Sigma detection rules, expert-reviewed

Windows: certutil.exe Encodes Files to Base64 Using -encode With Suspicious Extensions

Alert on certutil.exe -encode activity that targets files with suspicious extensions.

Windows DLL Sideloading: goopdate.dll Loaded from Nonstandard Paths

Alerts when goopdate.dll is loaded from non-standard locations, suggesting possible DLL sideloading behavior on Windows.

Windows Process Creation: SolidPDFCreator.dll Copy and Run Key Persistence Indicators

Flags Windows command lines that copy SolidPDFCreator.dll and set a Run registry key for auto-execution.

Windows Service Creation for Backdoor Persistence via GoogleUpdate (Event ID 7045)

Flags creation of a "GoogleUpdate" Windows service with rundll32/FileProtocolHandler image path pointing to ProgramData persistence.

Windows: GoogleUpdate.exe Self-Spawn From Uncommon Path

Alerts when GoogleUpdate.exe launches another GoogleUpdate.exe from an unusual directory.

Windows Devil Bait-like Recon via Wscript/Cmd with APPDATA Redirection

Flags cmd.exe launched by wscript.exe to redirect discovery output into %APPDATA%\Microsoft (.xml/.txt) using system enumeration commands.

Uncommon Windows Processes Writing .txt/.xml in AppData\Roaming\Microsoft

Flags creation of .txt/.xml files in AppData\Roaming\Microsoft by schtasks.exe, wscript.exe, or mshta.exe.

Windows RoboForm DLL Sideloading via ImageLoaded roboform.dll/roboform-x64.dll

Alerts on loaded roboform*.dll modules on Windows when module loading is not matched to expected RoboForm binaries.

Potential C2 HTTP Traffic via Goofy Guineapig User-Agent to static.tcplog.com (Proxy Logs)

Flags proxy HTTP requests with a specific Chrome-like User-Agent to static.tcplog.com, consistent with potential C2 traffic.

Windows Process Command Line Matching Goofy-Guineapig Backdoor Command Fragment

Alerts on Windows process command lines containing a specific non-interactive choice command often used in automation.

Windows File Indicators for Goofy Guineapig Malware IOCS

Flags Windows file events involving specific Goofy Guineapig backdoor indicator filenames.

Windows Certificate Export from Local Certificate Store (Event ID 1007)

Flags Windows events where a certificate is exported from the local certificate store via Certificate Services client telemetry.

Windows CAPI2 Event 70: Certificate Private Key Acquired

Detects when Windows CAPI2 logs that a process acquired a certificate private key (EventID 70).

Windows Excel Loads .XLL Add-in from Uncommon File Paths

Flags Excel loading .xll add-ins from uncommon directories based on image load paths.

Windows Excel Loads .XLL Add-In Files

Flags excel.exe loading a .XLL add-in module, an execution indicator for potential malicious add-in activity.