Sigma detection rules, expert-reviewed

Suspicious Persistence via Windows NT CurrentVersion Windows Load Value (via registry_set)

This rule detects Confucius writing to the legacy Windows load value under the HKCU Windows NT CurrentVersion Windows key which auto starts the copied Swom.exe loader at logon. The load value is an uncommon and abused autostart location. Any modification pointing to an executable is suspicious.

Suspicious Cloud Instance Metadata Service Probing

This rule detects command-line access to the cloud instance metadata endpoint at 169.254.169.254, used to steal instance credentials and role tokens. It is associated with software supply chain attacks whose payloads probe the metadata service from compromised build and developer environments. Detecting this probe surfaces cloud credential theft attempts early.

Malicious rundll32 Execution of COLDCOPY DLL via COLDRIVER ClickFix

This rule detects rundll32.exe invoking COLDCOPY DLLs by their known filenames or by the humanCheck and verifyme export names used in COLDRIVER ClickFix lures. Attackers run these exports to launch the YESROBOT and MAYBEROBOT backdoors after tricking a user into pasting a Run dialog command.

Malicious High Risk Local/domain Local Group Membership Change (via security)

This rule detects scenarios where a suspicious group membership is changed. Having Microsoft LAPS installed may trigger false positive events for the builtin administrators group triggered by the system account (S-1-5-18).

Malicious RDP Reconnaissance with Valid Credentials Performed on Multiple Hosts (via security)

This rule detects brutforce RDP services with compromised credentials via tools like Hydra. Note that this event will be reported only with valid user and password credentials, and it may be reported only when RDP session is fully opened (so not during reconnaisance phase) if NLA is disabled. For further correlation, ID 4624/4625 (logon type 3, 7 or 10) should be used.

Suspicious curl Download of nvidiadrivers Archive to Temp (via process_creation)

This rule detects curl retrieving an archive named nvidiadrivers.zip into the user temp directory. The Lazarus ClickFake Interview campaign uses this command to stage its payload while masquerading as a legitimate GPU driver update. The specific archive name written to a temporary path with certificate checks disabled indicates malicious staging.

Malicious EC2 Instance Metadata Credential Theft via curl (via process_creation)

This rule detects a command line that curls the EC2 Instance Metadata Service security-credentials path at 169.254.169.254 to steal the temporary IAM role credentials of a compromised instance. Attackers harvest these credentials for reconnaissance, lateral movement, and privilege escalation in the cloud account. Detecting IMDS credential retrieval on a host flags active cloud credential access.

Suspicious Wscript Execution of File With Media Extension

This rule detects wscript.exe executing a file that carries a media or image extension such as .3gp. LNK-based malware renames script files with deceptive extensions to evade detection while the script host still interprets them. A script host running a supposed media file indicates masquerading and script-based execution.

Suspicious PowerShell Interactive Shell Spawn with Console Output Encoding

This rule detects PowerShell launched with a persistent interactive session that explicitly forces the console output encoding to UTF-8, a pattern used by Sliver C2 implants when spawning an interactive shell channel to the operator. Attackers use this to run hands-on-keyboard commands through the C2 tunnel. Catching this reveals active operator interaction on a compromised host.

Suspicious COM Hijack via CLSID InprocServer32 Pointing to Writable Path (via registry_set)

This rule detects a CLSID InprocServer32 registry value being pointed at a DLL in a user-writable directory such as Temp, AppData or ProgramData. VanHelsing hijacks COM objects by redirecting their server registration to attacker-controlled files, so a CLSID handler in a writable path indicates persistence via COM hijacking.

Malicious EKS Pod Identity Credential Theft via Link-Local Endpoint

This rule detects command line access to the EKS Pod Identity credential endpoint at 169.254.170.23/v1/credentials. Wiz Research demonstrated that a compromised pod can request this URL with a stolen authorization token to retrieve IAM credentials, so direct interaction with this endpoint outside the SDK indicates credential theft.

Malicious Shai-Hulud Bun Payload Execution via npm Preinstall Script (via process_creation)

This rule detects execution of the set_bun.js and bun_environment.js scripts used by the Shai-Hulud 2.0 npm supply chain worm, which are launched from a malicious preinstall entry in package.json to install the Bun runtime and run the worm payload. Adversaries use this staging step to establish execution inside developer and CI environments, so detecting these script invocations exposes a compromised package before credential theft and propagation occur.

Malicious Akira Ransomware Encryptor Execution (via process_creation)

This rule detects execution of the Akira ransomware encryptor invoked with its characteristic path, share and encryption-percentage arguments. Operators launched akira.exe and locker.exe with the -n, -p and -s flags to encrypt local drives and network shares.

Suspicious HTA Execution via Mshta From Shortcut Chain (via process_creation)

This rule detects mshta.exe launching an HTA file which the CoralRaider infection triggers from a malicious LNK to start its multi-stage information stealer chain. Using the trusted mshta LOLBin to run remote or local HTA content is a signed proxy execution technique that evades application controls.

Suspicious PowerShell IEX DownloadString In-Memory Execution via process_creation

This rule detects PowerShell that combines Invoke-Expression with the WebClient DownloadString method to fetch and run remote code entirely in memory. Head Mare and Twelve launched PowerShell with an execution policy bypass and hidden window to download and execute scripts including ADRecon. This fileless download and execute pattern is a common intrusion loader technique.