Sigma detection rules, expert-reviewed

Suspicious Data Exfiltration via Rclone Cloud Transfer (via process_creation)

This rule detects Rclone copying or syncing data to a remote backend, the exfiltration tool used by the Ashen Lepus AshTag operators to move staged diplomatic data to attacker cloud storage. Rclone copy and sync operations bulk-transfer collected files off the host to web services.

Malicious Scheduled Task Masquerading as Windows Defender Updater (via process_creation)

This rule detects creation of a scheduled task named to impersonate Windows update or Defender maintenance, a persistence technique used by the Hamas-affiliated Ashen Lepus AshTag malware suite. The benign-looking task names Windows Defender Updater and Automatic Windows Update disguise attacker-controlled recurring execution.

Suspicious Self-Delete Chain via Loopback Ping and File Deletion (via process_creation)

This rule detects a self-deletion chain that pings the 127.0.0.7 loopback address as a timing delay before force-deleting a file, a cleanup routine used by the 01flip ransomware to remove its own binary after execution. Chaining ping to loopback with del /f /q lets the malware wait for its parent to exit and then erase traces.

Suspicious Anti-Recovery Zeroing via fsutil setZeroData (via process_creation)

This rule detects use of fsutil setZeroData, which overwrites file regions with zeros to prevent forensic recovery, a self-delete and anti-recovery step in the 01flip Rust ransomware Windows chain. The technique destroys the original binary and data remnants after encryption to inhibit recovery and analysis.

Malicious Shai-Hulud npm Worm Marker via SHA1HULUD Process Name (via process_creation)

This rule detects a process launched with the SHA1HULUD marker on its command line, the self-identifying tag used by the Shai-Hulud npm supply-chain worm. The worm spawns processes named SHA1HULUD during propagation and token theft, so this constant is a high-confidence indicator of compromise on developer and CI hosts.

Malicious WSUS Service Spawning Command Shell via CVE-2025-59287 (via process_creation)

This rule detects the WSUS service or its worker process spawning a command interpreter, the immediate post-exploitation behavior of CVE-2025-59287 remote code execution. WSUS components should never launch cmd or PowerShell, so this chain marks active exploitation. Detecting it exposes attacker command execution on a patch-management server used as an entry point.

Suspicious Chrome Launch With Remote Debugging via Airstalk (via process_creation)

This rule detects a Chromium-based browser started with the remote debugging port flag, a technique the Airstalk malware uses to hijack browser sessions and steal cookies and tokens. Enabling the debugging protocol lets the malware drive the browser and read authenticated state. Detecting this launch surfaces credential and session theft in a suspected supply chain intrusion.

Suspicious PowerShell Spawned by WScript via PhantomVAI Loader (via process_creation)

This rule detects PowerShell executed as a child of WScript, an early link in the PhantomVAI loader chain that proceeds through msedge and MSBuild to injection. Script-host to PowerShell transitions are a common malware execution handoff. Detecting this chain catches the loader before the final infostealer injection stage.

Suspicious MSBuild Execution Spawned by PowerShell via PhantomVAI Loader (via process_creation)

This rule detects MSBuild launched as a child of PowerShell, the final stage of the PhantomVAI loader chain that injects infostealer code into the trusted Microsoft build utility. MSBuild is abused as a signed process host to evade defenses. Detecting this parent-child relationship exposes process injection delivering commodity infostealers.

Suspicious Base64 Bash Execution via nohup on macOS via ClickFix (via process_creation)

This rule detects a detached bash process decoding a Base64 payload via nohup on macOS, matching the Odyssey stealer delivery produced by the IUAM ClickFix Generator for Apple systems. The lure instructs victims to paste a terminal command that background-executes an obfuscated downloader. Detecting this pattern surfaces cross-platform ClickFix infections targeting macOS users.

Suspicious ClickFix cv.bat Staging in Temp via PowerShell (via process_creation)

This rule detects PowerShell referencing the cv.bat helper script staged in a temporary directory, an intermediate step in the ClickFix delivery chain that subsequently retrieves an MSI-packaged DeerStealer payload. The batch file bridges the initial pasted command and the final installer. Detecting this staging step interrupts the infostealer infection before installation completes.

Suspicious PowerShell Download Spawned From Explorer via ClickFix (via process_creation)

This rule detects PowerShell launched directly by Explorer with download cmdlets, matching the ClickFix social engineering technique where a victim pastes a malicious command into the Windows Run dialog. The IUAM ClickFix Generator produces lures that trick users into self-executing payload downloaders. Detecting this pattern catches the delivery of DeerStealer and similar infostealers at execution.

Suspicious Phantom Taurus mssq.bat SQL Execution via WMI (via process_creation)

This rule detects execution of the mssq.bat script used by Phantom Taurus to run SQL queries against databases via the privileged sa account, invoked through WMI. The batch file automates data collection and command execution against Microsoft SQL Server. Detecting this named script exposes hands-on-keyboard database targeting by the actor.

Suspicious GeoServer Java Process Spawning Download Utility

This rule detects a Java or shell process spawning wget or curl to fetch a payload from a port 8080 host. Attackers exploiting the GeoServer JXPath remote code execution flaw use Runtime.exec to pull stager scripts over HTTP. A web application process downloading from an atypical port indicates exploitation and payload retrieval.

Suspicious Script Host Downloader via MSXML and WScript Shell

This rule detects the Windows script host executing a WSF or JS downloader that then spawns PowerShell. The DarkCloud delivery uses MSXML2.XMLHTTP and WScript.Shell inside a script file to fetch a PowerShell stage from remote infrastructure. Script host to PowerShell chaining is a common malware download and execute pattern.