Sigma detection rules, expert-reviewed

Suspicious PowerShell In-Memory Execution with AES Decryption

This rule detects PowerShell script blocks that combine Invoke-Expression with AES and base64 decryption routines. The DarkCloud stealer chain decrypts an obfuscated payload in memory and executes it via Invoke-Expression. Pairing in-memory execution with cryptographic decryption is characteristic of staged fileless loaders.

Malicious PUBLOAD Fake Windows Update C2 Request via Proxy (via proxy)

This rule detects outbound HTTP requests to the fake Windows Update redirect URI used by the PUBLOAD downloader attributed to Stately Taurus. The path masquerades as a legitimate Microsoft update redirect while delivering ToneShell and Bookworm payloads. Catching this beacon reveals an infected host reaching attacker command-and-control disguised as benign update traffic.

Malicious PubLoad C2 Beacon Spoofing Microsoft Host (via proxy)

This rule detects PubLoad C2 traffic that spoofs the Host header as www.asia.microsoft.com while requesting the URI path v6-winsp1-wuredir, a pattern used by Stately Taurus to disguise beacons as Windows Update traffic. The mismatch between a Microsoft-looking Host and the non-Microsoft destination reveals the covert command-and-control channel.

Malicious Splinter Post-Exploitation Implant C2 URI Pattern (via proxy)

This rule detects web requests to the fixed HTTP command-and-control endpoints used by the Splinter post-exploitation red-team implant, including its heartbeat, task-event, and file-transfer paths. These structured URI patterns are unique to the tool and indicate an active implant beaconing to its controller.

Malicious TCC AppleEvents Reset via Tccutil

This rule detects the tccutil command resetting the AppleEvents privacy permissions, which clears prior automation consent so the malware can re-prompt or re-establish control of other applications. XCSSET v4.0 resets AppleEvents to enable its AppleScript-driven automation. Detecting this reset surfaces manipulation of the macOS privacy framework for defense evasion.

Malicious AI CLI Anti-Attribution and Permission Bypass Flags

This rule detects invocation of an AI coding CLI with flags that suppress attribution headers or bypass the human approval gate such as the skip-permissions switch or the yolo approval mode. The Chinese-speaking actor sets these options to let an AI model run offensive actions autonomously and anonymously. Detecting these flags reveals adversarial abuse of agentic tooling to remove human oversight.

Malicious Scheduled Task Named Gentlemen via Schtasks

This rule detects creation of a scheduled task named gentlemen, the persistence marker used by The Gentlemen ransomware operators. The task re-launches ransomware tooling across reboots during the intrusion. Detecting this named task provides a high-confidence indicator tied directly to the campaign.

Suspicious MicrosoftEdgeUpdate Launched with Dat Config File

This rule detects MicrosoftEdgeUpdate.exe being started with a --config argument pointing at a .dat file, a pattern the legitimate Edge updater never uses. The Vidar campaign abuses the trusted Edge updater name to sideload a payload configured from a data file such as mgwthmc2.dat. Detecting this unusual argument reveals a masqueraded loader riding a signed updater filename.

Malicious Scheduled Task Masquerading as Defender NisSrv via Schtasks

This rule detects creation of a scheduled task named SystemAgentService that launches a NisSrv.exe payload at user logon. The Vidar stealer and XMRig miner campaign registers this task to masquerade its persistence as the Microsoft Defender network inspection service. Detecting the fake service task exposes a logon-triggered foothold impersonating a security component.

Suspicious Base64 Decoded Shell Dropper via Command Line

This rule detects a base64 encoded blob being decoded on the command line and piped straight into a shell interpreter. The OpenClaw AI supply chain campaign hides its curl-based droppers inside base64 to evade string based inspection before executing macOS stealer code. Catching this decode-and-run chain reveals obfuscated execution that static content filters miss.

Suspicious Execution of PAN-OS Captive Portal Implant Binaries (via process_creation)

This rule detects execution of implant binaries dropped during exploitation of the PAN-OS Captive Portal zero-day, staged under /var/tmp as linuxap, linuxda, or linuxupdate. These files provide attacker foothold and follow-on tooling on the compromised firewall.

Malicious Payload Download From copy.fail Exploit Host on Linux (via process_creation)

This rule detects curl or wget retrieving content from the copy.fail exploit host used in CVE-2026-31431 Copy Fail attacks. The downloaded exploit is followed by su-based privilege escalation to root on the compromised Linux system.

Malicious PowerShell Masquerading as Windows Terminal in ProgramData (via process_creation)

This rule detects an executable named wt.exe running from a ProgramData path, a masquerade used in the Axios supply chain attack where PowerShell was copied to %PROGRAMDATA%\wt.exe to impersonate Windows Terminal. The legitimate Windows Terminal never runs from ProgramData, so this location indicates a relocated payload used to evade detection.

Malicious FRP Reverse Proxy Tunnel Identified by Hardcoded Token (via process_creation)

This rule detects the hardcoded FRP authentication token frpforzhangwei used by CL-UNK-1068 to establish fast reverse proxy tunnels into victim networks. This unique token constant identifies the actor's tunneling infrastructure, providing persistent encrypted access for command and control and lateral movement.

Suspicious Extraction of PuTTY SSH Host Keys via Reg Export (via process_creation)

This rule detects export of the PuTTY SshHostKeys registry key, used by CL-UNK-1068 to harvest cached SSH host key material for lateral movement to Unix and network infrastructure. Recorded SSH host keys reveal previously accessed remote systems, so this extraction supports pivoting deeper into the environment.