Sigma detection rules, expert-reviewed

Suspicious Fake Crypto Wallet Installer Batch Script Staging (via file_event)

This rule detects creation of the distinctive numbered batch scripts staged by a fake cryptocurrency wallet installer that orchestrates hiding artifacts, terminating Explorer and deploying Remote Utilities. Adversaries drop these helper scripts during installation to sequence defense evasion and RMM setup, so their appearance on disk indicates the intrusion chain in progress.

Malicious Msiexec Installation of a Remote MSI Package (via process_creation)

This rule detects msiexec.exe installing a package directly from a remote HTTP or UNC location, a System Binary Proxy Execution pattern used to fetch and run attacker-controlled installers under a signed Microsoft binary. This LOLBin abuse appears in the Red Canary Threat Detection Report as a way to bypass application allowlisting and deliver second-stage payloads. Detecting remote msiexec installs surfaces the proxy-download-and-execute behavior.

Malicious LSASS Memory Access From a Non-System Process (via process_access)

This rule detects a process opening a handle to LSASS with memory-read access rights typical of credential-dumping tooling, while excluding the small set of legitimate operating-system components that normally interact with LSASS. Access to LSASS memory is a top credential-access technique in the Red Canary Threat Detection Report, yielding plaintext secrets and hashes for lateral movement. Alerting on non-system readers of LSASS surfaces dumping attempts across custom and off-the-shelf tools.

GateDoor Persistence via schtasks MicrosoftEdging Task (via process_creation)

This rule detects creation of a scheduled task named MicrosoftEdging through schtasks, the logon and idle persistence GateDoor establishes to relaunch its WebViewHost.exe loader. The task name masquerades as a Microsoft Edge component while pointing at attacker-controlled files under the roaming profile, making its creation a strong persistence indicator.

Suspicious Kimsuky AlphaSeed Artifacts in edge Hidden Directory (via file_event)

This rule detects creation of AlphaSeed working files inside the hidden .edge directory in the user profile, including the powermgmt.dat backdoor DLL, the cache_w.db keylog store and the schtaskw.exe self-copy. These files together in a hidden per-user folder are characteristic of a Kimsuky AlphaSeed infection staging keystroke capture and persistence.

Malicious Impacket Atexec Remote Scheduled Task Execution (via process_creation)

This rule detects the scheduled-task pattern used by Impacket atexec for remote command execution, where schtasks registers a one-off ONSTART task that runs cmd and redirects output to a temporary file for retrieval over SMB. Remote execution via scheduled tasks is a lateral-movement behavior in the Red Canary Threat Detection Report and a hallmark of hands-on-keyboard operators. Detecting this task-creation signature surfaces Impacket-driven lateral movement.

Suspicious Child Process Spawned by WMI Provider Host (via process_creation)

This rule detects the WMI Provider Host (WmiPrvSE.exe) spawning a command shell or script interpreter, an execution pattern that indicates local or remote code execution through Windows Management Instrumentation. WMI is a top execution and lateral-movement technique in the Red Canary Threat Detection Report because it runs under a trusted service and leaves little on disk. Detecting interpreter children of WmiPrvSE surfaces WMI-based hands-on activity.

Malicious Rundll32 DllRegisterServer Execution From a User-Writable Path (via process_creation)

This rule detects rundll32.exe invoking the generic DllRegisterServer export on a DLL located in a user-writable directory such as AppData, Temp or ProgramData, a proxy-execution pattern used to run attacker DLLs under a trusted binary and bypass application controls. Rundll32 abuse is a top System Binary Proxy Execution technique in the Red Canary Threat Detection Report. Detecting DllRegisterServer calls against non-system DLL paths surfaces the evasion.

PowerShell Encoded or Download-Cradle Command Line (via process_creation)

This rule detects PowerShell launched with an encoded command or an in-memory download-and-execute cradle on its command line, such as base64-encoded payloads or remote content pulled through Net.WebClient and piped into Invoke-Expression. PowerShell abuse is the single most prevalent technique in the Red Canary Threat Detection Report, used to stage and run payloads while evading disk-based controls. Flagging these command-line patterns catches the execution stage before follow-on activity.

Suspicious Trojanized ScreenConnect Client Installer with Guest Relay Parameters (via process_creation)

This rule detects the ScreenConnect client setup executed with the guest session and relay host parameters used by trojanized installers that drop AsyncRAT and PureHVNC on a single machine. Adversaries embed the e Support y Guest and h relay-host arguments so the agent silently connects to attacker infrastructure. The parameter combination distinguishes weaponized installers from legitimate deployments.

PATCHCORD SHEETCORD Startup Folder VBScript Persistence (via file_event)

This rule detects the SHEETCORD backdoor dropping SystemHelper.vbs into the user Startup folder to gain logon persistence during the PATCHCORD campaign against Afghan telecom targets. Adversaries place a VBScript launcher in the Startup directory so wscript executes their implant at every logon. Detecting the drop exposes persistence before the Google Sheets tasking channel activates.

Nullsoft Scriptable Installer Script (NSIS) execution

Detects the loading of the NSIS System plugin library, indicative of an NSIS script execution.

Malicious PHP Code Injection in URL via CraftCMS CVE-2025-32432 Exploitation (via webserver)

This rule detects inline PHP code appearing in a request URL, the code-injection technique used after CraftCMS CVE-2025-32432 exploitation to write a file manager webshell to the web root via file_put_contents and file_get_contents. Adversaries embed PHP tags and file functions in the request so the vulnerable application stores and executes attacker-controlled code.

Malicious Houken sysinitd Rootkit Kernel Module Load via insmod (via process_creation)

This rule detects loading of the Houken sysinitd rootkit kernel module via insmod, the persistence and defense-evasion behavior deployed on compromised Ivanti Cloud Service Appliance devices to hook the kernel and hide the intrusion. Adversaries leverage a loadable kernel module to survive reboots and conceal processes and network activity, making detection critical because the rootkit blinds most higher-level telemetry once loaded.

Malicious Kimsuky Remote HTA Execution via URL Shortener (via process_creation)

This rule detects mshta.exe launching a remote payload through a Korean URL shortener domain, the delivery behavior of the Kimsuky KimJongRAT campaign that hides its staging server behind link24 and buly redirects. Adversaries leverage mshta as a trusted scripting host to fetch and run remote HTA content while evading download controls, making early detection critical for catching execution at the initial access stage.