Sigma detection rules, expert-reviewed

Suspicious Service DLL Registration via regsvr32 Silent

This rule detects regsvr32.exe silently registering a DLL as part of the RONINGLOADER service installation chain that loads goldendays.dll. Adversaries use the silent flag to register malicious DLLs without user-visible prompts while establishing service-based persistence.

Suspicious COLDRIVER Logon Script Persistence via UserInitMprLogonScript (via process_creation)

This rule detects a reg add command creating the UserInitMprLogonScript value under HKCU Environment to run a hidden PowerShell stager at logon as performed by the COLDRIVER SIMPLEFIX chain. This logon script value is a well known but rarely legitimate persistence location.

Uncommon Print Spooler Exploitation Spawning a Child Process (via process_creation)

This rule detects the print spooler service (spoolsv.exe) spawning a command shell, script interpreter or a process from a user-writable path, behavior consistent with PrintNightmare-style spooler exploitation for code execution or privilege escalation. Print spooler abuse is a privilege-escalation technique noted in the Red Canary Threat Detection Report. Detecting anomalous spooler children surfaces exploitation of the service.

Suspicious macOS Hardware Fingerprinting via ioreg IOPlatformUUID (via process_creation)

This rule detects use of ioreg to read the IOPlatformExpertDevice and IOPlatformUUID hardware identifiers, a host-fingerprinting step performed by the FlutterShell backdoor. The unique UUID is used to track infected macOS hosts and tailor follow-on backdoor commands.

Suspicious SharePoint ToolPane Endpoint Request via ToolShell (via webserver)

This rule detects HTTP requests to the SharePoint ToolPane.aspx endpoint carrying the DisplayMode Edit parameter, the exploitation vector for ToolShell (CVE-2025-53770). Attackers send crafted requests to this endpoint to bypass authentication and achieve remote code execution. Requests to this endpoint with an edit display mode are a strong indicator of exploitation attempts.

Suspicious SystemSettings DLL Sideload from Non-System Path via image_load

This rule detects SystemSettings.exe loading a SystemSettings.dll from a path outside the System32 directory, the DLL sideloading technique used to launch SharkLoader in the StrikeShark campaign. The genuine binary only loads its companion DLL from System32. A matching name loaded from elsewhere indicates a sideloading proxy execution.

Malicious Zhong Stealer Loader and Log Artifacts

This rule detects creation of TASLoginBase.dll or TASLogin.log, host artifacts written by the Zhong Stealer during execution and inventory logging. These filenames are unique to the Zhong Stealer toolkit targeting fintech support channels.

Suspicious PowerShell Download to AppData Intel Path

This rule detects PowerShell using DownloadFile to stage a payload into an AppData Intel directory as seen in the Foxit PDF exploitation chain. The attacker hides downloaded miner and RAT payloads under an Intel named folder in the user profile. Detecting the download cradle exposes remote payload retrieval.

Suspicious Domain Trust Discovery via Nltest

This rule detects the nltest utility enumerating domain trusts, a reconnaissance step performed after GoldMelody gained code execution through ASP.NET ViewState deserialization. Adversaries map domain trust relationships to plan lateral movement. While administrators occasionally use nltest, its execution from web-facing hosts is suspicious.

Suspicious Telegram Bot API C2 Beaconing (via network)

This rule detects outbound HTTP requests to the Telegram bot API using sendPhoto and sendDocument methods which the CoralRaider actor abuses for command and control and exfiltration of stolen social media data. Abusing a legitimate messaging platform lets attackers hide C2 inside allowed web traffic and defeat domain reputation controls.

Suspicious Executable Launched from Domain Netlogon Share (via process_creation)

This rule detects execution of a binary located under a domain controller Netlogon share, a propagation method where RansomHub places scheduled tasks and payloads in the Netlogon folder to run on member logon per Group-IB. Adversaries abuse Group Policy and the Netlogon share to spread ransomware across domain hosts, so process execution from this path warrants investigation.

Suspicious Node Payload Drop in Local Share Directory (via file_event)

This rule detects creation of a sync.js payload under a hidden NodeJS local-share directory. The M-Red-Team AsyncAPI supply-chain compromise dropped this file after a GitHub Actions pwn-request to stage its second stage. A JavaScript payload written to this unusual location is a strong indicator of implant staging.

Suspicious Payload Drop to Public User Directory by Gladinet Exploit

This rule detects the files d3d11.dll or Centre.exe being written under the Public user directory, a payload staging behavior observed by Huntress following CVE-2025-30406 exploitation of Gladinet CentreStack. Attackers drop a DLL sideloading component and secondary executable into a world-writable directory to establish execution and persistence. Placement of these named binaries in the Public directory is anomalous and indicates post-exploitation staging.

Malicious Equation Editor Child Process Execution via process_creation

This rule detects the Microsoft Equation Editor EQNEDT32.EXE spawning any child process which almost always indicates exploitation of the CVE-2017-11882 memory corruption vulnerability. SideWinder delivered RTF documents that exploited Equation Editor to launch mshta.exe and fetch a remote HTA payload against maritime and nuclear targets. Equation Editor never legitimately creates child processes so this is a high confidence exploitation signal.

Suspicious awk Character Generation Piped to Shell on VMware ESXi (via process_creation)

This rule detects awk being used to assemble command strings from numeric character codes on VMware ESXi. Actors abuse awk BEGIN blocks with printf and percent-c formatting to build obfuscated commands that are then piped into a shell. This construct rarely appears in legitimate ESXi administration.