Sigma detection rules, expert-reviewed

Possible Team9 C2 via Emercoin bazar Domain Resolution

This rule detects DNS queries for domains under the Emercoin .bazar top-level domain used by the Team9 malware family for resilient command-and-control. Resolution of a .bazar name from an enterprise host is highly unusual and strongly suggests a blockchain-based C2 channel.

Malicious SharkBot Android Banking Trojan C2 via DGA Domain Suffix

This rule detects DNS resolution of domains containing the unique SharkBot domain generation algorithm suffix used to locate command and control infrastructure as documented by NCC Group. The trojan falls back to algorithmically generated domains sharing a hardcoded token making that constant a high confidence indicator of infection.

Possible SharePoint ToolShell Exploitation via ToolPane POST with SignOut Referer

This rule detects HTTP POST requests to the SharePoint ToolPane.aspx endpoint carrying a Referer header pointing to the SignOut page. Microsoft identified this request signature as the ToolShell exploit chain against on-premises SharePoint. The crafted Referer bypasses authentication to reach the vulnerable endpoint, so this combination indicates active exploitation.

Malicious Run Key Persistence miasma-monitor from AsyncAPI npm Compromise

This rule detects an autorun Run key value named miasma-monitor, the Windows persistence installed by the AsyncAPI npm supply chain compromise import-time loader. The distinctive miasma named autostart relaunches the malicious payload at logon after a poisoned package is imported.

Malicious Run Key Persistence NvmProtocal Launching NodePackages Payload

This rule detects an autorun Run key named NvmProtocal or one referencing the NodePackages protocal.cjs payload, the Windows persistence dropped by the Mastra npm supply chain compromise. The misspelled Node branding launches PowerShell or Node from ProgramData at logon to maintain access after the malicious package installs.

Suspicious Run Key Persistence Masquerading as Google Update

This rule detects creation of autorun Run key values named GupdateS or GupdateU, persistence entries dropped by The Gentlemen ransomware that impersonate the Google Update service. The false Google branding hides the malicious autostart from casual inspection while ensuring the encryptor relaunches at logon.

Malicious Password Filter Registration via LSA Notification Packages

This rule detects registration of a rogue password filter DLL named passms in the LSA Notification Packages registry value, seen in a stealthy third-party supply chain intrusion. A malicious password filter receives every password change in cleartext, giving the attacker durable credential access across the domain.

Malicious Network Provider Registration via ProviderOrder Registry Key

This rule detects registration of a rogue network provider named mslogon in the NetworkProvider ProviderOrder registry key, observed during a stealthy intrusion staged through a third-party compromise. A malicious network provider intercepts credentials at logon time so the attacker can harvest plaintext passwords and sustain long-term covert access.

Malicious WDigest UseLogonCredential Enabled for Cleartext Credential Theft (via registry_set)

This rule detects the WDigest UseLogonCredential value being set to 1, which forces Windows to cache cleartext credentials in memory. Storm-1175 enables this before dumping credentials during high-tempo Medusa ransomware operations. Adversaries use the change to recover plaintext passwords with tools like Mimikatz, so this registry modification is a strong precursor to credential theft and lateral movement.

Malicious Flax Typhoon Accessibility Feature IFEO Debugger Hijack via Registry (via registry_set)

This rule detects creation of an Image File Execution Options debugger value on an accessibility binary such as sethc.exe or utilman.exe pointing to taskmgr or cmd. Flax Typhoon abused this Sticky Keys hijack to gain SYSTEM-level command execution from the logon screen without credentials, enabling stealthy persistence and access.

Suspicious Diamond Sleet C2 via LambLoad Addon PHP URI Pattern (via proxy)

This rule detects outbound web requests to the LambLoad command and control URI structure using the bluemantis addon PHP endpoints. Diamond Sleet used these URIs during the CyberLink supply chain compromise to retrieve second-stage payloads and receive commands.

Suspicious Vidar Payload Execution from AI-Themed DeepSeek Lure Path

This rule detects process activity from a Downloads Programs directory named after a fake DeepSeek AI build, the staging path used to deliver the Vidar infostealer in an AI-branded social engineering campaign. The distinctive lure path indicates a user was tricked into running a fraudulent AI tool that deploys credential theft malware.

Malicious The Gentlemen Ransomware Encryptor via Distinctive CLI Flags

This rule detects execution of The Gentlemen ransomware Go encryptor invoked with its signature command line flags controlling self propagation and fast encryption. The presence of these operator flags together indicates active deployment of a self-propagating encryptor and imminent data destruction across the environment.

Malicious Sapphire Sleet TCC Privacy Database Tampering via sqlite3 (via process_creation)

This rule detects sqlite3 being used to read or write the macOS TCC.db privacy database, an injection technique Sapphire Sleet uses to grant itself access to protected resources without user consent. Adversaries tamper with TCC.db to bypass macOS privacy controls covering the camera, microphone, and full disk access, so direct sqlite3 access to this database is a strong indicator of privacy-control subversion.

Malicious Sapphire Sleet curl to osascript Chain With mac-cur User-Agent (via process_creation)

This rule detects a curl download piped into osascript while using the distinctive mac-cur user-agent, the staged execution chain Sapphire Sleet uses after a fake software update to fetch and run AppleScript payloads on macOS. Adversaries use this pattern to pull second-stage code and execute it in memory, so the mac-cur marker combined with curl and osascript exposes the intrusion at the download-and-execute stage.