Sigma detection rules, expert-reviewed

Suspicious StrelaStealer Base64 Payload Decode via Certutil (via process_creation)

This rule detects certutil being used with the decode and force flags to convert a Base64 encoded file into an executable payload, the deobfuscation step in the StrelaStealer infection chain. Because certutil decode is a living off the land technique for staging hidden binaries, this usage warrants review as likely payload unpacking.

Suspicious Csrss Process Masquerading Outside System32 (via process_creation)

This rule detects a process named csrss.exe running from any location other than the System32 or SysWOW64 directories, a masquerade used by the Glupteba packed installer to blend with the legitimate Client Server Runtime Subsystem. The genuine csrss.exe only ever launches from System32, so an off path copy indicates a spoofed loader attempting to hide malicious execution.

Malicious Mispadu Payload Execution from WebDAV Share via Rundll32 (via process_creation)

This rule detects rundll32.exe executing a DLL from a remote WebDAV share referenced through a file URL, a delivery technique used by the Mispadu infostealer to bypass SmartScreen and run its payload. Mispadu is a Latin American banking trojan that harvests browser credentials, and this remote execution path lets it evade reputation-based controls during initial access.

Malicious Scheduled rundll32 Execution of ProgramData VMware DLL by BianLian

This rule detects rundll32.exe executing a DLL from a ProgramData VMware directory with an Entry export and redirecting output to a temp file, matching the persistence and execution behavior of the BianLian ransomware group per Unit 42. The actor masquerades its loader as a VMware component and runs it via a scheduled task which evades scrutiny and maintains access.

Suspicious LSASS Memory Dump via Task Manager After Ivanti Exploitation

This rule detects Task Manager being used to create a memory dump of the LSASS process, matching credential access observed after Ivanti appliance exploitation by Unit 42. Adversaries dump LSASS through the built-in Taskmgr interface to harvest credentials while avoiding known dumping tools which enables further lateral movement.

Suspicious File Download via bitsadmin Transfer by Medusa Ransomware

This rule detects use of bitsadmin with the transfer argument to download files through the Background Intelligent Transfer Service, matching tooling ingress used by Medusa ransomware operators per Unit 42. Adversaries abuse the trusted bitsadmin utility to fetch payloads while evading application controls which supports staging of ransomware components.

Suspicious Mimilite Credential Dumper Execution Writing KB-Named Output

This rule detects execution of the Mimilite update.exe credential dumper writing its output to a KB-named text file, matching the toolset used against organizations in the Middle East, Africa and the US per Unit 42. The actor masquerades a dumping utility as an update binary and stores harvested secrets in a fake KB patch file which supports credential access.

Suspicious search-ms URI Handler Invocation in CVE-2023-36584 Exploit Chain

This rule detects invocation of the search-ms Windows search protocol handler with an attributes parameter, matching the delivery technique that triggers remote ZIP extraction in the CVE-2023-36884 and CVE-2023-36584 chain reported by Unit 42. Abuse of the search-ms handler lures users into opening remote content while bypassing web-mark protections which is an early exploitation signal.

Suspicious WScript VBS Execution from Temp Directory in CVE-2023-36884 Exploit Chain

This rule detects wscript.exe executing a VBScript file extracted into the user Temp directory, matching the SmartScreen-bypass stage of the CVE-2023-36884 and CVE-2023-36584 exploit chain attributed to a Russian APT by Unit 42. Running script payloads unpacked from a downloaded archive under Temp is a common evasion of mark-of-the-web protections and signals user-driven initial execution.

Suspicious Self-Deleting Batch Script Execution Consistent with Agonizing Serpens Wiper Cleanup

This rule detects a batch script named remover.bat being executed and deleting itself, matching the anti-forensic cleanup routine of the Agonizing Serpens (Agrius) wiper toolset described by Unit 42. Destructive actors self-delete their loaders after wiping to hinder recovery and attribution which makes this a strong post-impact indicator.

Malicious BYOVD EDR Kill via Renamed GMER Driver by Agonizing Serpens

This rule detects service or driver loading of the renamed vulnerable GMER driver AGMT.sys or the rentdrv2 driver used by Agonizing Serpens (Agrius) to disable endpoint security through a bring-your-own-vulnerable-driver technique. The actor abuses signed but exploitable drivers to terminate EDR processes by PID which blinds defenses ahead of wiper deployment.

Suspicious Localized Administrator Account and Group Enumeration After Citrix Bleed Exploitation

This rule detects net.exe enumeration targeting Spanish-localized privileged account and group names such as administrador and administradores, matching hands-on reconnaissance observed during Citrix Bleed post-exploitation by Unit 42. Attackers map local admin membership to plan privilege escalation which is unusual outside of interactive intrusion.

Suspicious Python HTTP Server Started for Payload Staging After Citrix Bleed Exploitation

This rule detects use of the Python built-in HTTP server module to host files on a local port, a hands-on-keyboard technique seen in Citrix Bleed (CVE-2023-4966) post-exploitation by Unit 42. Adversaries stand up an ad hoc web server to transfer tooling laterally which is rare on production endpoints and signals active intrusion.

Malicious BlackCat Munchkin Controller Execution via process_creation

This rule detects the BlackCat Munchkin utility boot sequence that runs the /app/controller binary and then powers off the disposable Linux virtual machine. Munchkin executes its ransomware controller from this hardcoded path inside a throwaway VM to evade host defenses, so this command shape is a high-confidence indicator of Munchkin execution.

Suspicious Impacket Remote Execution Tool Usage via process_creation

This rule detects command lines invoking the Impacket suite scripts smbexec, psexec, wmiexec, secretsdump and ntlmrelayx used for remote code execution and credential dumping. BlackCat operators used the Munchkin utility alongside these Impacket tools to move laterally and harvest credentials, so their execution outside sanctioned admin activity signals hands-on intrusion.