Sigma detection rules, expert-reviewed

Malicious Domain Group Enumeration via NetSupport remcmdstub

This rule detects the NetSupport remote command helper remcmdstub.exe spawning the net utility to enumerate domain groups, the Active Directory reconnaissance seen in the NetSupport RAT ClickFix campaign. A remote-control agent driving domain enumeration indicates hands-on-keyboard discovery by an operator.

Malicious Boot Configuration Set to Safe Mode with Networking via bcdedit

This rule detects bcdedit.exe configuring the system to boot into Safe Mode with Networking, an inhibit-recovery step used by Qilin ransomware to run its encryptor while defenses are inactive. Modifying boot configuration to force Safe Mode is a hallmark of ransomware preparing to encrypt with security tooling disabled.

Malicious PowerShell Spawned by Masqueraded NVIDIA GeForce Experience Binary

This rule detects PowerShell spawned by a process named nvidia geforce experience.exe, a masquerade the Genesis Market campaign used to sideload LummaStealer from a legitimately named binary. The genuine GeForce Experience application does not launch PowerShell, so this chain indicates DLL sideloading and stealer execution.

Shadow Copy Deletion via Vssadmin to Inhibit Recovery

This rule detects vssadmin.exe deleting all volume shadow copies quietly, the recovery-inhibition step performed by PlayBoy Locker before encryption. Removing shadow copies prevents victims from restoring files and is a defining precursor to ransomware detonation.

Masqueraded Executable With Double Image Extension

This rule detects execution of files carrying a double extension that hides an executable behind an image name such as .jpg.scr, a masquerading trick used by the Phorpiex downloader payloads. Double extensions deceive users and analysts into treating a runnable file as a harmless image.

AutoIt Script Execution via A3X Payload

This rule detects execution of a compiled AutoIt script through the AutoIt3ExecuteScript switch with an .a3x payload, seen in the Andromeda Gamarue cluster running via a masqueraded GoogleChrome.exe. Abusing the AutoIt interpreter to run a3x scripts is a common malware execution and obfuscation technique.

Andromeda Loader Execution via Rundll32 Desktop.ini Ordinal

This rule detects rundll32.exe invoking a DLL export _ldr together with a desktop.ini argument, the loader launch pattern of the Andromeda Gamarue cluster. Using rundll32 to call an obscure loader ordinal while referencing desktop.ini is a distinctive execution and evasion behavior.

Inbound C2 Firewall Rule Added via Netsh for TCP 5984

This rule detects netsh.exe adding a firewall rule opening TCP port 5984, the inbound access hole created by NOOPDOOR operators in Cuckoo Spear. Opening a specific high port via netsh to permit attacker connections is an evasion and command-and-control enablement step.

Scheduled Task Masquerading as Microsoft Wininet Config

This rule detects schtasks.exe creating a task under a Microsoft Windows Wininet Config path, a non-existent Microsoft task tree used by DeadRinger actors to disguise persistence. Placing tasks in a fake Microsoft folder helps them blend with legitimate scheduled tasks.

Active Directory Database Dump via Ntdsutil IFM

This rule detects ntdsutil.exe creating an Install From Media snapshot to dump the ntds.dit Active Directory database, a domain credential theft step observed in the DeadRinger campaign against telcos. Extracting ntds.dit yields every domain account hash and is a high-impact credential access technique.

Lateral Movement via WMIC Remote Process Creation

This rule detects wmic.exe invoking process call create against a remote node, the technique used in Operation Soft Cell to execute batch payloads across telecom networks. Remote WMI process creation is a common lateral movement and execution vector for hands-on-keyboard operators.

Credential Dumping via Reg Save of SAM Hive

This rule detects reg.exe saving the HKLM SAM registry hive to disk, an offline credential extraction step observed in Operation Soft Cell. Exporting the SAM hive lets attackers crack local account hashes away from the endpoint.

Suspicious Credential Dump via lsa.exe Debug Output

This rule detects execution of an lsa.exe tool with debug and module switches writing to a debug.bin file, the credential-dumping utility used in Operation GhostShell. Attackers run this to extract secrets from LSASS-related material and stage them for exfiltration. The specific command-line switches and output filename make this a distinctive credential-theft indicator.

Suspicious WinRM Compatibility HTTPS Listener Enabled via winrm.vbs

This rule detects use of winrm.vbs to enable the compatibility HTTPS listener, a remote-service configuration change used by Winnti in Operation CuckooBees to establish encrypted WinRM access. Attackers enable this listener to move laterally and control hosts over an encrypted management channel. Enabling the WinRM compatibility HTTPS listener via the script host is an uncommon and suspicious remote-access setup.

Suspicious SYSTEM Scheduled Task Named test Created via schtasks

This rule detects creation of a scheduled task named test that runs as the SYSTEM account, an execution and lateral-movement pattern used by Winnti in Operation CuckooBees. Attackers register this high-privilege task to run payloads under SYSTEM, often against remote hosts. The generic task name combined with a SYSTEM run-as context is a distinctive Winnti indicator.