Sigma detection rules, expert-reviewed

Suspicious Wscript Spawning Rundll32 to Load Remote DLL (via process_creation)

This rule detects wscript.exe launching rundll32.exe, an unusual parent-child relationship used by the Strela Stealer JavaScript loader to execute a WebDAV-hosted DLL payload. Legitimate scripts rarely invoke rundll32 in this manner.

Suspicious Script Interpreter Command Recorded in Explorer RunMRU History (via registry_set)

This rule detects the Windows Run dialog history under the Explorer RunMRU registry key recording a script-interpreter command such as mshta, powershell, or curl, the residual artifact left when a victim pastes a ClickFix command during this Booking.com themed phishing campaign. Adversaries drive users to run attacker-supplied commands via the Run dialog, so an interpreter invocation captured in RunMRU is a reliable sign of ClickFix-style execution.

Suspicious Python Backdoor Staging in SystemServices Folder (via file_event)

This rule detects creation of a Python script named svc.py inside a SystemServices directory under the local application data path. The DEEP#DOOR campaign staged its Python backdoor and credential stealer at this location.

Malicious macOS LaunchAgent Persistence com.nvm.protocal.plist

This rule detects creation of a LaunchAgent property list named com.nvm.protocal.plist, the macOS persistence dropped by the Mastra npm supply chain compromise. The plist impersonates a Node version manager helper to relaunch the malicious payload at every user login.

Suspicious Remote Payload Download Piped to Shell on Linux

This rule detects curl or wget output piped directly into a shell, the download-and-execute technique used by the PeerBlight Linux backdoor after exploiting React2Shell CVE-2025-55182. Piping a remote script straight to bash runs attacker code without touching disk for review. This one-line fetch-to-shell pattern is a common Linux initial execution indicator.

Suspicious Command Shell Spawned by Service or Remote Execution Parent

This rule detects a command shell spawned by WMI provider host, PsExec, or the SQL Server engine, parent processes that indicate remote or service-based command execution rather than interactive use. These lineages were highlighted as reliable signals of living-off-the-land abuse during lateral movement and post-exploitation. Shells launched from these parents warrant review for hands-on-keyboard activity.

Suspicious Batch File Persistence in Startup Folder

This rule detects creation of the WindowsSecure.bat file inside the Windows Startup folder, the persistence mechanism used by the Snake Python infostealer to survive reboots. Attackers place a batch launcher here so the stealer re-executes at every user logon. A batch file dropped into a Startup directory is a reliable autostart persistence indicator.

Malicious LD_PRELOAD Rootkit Persistence via ld.so.preload

This rule detects a command writing the OVERSTEP shared object into /etc/ld.so.preload to hook every dynamically linked process on a SonicWall SMA appliance. This LD_PRELOAD rootkit hides attacker files and processes while capturing credentials, cementing long-term stealthy access after public-facing exploitation.

Suspicious Copy of Outlook OST Email Data File for Exfiltration

This rule detects copying of an Outlook OST offline data file, a collection step used by the ToddyCat APT before extracting messages with XstExport. The attackers used xcopy to duplicate the .ost mailbox cache to a .ost2 file so its contents could be parsed offline. Copying a locked mailbox data file is a strong indicator of local email collection ahead of exfiltration.

Malicious Local Administrator Account Creation via CherryLoader (via process_creation)

This rule detects creation of a local account named Administrater, a misspelled account name hardcoded in the CherryLoader persistence batch script. The loader created this account and added it to the local administrators group for persistent access.

Malicious Windows Event Log Clearing via PowerShell

This rule detects Windows event log clearing performed through PowerShell log-management methods, an anti-forensic action Qilin ransomware used to wipe event logs during its intrusion. Programmatic clearing of event logs is rarely legitimate and typically indicates an adversary covering tracks.

QBot scheduled task REGSVR32 with C$ image path

Detects the creation of Scheduled Task with REGSVR32 (regsvr32.exe) and C$ in the image path field

Suspicious Cron Job Executing Binary From var tmp via Process Creation

This rule detects a cron daemon spawning a process from the /var/tmp directory. The trojanized Free Download Manager installs an /etc/cron.d/collect job that runs /var/tmp/crond every ten minutes, using cron to persist and periodically launch its reverse-shell payload from a world-writable path.

Suspicious Cloudflared Tunnel Execution via Renamed svchost Binary

This rule detects a process named svchost.exe running Cloudflare tunnel arguments from outside the System32 directory, matching the renamed cloudflared tunnel used by the RMMProject operators for covert C2 access. Adversaries rename cloudflared to svchost.exe to blend in while establishing an outbound tunnel. A svchost image running tunnel arguments from a non-system path is anomalous and indicates masqueraded tunneling.

Malicious BYOVD ThrottleStop Vulnerable Driver Load (via image_load)

This rule detects loading of the ThrottleStop vulnerable driver including the renamed ThrottleBlood.sys variant used in a Bring Your Own Vulnerable Driver attack to terminate security products. The driver exposes a device that lets an unprivileged process kill protected antivirus and EDR processes such as MsMpEng and SentinelAgent. Loading this kernel driver on a server or workstation with no ThrottleStop application present is highly suspicious.