Sigma detection rules, expert-reviewed

Suspicious Wininit Look-Alike Binary Execution from Windows Directory

This rule detects execution of a binary named to closely resemble the legitimate Windows initialization process which Lorenz ransomware uses for persistence from the Windows directory. Observed in NCC Group research unmasking Lorenz ransomware deploying a WinIniw.exe persistence binary. Typosquatting core system process names is a common masquerading tactic that warrants investigation.

Suspicious Active Directory Enumeration via Sysinternals AD Explorer Snapshot (via process_creation)

This rule detects Sysinternals AD Explorer being run with the accepteula and snapshot switches to dump an offline copy of Active Directory, a discovery step used by the RedCurl EarthKapre APT. A snapshot captures the full directory for later credential and target analysis. Automated AD Explorer snapshots outside a sanctioned administrative context indicate reconnaissance by an intruder.

Suspicious Vulnerable Driver EneIo Load for BYOVD (via image_load)

This rule detects the loading of the EneIo.sys driver, a known vulnerable driver abused for bring-your-own-vulnerable-driver privilege escalation. This behavior was observed in the updated MATA campaign against industrial companies to gain kernel-level access and disable defenses. Because a legitimate ENE Technology driver of this name also exists, the match should be triaged against expected motherboard and peripheral software.

Suspicious Environment File Credential Search via findstr (via process_creation)

This rule detects use of findstr or find to search for .env files, the credential-harvesting behavior of the InvisibleFerret backdoor which sweeps drives C through G for secrets. Programmatically hunting environment files across drives targets API keys and database credentials for theft.

Suspicious AdsExhaust Hidden Edge Search Automation via Start-Process

This rule detects PowerShell launching Microsoft Edge with a preset search query to drive automated ad clicks. AdsExhaust used Start-Process against msedge to open search result pages for click fraud revenue. Scripted browser launches tied to search terms indicate adware monetization rather than user activity.

Suspicious Persistence via PersonalizationCSP Registry Key via registry_set

This rule detects writes to the PersonalizationCSP registry key, abused by the hacktivist actors as an alternate autostart location alongside the Run key. This lock-screen personalization key can be repurposed to launch attacker binaries at logon. Non-standard autostart keys are a durable persistence signal.

Malicious CR4T C2 Beacon via TroubleShooter User-Agent (via proxy)

This rule detects outbound HTTP requests carrying the distinctive TroubleShooter User-Agent string which the CR4T implant of the DuneQuixote campaign uses when communicating with its command-and-control server.

Suspicious Masqueraded System Directory Creation with Trailing Space via cmd

This rule detects creation of a masqueraded Windows system directory containing a trailing space such as Windows -System32 using cmd. The Tangerine Turkey cryptomining campaign creates a directory that visually resembles a trusted system path to blend in XMRig components. Detecting it surfaces masquerading and defense evasion used to hide the miner from analysts.

Malicious Linux systemd Persistence miasma-monitor.service

This rule detects creation of a systemd unit named miasma-monitor.service, the Linux persistence installed by the AsyncAPI npm supply chain compromise. The service relaunches the import-time payload across reboots to keep the compromised developer host under attacker control.

Suspicious Service Persistence Masquerading as DevQueryBrokerService

This rule detects creation of a scheduled task or Windows service named DevQueryBrokerService, a masquerading persistence artifact used by the SADBRIDGE loader that delivers the GOSAR backdoor. The malware installs a service and scheduled task under this benign-looking name to survive reboots and maintain access. The masquerading service name executed through schtasks or sc indicates attacker-controlled persistence rather than a genuine Windows component.

Possible PowerShell Hidden Download Cradle via Process Creation

This rule detects PowerShell launched with hidden window and no-profile flags executing an in-memory download cradle that uses Net.WebClient DownloadString. Observed in NCC Group research on TA505 exploiting the SolarWinds Serv-U vulnerability CVE-2021-35211 for initial access. This technique stages remote payloads directly in memory to evade disk-based detection which makes it a high-value indicator.

Malicious Cloud PRT Theft via Mimikatz cloudap (via process_creation)

This rule detects Mimikatz cloudap and cloudapkd module usage that extracts the Primary Refresh Token key material used for cloud single sign-on. The cloud lateral-movement research shows this yields tokens for pivoting from a compromised host to cloud identity. These module names are tool-specific and indicate active credential theft.

Suspicious TeamViewer Remote Access DNS Resolution (via dns_query)

This rule detects DNS queries to TeamViewer infrastructure subdomains such as master, ping, router, and server nodes under teamviewer.com. Abuse of TeamViewer remote access enabled the Oldsmar water treatment facility intrusion where an operator workstation was manipulated remotely. TeamViewer is dual-use, so this detection is most valuable in ICS and OT segments where remote-access tooling should be absent or tightly controlled.

Suspicious PowerShell Spawned by Windows Script Host via Process Creation (via process_creation)

This rule detects powershell.exe spawned as a child of wscript.exe or cscript.exe, the wscript to cscript to PowerShell chain characteristic of Gootloader documented by Red Canary. Script hosts rarely need to invoke PowerShell in benign workflows, so this parent-child relationship is a high-confidence signal of staged script-based malware executing its next-stage payload.

Malicious Excel Macro Spawning Scripting Interpreter Downloader (via process_creation)

This rule detects Microsoft Excel spawning a scripting interpreter such as PowerShell, WScript, or cmd, the macro execution chain described in Deep Instinct's Regex Gone Rogue analysis. A weaponized xlsm macro uses WScript.Shell to launch PowerShell that downloads and runs a batch file. This indicates user-executed macro abuse leading to remote payload download and code execution.