Sigma detection rules, expert-reviewed

Suspicious Control Panel File Execution via control.exe with CPL Argument

This rule detects control.exe launching a Control Panel file, a proxy-execution technique observed in a martial-law-themed APT campaign where a disguised hwp.cpl was executed through control.exe to trigger CPlApplet and side-load a malicious DLL. It captures the abuse of the Control Panel host to run attacker code. Detecting this is important because control.exe invoking .cpl payloads outside settings interfaces is a recognized malware execution and DLL side-loading vector.

Suspicious Side-Loaded DLL Loaded by SSH Agent for Lazarus ServiceChanger

This rule detects the ssh-agent binary loading a libcrypto.dll from a non-standard path, a side-loading chain abused by the Lazarus ServiceChanger tool. The attackers convert ssh-agent into a persistent service and hijack its DLL dependency to run malicious code. A libcrypto.dll loaded by ssh-agent outside trusted install paths indicates side-loading.

Malicious Modification of a Fake Domain Controller SPN (DCshadow) - Directory Services (via security)

This rule detects update the Service Principal Name (SPN) of a computer account in order to perform "Kerberos redirection" and escalate privileges.

Suspicious Svchost Spawned by Non-Services Parent (via process_creation)

This rule detects svchost.exe launched by a parent other than the Windows Service Control Manager services.exe. Legitimate svchost instances are started by services.exe so any other parent suggests masquerading or code injected into a fake svchost. An anomalous svchost ancestry is a well-known indicator of process masquerading and injection.

Malicious Process Memory Injection via dd Write to /proc/pid/mem by UNC3886 (via process_creation)

This rule detects the dd utility writing to a process memory file under /proc, the injection primitive UNC3886 used to load TINYSHELL backdoors into legitimate processes on Junos OS routers. Direct writes to another process memory are a strong indicator of code injection and defense evasion.

Suspicious Shai-Hulud 2.0 Harvested Secret Dump File Creation

This rule detects creation of the secret dump files written by the Shai-Hulud 2.0 supply chain worm after it scans the host for cloud credentials and TruffleHog secrets during package install. These fixed filenames hold harvested AWS Azure and GCP credentials staged for exfiltration to attacker-controlled GitHub repositories.

Suspicious AutoIt Script Execution from User Writable Path via DarkGate (via process_creation)

This rule detects the AutoIt3 interpreter running a script from a user writable location such as AppData, Temp or ProgramData, matching DarkGate loader behavior that executes multiple AutoIt scripts staged after a JavaScript or LNK dropper. Some legitimate installers bundle AutoIt so parentage and path should be reviewed.

Malicious Chrome Relaunch Hijack by FlutterShell Backdoor on macOS (via process_creation)

This rule detects Google Chrome being relaunched with restore-session arguments pointing at the sinterfumesco.com domain, a browser-hijack step of the FlutterShell backdoor from Operation FlutterBridge. The malware kills and restarts Chrome to redirect the victim to attacker-controlled search infrastructure.

Suspicious Data Exfiltration to Elasticsearch Bulk API via ps_script

This rule detects PowerShell script content that posts data to an Elasticsearch bulk ingest endpoint targeting a systeminfo index. A threat actor abused an Elastic Cloud SIEM trial as exfiltration infrastructure by shipping collected host data to an attacker-controlled cluster via the _bulk API, so this pattern indicates outbound staging of stolen system information to a cloud index.

Suspicious Data Transfer via curl to Raw IP Address

This rule detects curl uploading or downloading files, the transfer mechanism this threat actor used to move a collection archive and tooling to and from attacker infrastructure. While curl has legitimate uses, its upload and download flags in interactive contexts frequently indicate ingress tool transfer or data exfiltration.

Malicious Interactive Reverse Shell on Linux (via process_creation)

This rule detects Linux command lines that establish an interactive reverse shell, including bash redirection to /dev/tcp, netcat with command execution, or a named-pipe backpipe. Reverse shells are a common execution and command-and-control behavior across the Linux intrusions summarized in the Red Canary Threat Detection Report. Detecting these constructs surfaces hands-on-keyboard access to the host.

Suspicious Lancefly TdiProxy Driver Loaded

This rule detects loading of a kernel driver named TdiProxy.sys, installed as a service by Lancefly to intercept network traffic and support its Merdoor backdoor. This driver name is not associated with legitimate software.

Suspicious Foxit PDF Reader Spawning Command Interpreter

This rule detects Foxit PDF Reader spawning a command interpreter, the exploitation behavior triggered by a crafted PDF using OpenAction and Launch. Foxit should not normally launch cmd or PowerShell so this parent child pair signals abuse of the flawed design. Detecting it catches the initial code execution from the malicious document.

Malicious Safe Mode Boot Configuration via bcdedit for Defense Evasion via Process Creation

This rule detects bcdedit.exe forcing a minimal safe-mode boot, a technique the Embargo ransomware uses to restart the host into an environment where most security products do not run before encrypting files. Legitimate administrative use of this exact command is rare on endpoints. This indicates preparation for defense evasion and ransomware detonation.

Malicious LOLBin Download Saved as Windows Utility ping.exe via certutil or curl

This rule detects use of certutil or curl to download a remote file and save it under the name of a legitimate Windows utility such as ping.exe. The Mysterious Elephant APT used this masquerading technique to stage payloads disguised as trusted system binaries. Writing downloaded content to a well-known utility name in a non-System32 location is a strong indicator of ingress tool transfer combined with defense evasion.