Sigma detection rules, expert-reviewed

Suspicious Code Execution via InstallUtil LOLBIN (via process_creation)

This rule detects InstallUtil.exe run with uninstall or log-suppression flags used to trigger attacker code in a .NET assembly's Uninstall method while avoiding console output, a signed-binary proxy technique. InstallUtil abuse is a defense-evasion technique tracked in the Red Canary Threat Detection Report. Detecting these command lines surfaces code execution under a trusted Microsoft utility.

Malicious Command Injection via SyncAppvPublishingServer VBS LOLBin (via process_creation)

This rule detects abuse of the SyncAppvPublishingServer.vbs living-off-the-land script to inject PowerShell after a semicolon separator, the ClickFix delivery behavior ClearFake uses to launch a hidden PowerShell downloader from a clipboard-pasted Run command. Adversaries proxy execution through this signed script to evade script-host controls, making early detection critical for catching the infection at the first execution stage.

Malicious regsvcs LOLBin Loading Ransomware DLL from UNC Path

This rule detects the regsvcs.exe living-off-the-land binary being used to load and install a DLL from a UNC network path, matching SafePay ransomware deployment via regsvcs proxy execution. Attackers abuse regsvcs to run their encryptor DLL while bypassing application controls. Loading a DLL over UNC through regsvcs is not a legitimate developer workflow.

Suspicious Payload Retrieval from Cloudflare Tunnel via LOLBin (via process_creation)

This rule detects Windows script and download utilities referencing a trycloudflare.com tunnel hostname on their command line, an infrastructure pattern used by PythonRatLoader to stage batch, WebDAV and Python payloads. Cloudflare quick tunnels are occasionally used by developers so context should be reviewed.

Suspicious TALONITE Certutil LOLBIN Decode and Download Abuse (via process_creation)

This rule detects certutil.exe invoked with decode, URL cache, or verifyctl arguments used to deobfuscate or download payloads. TALONITE abuses certutil as a living-off-the-land binary to decode staged content and retrieve additional tooling during intrusions. Certutil used for file decoding or remote fetch outside certificate management is a common defense-evasion and delivery technique.

Suspicious sLoad Payload Download via BITSAdmin LOLBin Transfer (via process_creation)

This rule detects bitsadmin.exe transferring a file from a remote HTTP location, the living-off-the-land download technique used by the sLoad downloader to stage banking-malware payloads in the drIBAN fraud operation. Adversaries abuse the Background Intelligent Transfer Service through bitsadmin to retrieve second-stage code under a trusted Windows utility while evading download controls, making early detection critical for catching delivery before Ramnit is deployed.

Suspicious Data Exfiltration via Finger LOLBIN

This rule detects execution of finger.exe, a rarely used legacy binary abused as a living-off-the-land channel for data exfiltration and remote content retrieval. It was catalogued among data-exfiltration LOLBIN binaries. Any finger.exe execution in modern environments is anomalous and warrants review.

Suspicious Download LOLBIN Spawned by ScreenConnect Client

This rule detects the ScreenConnect client service spawning download utilities such as bitsadmin or PowerShell which is the payload retrieval chain that dropped KrustyLoader after a ScreenConnect exploit as described by WithSecure. Remote monitoring tools launching download LOLBINs shortly after exploitation frequently indicates ingress tool transfer of a second stage.

Suspicious PowerShell Spawning .NET LOLBIN (via process_creation)

This rule detects PowerShell spawning uncommon .NET framework utilities used as living-off-the-land execution proxies. The Veil#Drop loader cascaded through these binaries as fallback execution paths for its payload.

Malicious more_eggs LOLBIN Scriptlet Execution via ie4uinit BaseSettings Abuse (via process_creation)

This rule detects the ie4uinit LOLBIN being run with the -basesettings flag from a user-writable location such as AppData, the first-stage technique in the more_eggs TA4557 resume-lure intrusion where a copied ie4uinit loaded a malicious SCT through a planted ieuinit.inf. Adversaries relocate this signed binary to abuse its inf-driven command execution while evading path-based controls, so an out-of-System32 ie4uinit with -basesettings indicates staged code execution.

Malicious DLL Sideloading via LOLBins from ProgramData by Dohdoor

This rule detects trusted Windows utilities loading propsys or batmeter DLLs from ProgramData or the Public directory. The Dohdoor campaign sideloads its payload through living-off-the-land binaries such as OpenWith and mblctr running from unusual paths. A signed utility loading a system-named DLL from a writable directory is a strong sideloading indicator.

Suspicious MSBuild LOLBin Spawning Script Interpreter (via process_creation)

This rule detects MSBuild.exe spawning PowerShell or cmd child processes which indicates inline task code execution abused as a signed binary proxy. Legitimate build automation rarely has MSBuild directly launching interactive script interpreters.

Malicious LOLBin Download Saved as Windows Utility ping.exe via certutil or curl

This rule detects use of certutil or curl to download a remote file and save it under the name of a legitimate Windows utility such as ping.exe. The Mysterious Elephant APT used this masquerading technique to stage payloads disguised as trusted system binaries. Writing downloaded content to a well-known utility name in a non-System32 location is a strong indicator of ingress tool transfer combined with defense evasion.

Malicious LOLBin Spawned by Outlook via MonikerLink CVE-2024-21413

This rule detects Microsoft Outlook spawning script interpreters or living off the land binaries such as mshta which is a hallmark of the MonikerLink CVE-2024-21413 exploitation chain. Successful exploitation lets an attacker bypass the Protected View warning and achieve code execution from a crafted email which makes any such child process highly suspicious.

Windows: Detect baaupdate.exe Spawning Scripting, Admin, or LOLBin Child Processes

Alerts when baaupdate.exe runs typical script/utility processes, an uncommon parent-child execution pattern on Windows.