Sigma detection rules, expert-reviewed

In-Memory Security Package (SSP) Added - Reg via Command (via process_creation)

This rule detects adds a reference in the registry to a malicious SSP (Security Support Provider). Note that this rule will not work with "in memory" SSP injection (Mimikatz).

Suspicious Windows Subsystem for Linux (WSL) Package Turned on - Native (via setup)

This rule detects enables the WSL to cary out malicious activities in a virtual instance to avoid detection.

Suspicious msiexec Remote Package Installation over HTTP

This rule detects msiexec.exe installing a package directly from an http or https URL in quiet mode, a NetSupport RAT delivery vector in the ClickFix campaign. The loaders invoked msiexec with a remote URL and the /qn switch to silently install the RAT from attacker infrastructure. Remote quiet MSI installation is a LOLBin abuse pattern used to bypass download controls.

Malicious PyPI Package Installation from Gleaming Pisces Supply Chain (via process_creation)

This rule detects installation of the malicious PyPI packages real-ids, coloredtxt, beautifultext, or minisound published by Gleaming Pisces to deliver the PondRAT backdoor. Installing these poisoned packages compromises developer and build systems through the software supply chain.

Suspicious Msiexec Remote Package Installation from URL via Process Creation

This rule detects msiexec.exe installing an MSI package directly from a remote HTTP or HTTPS URL, a technique used in the Operation Rusty Flag campaign to deploy a Rust implant from a Dropbox-hosted MSI reached through a double-extension LNK. Adversaries abuse the trusted Windows Installer to proxy execution and pull payloads while evading application controls.

Suspicious Network Download Spawned by Node.js During Package Install

This rule detects the Node.js process spawning a download utility or command interpreter during an npm package install which the Stressed Pungsan campaign abuses through a malicious preinstall hook to fetch a second stage payload onto developer machines.

Malicious Mimikatz Malicious Security Package (SSP) Exfiltrates Cleartext Passwords in File (via file_event)

This rule detects loaded the Mimikatz SSP "mimilib.dll" into the LSA process in order to exfiltrate clear text passwords into a file.

Suspicious TruffleHog Secret Scanner Spawned by Node Package Manager on Linux

This rule detects the TruffleHog secret scanning tool being launched as a child of a node or npm process which the Shai-Hulud npm worm abuses during package install to locate GitHub npm and cloud credentials on the victim host. Running a credential scanner from within a package install lifecycle is anomalous and indicates automated secret theft rather than a developer audit.

Suspicious Python Site Hook or PTH File Written to Site-Packages via File Event

This rule detects the creation of Python site-initialization hooks sitecustomize.py and usercustomize.py or a .pth file inside site-packages, the persistence mechanism used by the malicious Python packages reported by Cisco Talos. These files execute automatically every time the interpreter starts, giving attackers durable code execution. Detecting writes of these hooks reveals stealthy persistence planted through the packaging ecosystem.

macOS: Detect Axios malicious npm execution chain using osascript, curl download, and cleanup

Flags macOS command-line patterns showing osascript execution plus npm package download and staged file cleanup.

Linux Process Creation Indicators for LiteLLM Backdoored Package Activity (v1.82.7/v1.82.8)

Identifies Linux process executions matching indicators tied to backdoored LiteLLM v1.82.7/v1.82.8 credential-stealer and persistence activity.

Windows Process Creation: npm install for Shai-Hulud 2.0 Malicious Package Names and Versions

Alert on Windows node.exe running npm install with command-line package/version strings known from the Shai-Hulud 2.0 npm campaign.

Linux Process Creation: Installation of Known Malicious NPM Packages (Shai-Hulud 2.0)

Alerts on Linux npm install commands referencing known Shai-Hulud 2.0 malicious package versions.

Linux Process Creation: curl Exfiltration from Malicious NPM Package Webhook.site

Alerts on Linux curl command lines using -d to send data to a specific webhook.site endpoint, consistent with exfiltration.

Windows: .pth Python Path Configuration File Created in site-packages or venv

Detects creation of Windows Python .pth files in site-packages/venv directories, which can enable code execution or persistence via Python startup.