Sigma detection rules, expert-reviewed

Malicious NOOPDOOR Registry Persistence under Software License Key (via registry_set)

This rule detects creation of registry values under Software\License with a hex-named subkey, the storage location used by the NOOPDOOR backdoor deployed by MirrorFace against Japanese organizations. The implant hides encoded configuration and payload data in this uncommon path to survive reboots and blend with legitimate keys.

Suspicious node.exe or code.exe Execution from Public Music Directory

This rule detects node.exe or code.exe running from the C:\Users\Public\Music directory, where ChaosBot staged a FRP tunneling client and a downloaded VS Code binary. Legitimate Node.js and VS Code do not execute from a Public media folder, so this path indicates staged tooling for tunneling and command execution. The wrong-path execution of dual-use binaries reveals attacker infrastructure on the host.

Malicious Command Shell Spawned by Wing FTP Server Process

This rule detects the Wing FTP server process WFTPServer.exe spawning cmd.exe or powershell.exe, the remote code execution chain Huntress observed during in-the-wild exploitation of CVE-2025-47812. Attackers abuse a null-byte and Lua injection flaw to run arbitrary commands as the FTP service. A command shell parented by the FTP server is rarely legitimate and is a high-confidence exploitation indicator.

Suspicious NetSupport Client Execution via Scheduled Task

This rule detects execution of the NetSupport remote control client client32.exe spawned by the Windows task scheduler, observed in a Huntress ClickFix CastleLoader campaign that established persistence through a scheduled task. NetSupport is frequently abused as a covert remote access tool after loader execution. Launch of client32.exe from the scheduler service indicates attacker-installed remote access persistence.

Suspicious macOS Trojan-Proxy LaunchAgent GoogleHelperUpdater Persistence (via file_event)

This rule detects creation of a LaunchAgent property list named GoogleHelperUpdater.plist. The macOS Trojan-Proxy bundled with cracked software installs this masquerading Google-branded LaunchAgent to persist and relay traffic through the victim host, so this plist name in a LaunchAgents directory indicates the proxy implant establishing persistence.

Suspicious Executable Launched from SYSVOL Share

This rule detects an executable running directly from a domain SYSVOL path. The Twelve and BlackJack groups deployed payloads such as letsgo.exe through Group Policy scripts hosted on SYSVOL to distribute malware across the domain, so an EXE executing from SYSVOL warrants review.

Malicious PowerShell Download From Storjshare With UAC Elevation via OXLoader

This rule detects PowerShell downloading a payload from the storjshare distribution service and relaunching it with RunAs to trigger UAC elevation as used by the OXLoader loader delivering CASTLESTEALER in Elastic research. Combining a remote fetch with an elevation prompt indicates the loader staging its next component with administrative rights.

Suspicious PowerShell ReadAllBytes and Expand-Archive Payload Staging (via process_creation)

This rule detects PowerShell reading raw bytes from a dropped file and expanding an archive in the same command, a loader chain launched from a malicious LNK in the SmugX campaign delivering PlugX. Chaining ReadAllBytes with Expand-Archive is characteristic of staged payload extraction rather than normal scripting.

In-Memory Offensive PowerShell Tooling Cmdlet Usage (via process_creation)

This rule detects command lines that reference offensive PowerShell tradecraft such as Invoke-Mimikatz, PowerView, Invoke-Kerberoast or Get-Keystrokes, revealing use of red-team frameworks for credential access, discovery and post-exploitation. Weaponized PowerShell is the most prevalent technique in the Red Canary Threat Detection Report, and these function names are strong indicators of adversary tooling loaded in memory. Detecting the cmdlet names surfaces the activity even when the payload is fileless.

Suspicious Run Key Referencing Alternate Data Stream Payload

This rule detects an autorun value whose data references an alternate data stream on the user profile. Gamaredon hides GammaPhish payloads in named streams such as USERPROFILE GTR and points a Run entry at them for stealthy persistence. Autorun values pointing into alternate data streams are a strong sign of hidden payload persistence.

Suspicious APT37 Persistence via MicrosoftUpdate Scheduled Task From ProgramData (via process_creation)

This rule detects APT37 creating a scheduled task named MicrosoftUpdate that repeatedly executes a payload staged in the ProgramData directory every few minutes. The masquerading task name paired with a ProgramData executable indicates the Rustonotto loader.

Possible PsExec Remote Service Installation with Randomly Named Service (via security)

This rule detects the installation of a new Windows service whose name is a random eight-character alphabetic string, matching the pattern left behind by PsExec-style remote execution tooling. Adversaries install such transient services during lateral movement to run code under the SYSTEM context, so a random service name paired with a service install event is a strong indicator of hands-on-keyboard activity.

Malicious Exchange Transport Agent Installation Artifacts - Native (via msexchange-management)

This rule detects load an artifact in the Exchange transport agent.

Malicious PrintNightmare Privilege Escalation via Invoke-Nightmare

This rule detects the Invoke-Nightmare PowerShell cmdlet used to exploit the PrintNightmare vulnerability for local privilege escalation, as observed in SnapMC intrusions before data theft. Invocation of this public exploit tooling reliably indicates an attempt to gain SYSTEM privileges through the print spooler.

Malicious Named Pipe Netcat Reverse Shell via Shell (via process_creation)

This rule detects a reverse shell built from a named pipe relayed through netcat on Linux hosts. The marimo blockchain botnet campaign used mkfifo and nc to relay an interactive shell back to attacker infrastructure. This combination of a fifo and netcat is a well known reverse shell construct that warrants immediate investigation.