Sigma detection rules, expert-reviewed

Suspicious Masquerading Python Interpreter csshost Executing Script

This rule detects a renamed Python interpreter named csshost.exe executing a Python script, a masquerading technique used by PyLangGhost RAT to hide its stealer logic behind a system-looking process name. The legitimate Python binary is copied and renamed to blend in.

Suspicious Hidden PowerShell Executing Substring of Dropped File

This rule detects a hidden PowerShell process that reads a dropped file with Get-Content, extracts a substring, and invokes it as code, matching the AZORult fileless loader stage. Reading an oddly named data file and executing a slice of it is characteristic of obfuscated PowerShell stagers.

Malicious PureMiner Persistence Executable in AppData HResult Folder

This rule detects execution of TypeId.exe from an AppData Roaming HResult directory, the persistence location used by PureMiner to launch its XMRig-based cryptominer at startup. This path and filename combination is specific to the Pure malware family.

Suspicious Outbound Connection From CasPol Binary

This rule detects the .NET CasPol.exe binary establishing outbound network connections, behavior consistent with the XWorm LATAM campaign hollowing CasPol to beacon to its C2. CasPol has no legitimate need for network communication.

Suspicious shfolder.dll Sideloading via VMware net-service Binary

This rule detects the VMware net-service.exe binary loading shfolder.dll from outside the System directory, the DLL search-order hijack abused by Gh0stBins RAT to run its loader. Legitimate shfolder.dll is loaded from System32, so a load from the application folder indicates sideloading.

Malicious Interlock Credential Stealer Output File

This rule detects creation of chrgetpdsi.txt, the file used by the Interlock ransomware credential stealer to store harvested browser credentials. This filename is a unique host-based indicator of Interlock stealer activity.

Suspicious WDigest UseLogonCredential Enablement for Plaintext Credential Theft (via registry_set)

This rule detects setting the WDigest UseLogonCredential value which forces Windows to cache plaintext credentials in memory as observed in the SoftEther VPN intrusion. Enabling this value is a credential access preparation step ahead of memory dumping.

Suspicious PebbleDash C2 Configuration Stored Under WMI Security Key (via registry_set)

This rule detects writes to the HKLM SYSTEM CurrentControlSet Control WMI Security value with the GUID used by the Kimsuky PebbleDash backdoor to store its encrypted command and control address. This registry location is not normally written by user applications.

Malicious Invoke-WMIExec Lateral Movement Download and Execute (via ps_script)

This rule detects a PowerShell one liner that downloads Invoke-WMIExec via a web client and executes it against a remote target using a pass the hash argument as observed in the MeshAgent and SuperShell intrusion. This chains in memory script download with WMI based lateral movement.

Malicious Xctdoor XcLoader Execution via Regsvr32 AppX Path Abuse (via process_creation)

This rule detects regsvr32.exe loading a DLL named settings.lock from the Microsoft MicrosoftOffice365Hub AppX package settings directory. This loader technique is used by the Xctdoor and XcLoader backdoors to execute encrypted payloads from a user AppX path where legitimate COM registration is not expected.

Malicious Potato Family Privilege Escalation Tool Execution (via process_creation)

This rule detects execution of Potato family token impersonation tools including JuicyPotatoNG, RasManPotato, SigmaPotato, BadPotato, and RustPotato used for local privilege escalation in the MS-SQL intrusion. These utilities abuse SeImpersonate privileges to elevate to SYSTEM.

Malicious Certutil Decode of Encoded Web Shell to ASPX (via process_creation)

This rule detects certutil.exe decoding a text file into an ASPX web shell within a web server images directory as seen in the targeted MS-SQL server intrusion. Certutil decoding output directly into a web accessible aspx file is a common web shell deployment technique.

Suspicious Linux CoinMiner Watchdog Staging in Shared Memory (via process_creation)

This rule detects a watchdog command that downloads the miner into a hidden .Sys_cache_backup file under dev shm using curl with a wget fallback as observed in the Linux SSH CoinMiner campaign. Fetching an executable into shared memory to survive removal is a hallmark of this miner.

Suspicious Linux Payload Download From Xrpl City Miner Host (via process_creation)

This rule detects wget or curl retrieving payloads from the download.xrpl.city host used to distribute the Linux SSH CoinMiner and its propagation modules. This host serves disguised archive and binary files during the infection chain.

Malicious Ladon PowerShell Attack Framework Import (via process_creation)

This rule detects PowerShell importing the Ladon attack framework module and invoking its modules such as SweetPotato, Runas, or MssqlCmd as observed in the MeshAgent and SuperShell intrusion. Ladon provides scanning, privilege escalation, and lateral movement capabilities.