Sigma detection rules, expert-reviewed

Suspicious PowerShell AMSI Bypass In-Memory Patching

This rule detects PowerShell attempting to disable the Antimalware Scan Interface by reflectively locating and patching amsiInitFailed or amsi.dll in memory. The ARECHCLIENT2 information stealer uses this AMSI bypass so subsequent in-memory stages are not inspected by endpoint scanning.

Suspicious Windows Subsystem for Linux (WSL) Installation - PowerShell (via powershell)

This rule detects enables the WSL to cary out malicious activities in a virtual instance to avoid detection.

Suspicious pythonw.exe Executing LICENSE.txt Downloader from AppData

This rule detects a hidden pythonw.exe process launched from the AppData Local directory with a LICENSE.txt argument, matching an AI-themed lure that drops a Python downloader loading shellcode. Running a Python interpreter over a text file disguised as a license from a user writable path is a strong sign of staged malware execution.

Suspicious ESXi Virtual Machine Enumeration via esxcli Process List

This rule detects esxcli enumerating running virtual machine processes on an ESXi host. RTM Locker collects the output of esxcli vm process list into a temporary file to build a target list before force-killing and encrypting the VMs. VM process enumeration through esxcli immediately preceding termination is an early ransomware staging behavior.

Suspicious UAC Bypass via CMSTP INF Auto-Install

This rule detects execution of cmstp.exe with the auto-install switch pointing to an INF file, a technique used to bypass User Account Control and execute arbitrary commands at high integrity. The Sliver C2 framework and multiple threat actors abuse this living-off-the-land binary to elevate privileges while evading defenses. Detecting it early helps stop attacker privilege escalation before further post-exploitation activity.

Possible Citrix Session Recording SOAPAction Deserialization RCE (CVE-2023-6184) (via webserver)

This rule detects POST or M-POST requests to the Citrix Session Recording broker rem endpoints carrying a SOAPAction header. This maps to the .NET deserialization vulnerability where crafted SOAP requests to the RestApiStat and Player broker interfaces execute arbitrary code. An attacker uses this to gain remote code execution on the session recording server.

Malicious DLL Sideloading of wke.dll via DriverAssistant acvb (via image_load)

This rule detects the signed DriverAssistant binary acvb.exe loading a wke.dll located alongside it, a DLL side-loading chain used to bypass UAC and launch FatalRAT. This behavior was observed in Operation SalmonSlalom against Chinese-speaking targets in APAC. Detecting the abnormal module load exposes the defense-evasion and execution stage of the loader.

Malicious Windows Defender Disable via Policy Registry Keys

This rule detects modification of the Windows Defender policy registry values that switch off antispyware antivirus and real time monitoring as performed in the SystemBC intrusion described by WithSecure. Disabling Defender through policy keys is a defense evasion step attackers take to clear the path for credential theft and ransomware staging.

Suspicious AWS Secrets Manager Bulk Secret Retrieval via BatchGetSecretValue

This rule detects the AWS Secrets Manager BatchGetSecretValue API which returns multiple secret values in a single call. Wiz observed attackers accessing stored secrets after compromising cloud credentials during hybrid cloud intrusions. This is important because bulk secret retrieval is a common credential-access step that harvests database passwords and API keys enabling deeper movement across cloud and on-prem systems.

Malicious Shai-Hulud npm Payload Execution via bun_environment Script (via process_creation)

This rule detects execution of the Shai-Hulud worm install-hook payloads setup_bun.js and bun_environment.js, dropped and run via npm pre/post-install scripts during the supply-chain compromise. These scripts scan for cloud and SSH credentials and self-propagate, so their execution signals active infection of the npm ecosystem.

Malicious Volgmer Payload Storage in WMI Security Registry Key

This rule detects creation of specific named values under the WMI Security registry key used by the Hidden Cobra Volgmer backdoor to hide its encoded configuration and payload. Writing data to this rarely used registry location under these hardcoded GUID value names is a high-confidence indicator of a Volgmer infection.

Suspicious rundll32 shell32.dll Ordinal 61 Execution

This rule detects rundll32.exe calling shell32.dll by ordinal number 61, a proxy-execution trick observed in the NightshadeC2 loader chain. Invoking shell32 functions by ordinal avoids readable export names and is used to launch further stages while blending into normal rundll32 usage. Ordinal-based shell32 execution rarely appears in legitimate activity.

Suspicious Execution of Microsoft.Http.Api.exe from AppData

This rule detects execution of a binary named Microsoft.Http.Api.exe from a user AppData path, used by the SHELBY backdoor to masquerade as a legitimate Microsoft component. A Microsoft-branded executable running from AppData rather than a system directory indicates masquerading and side-loading staging used to blend malicious execution with trusted software.

Suspicious GoGRPC Persistence via Realtek HD Audio Run Key (via process_creation)

This rule detects a PowerShell command that sets a CurrentVersion Run value named Realtek HD Audio pointing to an executable in the roaming AppData folder as used by the GoGRPC backdoor. Legitimate Realtek audio software does not persist from AppData.

Suspicious VMware Tools Binary Executing from Non-Standard Path

This rule detects a process named vmtools.exe or vmwared.exe running from a directory outside the legitimate VMware installation tree. CL-STA-1062 masquerades its loader as VMware guest tooling to evade analyst scrutiny on virtualized targets. Spotting the trusted filename in the wrong path exposes a masqueraded implant rather than genuine VMware software.