Sigma detection rules, expert-reviewed

Malicious Turla PNG Dropper Service Masquerading as Windows Error Reporting via Service Creation

This rule detects installation of a Windows service using names that masquerade as legitimate Windows Error Reporting components which the Turla PNG Dropper uses for persistence. Observed in NCC Group research on the returning Turla PNG Dropper which registers services such as WerFaultSvc and RegRunnerSvc to load steganographic payloads. Detecting these masquerading service installations helps catch stealthy persistence by this espionage actor.

Suspicious Long Alphanumeric DNS Subdomain Indicative of DNS Tunneling

This rule detects DNS queries whose leftmost label is an unusually long fixed-width alphanumeric string, matching the 28 to 31 character encoded subdomains used by the Saitama DNS implant to smuggle command-and-control data. Such high-entropy labels are a hallmark of DNS tunneling and warrant review of the querying host for a covert C2 channel.

Malicious EKS Access Policy Association Granting Cluster Admin

This rule detects CloudTrail AssociateAccessPolicy events that attach the AmazonEKSClusterAdminPolicy or AmazonEKSAdminPolicy to an EKS access entry. Wiz Research showed this new access management API can be abused to grant an attacker principal cluster administrator rights, so unexpected admin grants should be treated as potential privilege escalation.

Malicious Immutable Flag on SSH authorized_keys via chattr

This rule detects use of chattr to set or clear the immutable attribute on an SSH authorized_keys file. Linux intrusion actors inject a backdoor key and then mark authorized_keys immutable so defenders and competing actors cannot remove their persistent access.

Malicious BITS Job Notify Command Pointing To ProgramData Payload via BITSLOTH

This rule detects creation of a BITS transfer job named Microsoft Windows configured with a SetNotifyCmdLine that executes a binary staged under C:\ProgramData which is the persistence mechanism used by the BITSLOTH backdoor. Adversaries abuse the Background Intelligent Transfer Service to survive reboots and blend malicious execution into a trusted Windows service.

Suspicious php.exe Backdoor Execution from AppData Roaming

This rule detects the PHP interpreter running from a user AppData Roaming directory while loading extensions and a config file, which matches the Interlock PHP backdoor. The group deployed php.exe with an extension directory and config.cfg to run a resident backdoor from Roaming rather than a normal install path. A scripting interpreter running from a per-user profile path is a strong indicator of malicious code execution and persistence.

Malicious svcagent DLL Load From AssetMon ProgramData Directory via PHANTOMPULSE

This rule detects loading of svcagent.dll from a ProgramData AssetMon directory as used by the PHANTOMPULSE blockchain C2 RAT in Elastic research. A service agent named DLL staged under a fabricated AssetMon folder in ProgramData indicates the implant module being mapped for execution and persistence.

Suspicious UAC Bypass via ComputerDefaults Auto-Elevation (via process_creation)

This rule detects the auto-elevating ComputerDefaults.exe spawning a command interpreter or scripting host, the signature of a registry-hijack UAC bypass. PrivateLoader abuses ComputerDefaults to run elevated code without prompting the user, gaining higher privileges for installation. A trusted auto-elevated binary launching cmd or PowerShell is a well-known UAC-bypass pattern.

Suspicious C2 Connection to AWS Lambda Function URL

This rule detects outbound connections to AWS Lambda function URLs in the ap-southeast-1 region. The backdoor targeting Southeast Asian governments tunnels novel covert C2 through Lambda function URLs to blend with legitimate cloud traffic. Endpoint processes contacting these on.aws endpoints warrant review for web-service C2 abuse.

Possible Process Injection into Notepad via PythonRatLoader (via process_creation)

This rule detects notepad.exe being spawned by a Python interpreter, which corresponds to the PythonRatLoader chain that creates suspended notepad processes as hosts for Early Bird APC shellcode injection delivering DCRat, VenomRAT and XWorm. A Python process launching Notepad is highly abnormal on endpoints.

Suspicious Virtual Machine Detection via Get-MpComputerStatus and Win32_VideoController (via ps_script)

This rule detects PowerShell anti-analysis checks used by MintsLoader that read the IsVirtualMachine property from Get-MpComputerStatus or query the Win32_VideoController AdapterDACType to fingerprint virtual display adapters. The loader aborts when it believes it runs inside a sandbox. Scripted inspection of these virtualization indicators is characteristic of evasive malware rather than administration.

Suspicious Retrieval of AWS Secrets Manager Values (via cloudtrail)

This rule detects GetSecretValue and BatchGetSecretValue calls against Secrets Manager, a credentials-from-cloud-stores technique used to harvest database passwords, API keys and tokens after gaining access to an AWS account. Cloud secret-store access is tracked in the Red Canary Threat Detection Report cloud coverage. Detecting these reads surfaces bulk secret harvesting.

Suspicious Cron Job Persistence Creation on Linux (via process_creation)

This rule detects editing of a user crontab or writing into system cron directories, the scheduled-execution mechanism adversaries abuse on Linux to persist and re-run payloads on a timer. Cron-based persistence is a durable technique across the Linux threats summarized in the Red Canary Threat Detection Report. Detecting crontab edits and cron-directory writes surfaces persistence as it is established.

DSRM Password Changed - Reg via Command (via security)

This rule detects reset or synchronize with another domain account the DSRM (Directory Services Restore Mode) password in order to escalate privileges.

DLL Side-Loading of WebUI.dll via Iscrpaint Host Binary

This rule detects the iscrpaint.exe binary loading WebUI.dll, the DLL side-loading pair used to run LummaStealer under a signed host process. Loading this companion DLL from the malware staging directory indicates search-order hijacking rather than legitimate application behavior.