Sigma detection rules, expert-reviewed

Malicious Gelsemium OwlProxy wmipd DLL Load via image_load

This rule detects the load of wmipd.dll which is the OwlProxy backdoor registered as a service masquerading as a WMI Provider. The suspected Gelsemium activity against a Southeast Asian government installed OwlProxy for proxying and persistence, and the impostor module name is a strong indicator of the malicious service DLL.

Malicious Turla TinyTurla w64time DLL Load via image_load

This rule detects the load of w64time.dll which is the TinyTurla backdoor payload masquerading as the legitimate Windows Time service module. Turla (Pensive Ursa) registers a malicious service named Windows Time Service that loads this DLL from system32 for stealthy persistence, and the impostor module name is a strong indicator of compromise.

Possible Public Bucket IAM Binding for Data Exfiltration (via gcp)

This rule detects GCP IAM policy changes that grant the allAuthenticatedUsers or allUsers principals object-creator access on storage buckets, exposing them to universal write. Attackers abuse this global-namespace binding to hijack buckets and stage cloud data exfiltration.

Suspicious Cloud Storage Access by Vertex AI P4SA Identity (via gcp)

This rule detects Cloud Storage object and bucket access performed by the Vertex AI service agent identity, a data access behavior shown in the Double Agents research to enable theft of data via a stolen P4SA credential. Storage reads by the AI platform agent outside expected pipelines indicate misuse of the compromised service identity to reach protected data.

Suspicious Artifact Registry Enumeration by Vertex AI Service Agent (via gcp)

This rule detects the Vertex AI per-product service agent enumerating Artifact Registry packages, a cloud discovery behavior demonstrated in the Double Agents research against GCP Vertex AI. Enumeration of container and package registries by the AI platform identity reflects abuse of the P4SA credential to map resources beyond its intended scope.

Suspicious Compute Instance Metadata Modification in GCP

This rule detects modification of GCP compute instance metadata through compute.instances.setMetadata, a technique adversaries use to inject SSH keys or startup scripts and gain execution on virtual machines. Changing instance metadata via the control plane provides persistent access without touching the guest network. Detecting this call exposes credentialed access into compute workloads.

Malicious XCSSET Payload Drop to Temp and Hidden Home Paths

This rule detects creation of the specific staging artifacts used by XCSSET v4.0 including the tmp p.app bundle the tmp r file and the hidden tr file in the user home directory. These fixed drop paths hold the malware components and persistence loaders. Detecting these file writes provides a strong campaign-specific indicator of an XCSSET infection.

Malicious Systemd Service Masquerading as Sd-Pam Helper

This rule detects creation of a systemd unit file named sd-pam.service, a name TuxBot v3 borrows from the legitimate PAM session helper which is a binary and never ships as a service. The botnet installs this always-restart unit for resilient persistence on Linux and IoT hosts. Detecting the bogus service file exposes systemd persistence hiding behind a trusted system name.

Suspicious Python Path Configuration Hook Persistence (via file_event)

This rule detects creation of the litellm_init.pth Python path configuration file used in the TeamPCP supply chain attack to run code automatically when the interpreter starts. A .pth file with an import hook executes attacker code on every Python invocation, providing stealthy persistence within the software environment.

Suspicious Infostealer Log Artifacts Written to Disk (via file_event)

This rule detects creation of the log artifacts victim_logs.txt and opsec.log written by AI-assisted malware samples analyzed by Unit 42, including a .NET infostealer and a Golang Sliver dropper. These operator log files record collected victim data and dropper activity, so their presence indicates malware staging harvested information locally.

Suspicious Storage Service Driver Masquerade swprv Typosquat (via file_event)

This rule detects creation of driver files swrpv.sys and swprv32.sys that typosquat the legitimate Windows Shadow Copy provider swprv, a masquerade used in a suspected China-based espionage operation against military targets. These misspelled driver names impersonate a trusted system component to blend malicious kernel or service components into the environment.

Suspicious Active Directory Reconnaissance Output via ADRecon CSV (via file_event)

This rule detects creation of the ADRecon output file ComputerSPNs.csv, an artifact generated when Muddled Libra enumerates Active Directory service principal names during discovery. The CSV captures SPN data that enables Kerberoasting and lateral-movement targeting.

Malicious VVS Discord Stealer Script Drop via injection-obf.js (via file_event)

This rule detects the injection-obf.js payload being written into a Discord application directory, the client-injection component of the Pyarmor-obfuscated VVS Discord stealer. The dropped script hooks the Discord client to harvest tokens and DPAPI-protected credentials for webhook exfiltration.

Malicious Ransomware Encryption Extension x2anylock

This rule detects files being created or renamed with the .x2anylock extension. The ransomware deployed in the Project AK47 campaign appends this extension to encrypted files. Mass creation of .x2anylock files is a definitive indicator of active ransomware encryption.

Suspicious Modification of PAM Authentication Module

This rule detects writes to the pam_unix.so authentication module under the security library directory. Telecom-focused intruders replace pam_unix.so with a backdoored version to harvest credentials and enable covert authentication. Modification of this PAM module outside package updates signals an authentication backdoor.