Sigma detection rules, expert-reviewed

Malicious wp2shell WordPress Web Shell via PHP Drop to Plugin Directory

This rule detects a PHP file written into a wp2shell plugin directory which is the web shell installed by the pre-auth WordPress RCE before command execution. Attackers drop the malicious plugin to gain a persistent server-side foothold. A PHP file appearing under this specific plugin path is a high-confidence web shell indicator.

Suspicious Rundll32 Execution Of DllGetClassObject Export via Process Creation

This rule detects rundll32.exe invoking the DllGetClassObjectGuid export. Cuba ransomware executes its loader DLL through rundll32 using this specific non-standard export name to proxy execution, an artifact with no known legitimate use.

Suspicious Download Cradle via Cmd Mkdir and Curl in Process Creation

This rule detects a cmd.exe one-liner that creates a Temp working directory and immediately downloads a payload with curl, a staging cradle observed ahead of remote access tool deployment. Attackers combine directory creation and a follow-on curl fetch to retrieve installers into a predictable path, so this chained command indicates payload retrieval and staging.

Suspicious PowerShell Bypass Spawned by wscript Script Host

This rule detects wscript spawning PowerShell with an execution policy bypass, the initial handoff in a Huntress-analyzed malspam-to-loader chain that led to an in-memory .NET loader. A script host launching PowerShell with bypass flags reflects a scripted download-and-execute stage rather than normal administration. This parent-child pattern is a common malspam loader behavior.

Suspicious PG_MEM Payload Drop in PostgreSQL Data Directory (via file_event)

This rule detects the PG_MEM malware writing its pg_core loader and pg_mem payload into the PostgreSQL data directory after gaining code execution through the database. Executables written under the postgres data directory are highly abnormal and indicate compromise.

Suspicious JumpCloud Password Brute Force Followed by Success

This rule detects a JumpCloud account accumulating ten or more failed login attempts within a short window, indicating password brute forcing. A burst of authentication failures against one identity signals credential guessing that may precede a successful takeover.

Suspicious FakeBat Fake Browser Update Stats and Download Endpoints (via proxy)

This rule detects requests to the FakeBat distribution endpoints get_stats.php and the misspelled dwnl_standart.php used by fake browser update pages to track victims and serve the MSIX payload. The typo-laden download path is a distinctive campaign artifact hosted on doggygangers[.]com. This surfaces drive-by delivery of FakeBat leading to LummaC2.

Suspicious VOLTZITE Single-Character Named ZIP Exfil Staging (via file_event)

This rule detects creation of ZIP archives whose file name is a single letter or digit, a staging convention observed in VOLTZITE intrusions. The group compresses collected data into minimally named archives to blend into disk activity before exfiltration. Detecting these staging files provides an opportunity to interrupt data theft prior to transfer.

Malicious regsvr32.exe Spawned by calc.exe via DLL Side-Loading

This rule detects regsvr32.exe launched with the Windows Calculator calc.exe as its parent process. During Qbot infections the side-loaded calc.exe uses regsvr32 to register and execute the trojan payload DLL. Calculator legitimately never spawns regsvr32, so this parent-child chain is a strong indicator of DLL side-loading and proxied code execution.

Malicious LSASS Credential Dump via comsvcs.dll MiniDump by APT28 (via process_creation)

This rule detects use of rundll32 to invoke the MiniDump export of comsvcs.dll against the LSASS process, the credential-access technique documented in CERT-FR analysis of the APT28 intrusion set targeting French entities. Adversaries leverage this signed LOLBin to capture a memory dump containing plaintext and hashed credentials, making early detection critical for stopping privilege escalation and lateral movement.

Malicious XE Group thump.aspx Webshell Interaction via File Directory Parameters (via webserver)

This rule detects requests to the XE Group .thump.aspx webshell that carry the file-listing and file-read parameters the operator uses to browse and exfiltrate server files. The hidden-prefixed ASPX name combined with these directory parameters distinguishes webshell tasking from normal application traffic.

In-Memory MSBuild Proxy Execution of a Project From a User-Writable Path (via process_creation)

This rule detects MSBuild.exe building an inline-task project file located in a user, temp or AppData directory, a pattern adversaries use to compile and run C# payloads in memory under a signed Microsoft developer utility. MSBuild proxy execution is a trusted-developer-utility abuse technique in the Red Canary Threat Detection Report. Detecting builds sourced from user-writable paths surfaces code execution that evades application allowlisting.

Malicious Recovery Inhibition via Shadow Copy and WinRE Tampering

This rule detects command lines that delete Volume Shadow Copies with vssadmin or disable the Windows Recovery Environment with reagentc, actions used by NOVABLIGHT to prevent system and file recovery. Inhibiting recovery is a common precursor to destructive or extortion activity.

Suspicious Disk Image File Written by a Browser or Mail Client (via file_event)

This rule detects a browser or email client writing an ISO, IMG or VHD disk-image file to disk, the delivery half of an HTML-smuggling campaign that packages a payload inside a container to bypass Mark-of-the-Web and mail-attachment controls. HTML smuggling and container-file delivery are recurring initial-access techniques in the Red Canary Threat Detection Report. Detecting image files dropped by internet-facing apps surfaces smuggled payloads before they are mounted and run.

Suspicious Batch Script Unhiding Files via Attrib From Temp

This rule detects a batch script spawning attrib.exe to clear hidden and system attributes, a staging step used by Zhong Stealer to reveal and execute dropped components. Clearing attributes on files via a randomly named batch is uncommon in benign activity.