live Service (via process_creation)

This rule detects curl downloading content from live.sysinternals.com. MisterioLNK loaders abuse this live service as a trusted download host to retrieve second-stage tools and payloads.

Malicious CMSTP UAC Bypass via INF File From Temp (via process_creation)

This rule detects cmstp.exe executing an INF configuration file from a Temp directory using the auto-install flag. This LNK-driven chain abuses CMSTP as a signed binary proxy to bypass UAC and run stealer payloads.

Suspicious Rogue Administrator Account Creation Named System32 (via process_creation)

This rule detects creation of a local account named System32 and its addition to the administrators group. The AgentTesla loader creates this masqueraded account to establish privileged persistence.

Malicious Windows Defender Service Tampering via PowerShell (via process_creation)

This rule detects PowerShell stopping or disabling the WinDefend service. The AgentTesla CPL loader chain uses these commands to neutralize Windows Defender before payload injection.

Suspicious Windows Defender Exclusion via Add-MpPreference (via process_creation)

This rule detects PowerShell adding a Windows Defender path exclusion via Add-MpPreference. DarkWatchMan RAT excludes the system drive during installation to prevent detection of its components.

Suspicious OneNote Spawning Script Interpreter (via process_creation)

This rule detects OneNote spawning a command shell or scripting interpreter. BatLoader is delivered through malicious OneNote attachments that launch cmd or PowerShell to drop and run the BAT loader.

Suspicious PowerShell Reflective Assembly Load With GZip Decompression (via process_creation)

This rule detects PowerShell reflectively loading a .NET assembly combined with GZip stream decompression. BatLoader uses this in-memory loading pattern to unpack and run RAT payloads such as QuasarRAT and AsyncRAT.

Suspicious Renamed PowerShell Binary Execution (via process_creation)

This rule detects a process whose original filename is PowerShell but whose image name is not powershell.exe or powershell_ise.exe. BatLoader copies powershell.exe to a temp folder under a decoy name such as Bill.bat.exe to evade image-based detection.

Suspicious Named Pipe ChromeDecryptIPC Used by Stealer (via pipe_created)

This rule detects creation of a named pipe containing ChromeDecryptIPC. Maranhao Stealer uses this pipe for reflective DLL communication when decrypting Chromium browser credentials.

Malicious SharePoint ToolShell Exploitation via ToolPane Endpoint

This rule detects a POST request to the SharePoint ToolPane endpoint in edit mode with a referer set to the SignOut page, the exact exploitation pattern of the ToolShell on-premises SharePoint vulnerabilities. This unauthenticated request chain is used to forge ViewState and achieve remote code execution and should be treated as active exploitation.

Possible Ivanti Connect Secure Webshell Access

This rule detects HTTP access to Ivanti Connect Secure API paths and CGI scripts associated with the WIREFIRE, LIGHTWIRE, and backdoored compcheckresult webshells dropped during the zero-day exploitation. Attackers use these implanted webshells for persistent remote command execution on the appliance. Requests to these specific endpoints indicate an already-compromised device.

Malicious Run Key Persistence Referencing DLL in User Documents

This rule detects a Run key persistence value whose data references a DLL located under a user Documents folder, matching the Rhadamanthys stealer persistence that pointed an autorun entry at a DLL in the Documents directory. Autorun entries loading a DLL from a user-writable location strongly indicate malicious persistence rather than legitimate software.

Windows Defender Disabled via DisableAntiSpyware Registry Key

This rule detects the Windows Defender DisableAntiSpyware registry value being set, an antivirus tampering step performed by the Phorpiex downloader before deploying LockBit. Disabling Defender via this policy key removes real-time protection prior to ransomware execution.

Suspicious Service DLL Hijack of IKEEXT or PrintNotify

This rule detects modification of the ServiceDll value for the IKEEXT or PrintNotify services, a DLL search-order and service hijack technique used by Winnti in Operation CuckooBees for persistence. Attackers point these built-in services at a malicious DLL so their code runs under a trusted service context. Tampering with the ServiceDll of these services is a strong persistence-and-evasion indicator.