Sigma detection rules, expert-reviewed

Suspicious ClickFix Command Execution via RunMRU Registry Key

This rule detects commands written to the Explorer RunMRU registry key that reference LOLBins such as mshta powershell curl or cscript. Adversaries running the ClickFix social engineering attack trick users into pasting attacker-supplied commands into the Windows Run dialog which persists them in RunMRU. Catching this reveals the initial user-executed loader stage before the second-stage payload runs.

Suspicious Run Key Persistence Executing VBScript as WindowsSecurityCheck

This rule detects a Run key named WindowsSecurityCheck whose value launches a .vbs script. The KimJongRAT stealer sets this entry to run a VBScript at logon while masquerading as a security component. A security-themed autorun name pointing to a script indicates malicious persistence.

Suspicious Logon Script Persistence via UserInitMprLogonScript

This rule detects modification of the HKCU Environment UserInitMprLogonScript value, which registers a script that runs at each user logon. The Blitz malware abuses this rarely-used key for persistence. Because few legitimate applications set this value, changes are a high-confidence persistence indicator.

Suspicious RunOnce Persistence Pointing to User AppData

This rule detects a RunOnce registry value whose payload path resides in the user AppData directory. The DarkCloud stealer establishes persistence through HKCU RunOnce entries referencing its dropped AutoIt-compiled executable. A RunOnce value launching a binary from a user-writable location is a common malware persistence pattern.

Malicious SnipBot COM Hijack via InprocServer32 CLSID (via registry_set)

This rule detects registry writes to the InprocServer32 subkey of CLSID 2155fee3-2419-4373-b102-6843707eb41f, the COM object SnipBot hijacks to persist and execute its payload. COM hijacking gives the RomCom operator stealthy persistence triggered by normal application activity.

Malicious FalseFont Backdoor Run Key Persistence from AppData (via registry_set)

This rule detects a Run key persistence value pointing to a host.exe or broker.exe binary under an AppData path, the autostart mechanism the FalseFont backdoor uses to survive reboots. FalseFont is attributed to the Curious Serpens espionage actor, and running these implants from a user writable directory via a Run key is a clear sign of established backdoor persistence.

Suspicious Port Proxy Persistence Registry Key Creation (via registry_set)

This rule detects modification of the PortProxy v4tov4 tcp registry subtree that stores netsh port forwarding rules, the persistence footprint left when Volt Typhoon establishes an internal relay. Legitimate administrative use of port proxies is rare in most environments, so writes under this key warrant investigation for covert traffic tunneling.

Malicious Registry Run Key Persistence via AHealthDB by Stately Taurus

This rule detects creation of a Run key value named AHealthDB that launches SmadavProtect32.exe, matching the persistence mechanism used by Stately Taurus in cyberespionage against the Philippines government reported by Unit 42. The actor masquerades a Run entry to auto-start a sideloading host at logon which maintains footholds for espionage.

Suspicious PowerShell Shellcode Loader via Function Pointer Delegate

This rule detects PowerShell that fetches remote content and invokes GetDelegateForFunctionPointer to execute shellcode. The AdaptixC2 framework uses Invoke-RestMethod to retrieve a beacon and this delegate call to run it in memory. Combining a network fetch with function pointer delegation is a hallmark of in-memory shellcode loaders.

Suspicious PowerShell In-Memory Execution with AES Decryption

This rule detects PowerShell script blocks that combine Invoke-Expression with AES and base64 decryption routines. The DarkCloud stealer chain decrypts an obfuscated payload in memory and executes it via Invoke-Expression. Pairing in-memory execution with cryptographic decryption is characteristic of staged fileless loaders.

Malicious GenAI Browser Extension C2 and PAC Redirection (via proxy)

This rule detects web traffic to the command-and-control WebSocket endpoint, proxy auto-config file, and data-exfiltration API used by high-risk generative-AI browser extensions reported by Unit 42. These extensions hijack browser proxy settings and read user email and session data, exfiltrating it to attacker infrastructure.

Suspicious Non-Standard HTTP Methods Used for Covert C2 (via proxy)

This rule detects HTTP requests using the non-standard verbs POT, DPF, UPF, CPF, and LPF employed by malware in a suspected China-based espionage operation to encode command and control operations. These invalid HTTP methods are not produced by legitimate clients, so their presence marks covert C2 signaling.

Malicious PUBLOAD Fake Windows Update C2 Request via Proxy (via proxy)

This rule detects outbound HTTP requests to the fake Windows Update redirect URI used by the PUBLOAD downloader attributed to Stately Taurus. The path masquerades as a legitimate Microsoft update redirect while delivering ToneShell and Bookworm payloads. Catching this beacon reveals an infected host reaching attacker command-and-control disguised as benign update traffic.

Possible Prometei Botnet C2 URI Pattern

This rule detects outbound HTTP requests matching the Prometei botnet download and command-and-control URI patterns, including architecture-tagged downloader requests and the p.cgi tasking endpoint. The botnet retrieves UPX-packed ELF payloads from a k.php path and beacons to a cgi-bin p.cgi endpoint. These structured URI patterns identify Prometei infections on the network.

Possible Lampion C2 Beacon With dados Parameter

This rule detects outbound HTTP GET requests carrying a dados URL parameter used by the Lampion malware for command-and-control tasking and data transfer. The malware appends stolen or beacon data to this parameter when contacting its infrastructure. Monitoring this structured request pattern helps surface active Lampion C2 traffic.