Sigma detection rules, expert-reviewed

Suspicious Shell Spawned by Gogs Git Server on Linux

This rule detects the Gogs Git service process spawning a command shell which indicates exploitation of the CVE-2025-8110 remote code execution used in the wild to deploy Supershell reverse-SSH C2 payloads. A Git hosting service launching an interactive shell is not expected behavior and signals active post-exploitation.

Malicious DLL Sideloading via SmadavProtect and SolidPDFCreator by Stately Taurus

This rule detects legitimate signed executables SmadavProtect32.exe and SolidPDFCreator.exe loading the malicious sideloaded DLLs Smadhook32c.dll and SolidPDFCreator.dll used by Stately Taurus to run the errordetails payload described by Unit 42. DLL search-order hijacking of trusted binaries lets the actor execute espionage code under a benign process which evades signature-based defenses.

Suspicious Kernel Mode Service Creation via SC

This rule detects creation of a kernel-mode service using sc with a kernel type flag, the mechanism used to load a driver during the ReadText34 ransomware incident as part of a bring-your-own-vulnerable-driver attack. Registering a kernel service outside of software installation is anomalous. Attackers exploit this to load vulnerable drivers that disable endpoint protection.

Suspicious Execution of PIF File as AutoIt Loader

This rule detects execution of a process image with the .pif extension, an abuse observed in a Lumma infostealer campaign where a renamed AutoIt3 interpreter named Riding.pif performed process hollowing to inject the stealer. It captures the use of an uncommon executable extension to disguise a script interpreter. Detecting this is important because .pif files launching as active processes are almost never legitimate on modern systems and frequently indicate masqueraded loader activity.

Suspicious PowerShell Download of updserc Archive to AppData via ClickFix

This rule detects PowerShell downloading an archive named updserc.zip into the local AppData directory. This activity is part of a ClickFix phishing chain abusing Booking.com themed lures to stage the PureRAT loader. Pulling a named archive into AppData through PowerShell is an early loader step that precedes DLL side-loading and in-memory execution.

Suspicious High-Privilege Microsoft Graph Application Role Grant via Azure Audit (via azure)

This rule detects the assignment of high-privilege Microsoft Graph application roles such as AppRoleAssignment.ReadWrite.All, Directory.ReadWrite.All, or RoleManagement.ReadWrite.Directory to a service principal, an escalation path into Azure highlighted by Red Canary. Granting these permissions lets an app rewrite directory roles and grant itself further access, making it a powerful and stealthy persistence mechanism that should be tightly controlled.

ClickFix Paste-Jacking Command Written to RunMRU History (via registry_set)

This rule detects download or script-execution commands recorded in the Explorer RunMRU history, the forensic residue left when a user pastes a clipboard-injected command into the Run dialog during a paste-jacking or ClickFix attack. Adversaries rely on this manual execution path to bypass download controls, making mshta or PowerShell cradle strings in RunMRU a useful post-execution indicator.

Suspicious Hello-World Scraper Botnet User-Agent in Web Requests

This rule detects inbound web requests carrying the User-Agent string Hello-World/1.0, a hardcoded identifier used by a scraper botnet concentrated in Taiwan that issues evenly distributed GET floods across ports 80 through 85. Surfacing this fingerprint reveals automated reconnaissance and scraping activity that often precedes targeted follow-on abuse.

Malicious Data Exfiltration to Restic REST Server over HTTP (via process_creation)

This rule detects the restic backup utility being pointed at a remote REST endpoint over HTTP to back up file-share directories, the exfiltration channel used in the Nitrogen BlackCat intrusion to stage stolen data before ransomware. Adversaries repurpose restic as a fast deduplicating uploader to attacker-controlled REST servers, so restic writing to a rest http repository is a strong pre-encryption data-theft signal.

Suspicious Vulnerable Driver googleapiutil64.sys Loaded for BYOVD

This rule detects loading of a driver named googleapiutil64.sys, a renamed vulnerable Baidu antivirus driver deployed by Warlock ransomware operators to disable security tooling via Bring Your Own Vulnerable Driver. The filename masquerades as a legitimate Google component.

Obfuscated Encoded PowerShell Payload Deployed via Service (via security)

This rule detects deployed a service pointing to a hidden and encoded PowerShell payload. Some parameters are commented in case you would like to reduce false positives or make the rule more precise.

Malicious Axios NPM RAT Renamed PowerShell Execution via wt.exe

This rule detects a PowerShell binary copied to wt.exe under ProgramData and executed with a hidden window and execution policy bypass, matching the Axios NPM supply chain incident where a post-install hook drops a RAT. Renaming powershell.exe to wt.exe masquerades the interpreter as Windows Terminal to evade name-based detection. Execution of a masqueraded interpreter from ProgramData with bypass flags is a strong compromise indicator.

Suspicious Fileless PowerShell Execution via Invoke-RestMethod Piped to IEX (via process_creation)

This rule detects PowerShell fetching remote content with Invoke-RestMethod and piping it straight into Invoke-Expression, the fileless delivery used by the SEO poisoning campaign impersonating Gemini and Claude Code installers. This pattern executes attacker-hosted script without touching disk. Some tooling uses irm iex legitimately, so review the target domain.

Microsoft Defender SpyNet Reporting Disabled via Registry

This rule detects the Microsoft Defender SpyNetReporting registry value being set to 0, disabling cloud-delivered protection telemetry so malware runs with reduced detection. Huntress observed BlackCat affiliates degrading Defender before payload deployment. Turning off SpyNet reporting is a deliberate defense-evasion action rarely performed by legitimate administration.

Suspicious New Rights Granted to an Account for Privilege Escalation (via security)

This rule detects grants new rights to an account in order to escalate privileges.