Sigma detection rules, expert-reviewed

Suspicious Service Creation Named RDP-Controller via sc.exe (via process_creation)

This rule detects creation of a Windows service named RDP-Controller with a custom binary path via sc.exe. The RATatouille intrusion installs this service to gain persistence and enable remote desktop control through its main.exe payload. A service using this masquerading name with an arbitrary binPath indicates malicious persistence.

Suspicious mshta Execution Spawned by Scheduled Task Service Host (via process_creation)

This rule detects mshta.exe being launched as a child of the Schedule service host process. In the Double-Tap campaign the HATVIBE loader is executed through a scheduled task so svchost hosting the Schedule service spawns mshta.exe. A scheduled task launching the mshta living-off-the-land binary is unusual and points to malicious HTA execution.

Suspicious Scheduled Task Creation Launching mshta via schtasks (via process_creation)

This rule detects creation of a scheduled task named ServiceDispatch that repeatedly launches mshta.exe. The Double-Tap campaign attributed to APT28 uses this persistence mechanism to run the HATVIBE HTA loader every few minutes. Combining a masquerading task name with the mshta living-off-the-land binary indicates malicious persistence rather than benign scheduling.

Malicious Volume Shadow Copy Deletion via wmic and vssadmin (via process_creation)

This rule detects deletion of volume shadow copies through wmic shadowcopy delete and vssadmin Delete Shadows commands. This behavior is used by the Helldown ransomware to inhibit system recovery prior to encrypting files. Removing shadow copies prevents victims from restoring their data which maximizes the impact of the intrusion.

Suspicious GobRAT Bulbature Infection Shell Scripts Execution

This rule detects execution of the distinctive bash infection and management scripts used by the Bulbature operation behind GobRAT, including zonesetup.sh, zoneController.sh, zoneupdate.sh, hold_by_bot.sh, sshdeny1.sh, zonedelete.sh and zoneRestart.sh. These uniquely named scripts orchestrate persistence, SSH access control and bot management on hijacked routers. Their filenames are specific enough to serve as reliable indicators.

Suspicious Process Masquerading as apached via GobRAT Bulbature Implant

This rule detects a running process named apached, the disguised name GobRAT uses to blend in with the legitimate Apache httpd daemon on compromised edge devices in the Bulbature operation. The extra character in the name is designed to survive casual process listing review. Because no standard Apache binary is named apached, this is a strong host indicator of GobRAT.

Suspicious lwp-download Retrieval of Remote File Masquerading as Image via 8220 Gang

This rule detects the Perl based lwp-download utility fetching a remote resource and saving it with a .gif image extension, a technique the 8220 gang uses in the Hadooken and K4Spreader campaigns to disguise downloaded shell scripts and payloads. Legitimate administrators rarely invoke lwp-download to write image files from the web. This pattern signals staging of second stage tooling on compromised Linux hosts.

Malicious MuddyRot Implant Execution From ProgramData SoftwareMemory Path

This rule detects execution of a binary from the ProgramData softwarememory documentsmanagerreporter.exe location, the fixed install path and filename used by the MuddyWater MuddyRot implant. The actor drops the payload here and registers persistence to maintain access. The hardcoded path and masqueraded name make this a high confidence indicator of MuddyRot infection.

Malicious System Recovery Inhibition via bcdedit and vssadmin in Mallox

This rule detects Mallox disabling recovery by editing boot configuration with bcdedit and deleting volume shadow copies with vssadmin. Turning off recovery and wiping shadows prevents restoration of encrypted files, a hallmark pre-encryption step of the Mallox ransomware.

Malicious MS-SQL Server Spawning Command Shell via Mallox

This rule detects the MS-SQL service process sqlservr.exe spawning cmd.exe or PowerShell. Mallox affiliates abuse xp_cmdshell and OLE automation after compromising weak SQL Server instances, so a shell child of the database engine strongly indicates SQL exploitation.

Suspicious PlugX Self-Cleanup Batch Execution

This rule detects execution of the del_AsvastSvcpCP.bat cleanup script used by the PlugX worm to remove its staging artifacts. Running this uniquely named batch indicates PlugX is tidying up its footprint after installation or removal.

Malicious PlugX DLL Sideloading via CEFHelper from RECYCLER.BIN

This rule detects the PlugX loader CEFHelper.exe running from a hidden RECYCLER.BIN directory on a USB or local volume. The worm sideloads its payload DLL through this renamed helper stored in a fake recycle bin folder to evade inspection.

Suspicious Proxyware Installation via accept-tos Flag on Linux

This rule detects a Linux binary being executed with the -accept-tos flag used by residential proxyware agents to silently accept terms and enroll the host. Attackers monetise compromised hosts by installing proxyware, and this non-interactive acceptance flag is characteristic of that abuse.

Suspicious Firewall Flush via iptables in Kinsing Intrusion

This rule detects iptables being run with the flush flag to clear all firewall rules. Kinsing flushes iptables to remove competing miner blocks and to keep its own C2 and mining traffic unimpeded, an impair-defenses action that can also occur during legitimate administration.

Malicious ActiveMQ CVE-2023-46604 Payload Download via curl or wget

This rule detects curl or wget fetching the Kinsing exploitation Spring context files poc.xml or linux-poc.xml. During ActiveMQ CVE-2023-46604 exploitation the broker is coerced into loading a remote XML that pulls the next stage, so these filenames in a download command indicate active exploitation.