Sigma detection rules, expert-reviewed

Malicious Msiexec Installation of a Remote MSI Package (via process_creation)

This rule detects msiexec.exe installing a package directly from a remote HTTP or UNC location, a System Binary Proxy Execution pattern used to fetch and run attacker-controlled installers under a signed Microsoft binary. This LOLBin abuse appears in the Red Canary Threat Detection Report as a way to bypass application allowlisting and deliver second-stage payloads. Detecting remote msiexec installs surfaces the proxy-download-and-execute behavior.

Malicious LSASS Memory Access From a Non-System Process (via process_access)

This rule detects a process opening a handle to LSASS with memory-read access rights typical of credential-dumping tooling, while excluding the small set of legitimate operating-system components that normally interact with LSASS. Access to LSASS memory is a top credential-access technique in the Red Canary Threat Detection Report, yielding plaintext secrets and hashes for lateral movement. Alerting on non-system readers of LSASS surfaces dumping attempts across custom and off-the-shelf tools.

GateDoor Persistence via schtasks MicrosoftEdging Task (via process_creation)

This rule detects creation of a scheduled task named MicrosoftEdging through schtasks, the logon and idle persistence GateDoor establishes to relaunch its WebViewHost.exe loader. The task name masquerades as a Microsoft Edge component while pointing at attacker-controlled files under the roaming profile, making its creation a strong persistence indicator.

Malicious Impacket Atexec Remote Scheduled Task Execution (via process_creation)

This rule detects the scheduled-task pattern used by Impacket atexec for remote command execution, where schtasks registers a one-off ONSTART task that runs cmd and redirects output to a temporary file for retrieval over SMB. Remote execution via scheduled tasks is a lateral-movement behavior in the Red Canary Threat Detection Report and a hallmark of hands-on-keyboard operators. Detecting this task-creation signature surfaces Impacket-driven lateral movement.

Malicious Rundll32 DllRegisterServer Execution From a User-Writable Path (via process_creation)

This rule detects rundll32.exe invoking the generic DllRegisterServer export on a DLL located in a user-writable directory such as AppData, Temp or ProgramData, a proxy-execution pattern used to run attacker DLLs under a trusted binary and bypass application controls. Rundll32 abuse is a top System Binary Proxy Execution technique in the Red Canary Threat Detection Report. Detecting DllRegisterServer calls against non-system DLL paths surfaces the evasion.

PowerShell Encoded or Download-Cradle Command Line (via process_creation)

This rule detects PowerShell launched with an encoded command or an in-memory download-and-execute cradle on its command line, such as base64-encoded payloads or remote content pulled through Net.WebClient and piped into Invoke-Expression. PowerShell abuse is the single most prevalent technique in the Red Canary Threat Detection Report, used to stage and run payloads while evading disk-based controls. Flagging these command-line patterns catches the execution stage before follow-on activity.

PATCHCORD SHEETCORD Startup Folder VBScript Persistence (via file_event)

This rule detects the SHEETCORD backdoor dropping SystemHelper.vbs into the user Startup folder to gain logon persistence during the PATCHCORD campaign against Afghan telecom targets. Adversaries place a VBScript launcher in the Startup directory so wscript executes their implant at every logon. Detecting the drop exposes persistence before the Google Sheets tasking channel activates.

Malicious PHP Code Injection in URL via CraftCMS CVE-2025-32432 Exploitation (via webserver)

This rule detects inline PHP code appearing in a request URL, the code-injection technique used after CraftCMS CVE-2025-32432 exploitation to write a file manager webshell to the web root via file_put_contents and file_get_contents. Adversaries embed PHP tags and file functions in the request so the vulnerable application stores and executes attacker-controlled code.

Malicious Houken sysinitd Rootkit Kernel Module Load via insmod (via process_creation)

This rule detects loading of the Houken sysinitd rootkit kernel module via insmod, the persistence and defense-evasion behavior deployed on compromised Ivanti Cloud Service Appliance devices to hook the kernel and hide the intrusion. Adversaries leverage a loadable kernel module to survive reboots and conceal processes and network activity, making detection critical because the rootkit blinds most higher-level telemetry once loaded.

Malicious Kimsuky Remote HTA Execution via URL Shortener (via process_creation)

This rule detects mshta.exe launching a remote payload through a Korean URL shortener domain, the delivery behavior of the Kimsuky KimJongRAT campaign that hides its staging server behind link24 and buly redirects. Adversaries leverage mshta as a trusted scripting host to fetch and run remote HTA content while evading download controls, making early detection critical for catching execution at the initial access stage.

Masquerading Kimsuky Scheduled Task Persistence Executing VBE via Wscript (via process_creation)

This rule detects creation of a scheduled task that repeatedly launches wscript.exe against a VBScript encoded file, the persistence behavior used by a Kimsuky campaign to keep its bot.vbe beacon running at short intervals. Adversaries leverage the Task Scheduler to survive reboots and maintain access while masquerading as a browser update task, making early detection critical for surfacing persistence before further payload deployment.

Malicious Browser Master Key Decryption Artifacts Written by Katz Stealer (via file_event)

This rule detects creation of the decrypted browser master-key text files written by Katz Stealer after it extracts and decrypts Chrome, Edge, and Brave application-bound encryption keys. Adversaries leverage these staged key files to decrypt saved credentials and cookies offline, making detection valuable for catching browser credential theft in progress.

Renamed DLL Sideloading of TOTPGuard via Renamed Setup Binary in Nimbus Manticore Chain (via image_load)

This rule detects a setup.exe process loading TOTPGuard.dll, the AppDomain-hijacking DLL sideloading pair used by Nimbus Manticore to run a decrypted native implant from a renamed Microsoft Visual Studio host binary. Adversaries leverage sideloading through a signed executable to execute malicious code under a trusted process, making early detection critical for surfacing the infection chain before beacon establishment.

In-Memory Matanbuchus Loader DLL Sideloading via Notepad++ GenericUpdater Loading libcurl (via image_load)

This rule detects the legitimate Notepad++ GUP updater GenericUpdater.exe loading libcurl.dll from a user-writable location, the DLL sideloading behavior used by the Matanbuchus 3.0 loader after delivery through a fake Notepad++ update. Adversaries leverage sideloading against a signed updater to execute the loader under a trusted process while evading process-based detection, making early detection critical for stopping the chain before regsvr32 persistence and process hollowing deploy.

PowerShell Spawned by SharePoint Worker Process After ToolShell Exploitation (via process_creation)

This rule detects the SharePoint worker process w3wp.exe spawning PowerShell, the post-exploitation execution pattern seen after ToolShell CVE-2025-53770 web shell deployment where decoded payloads are written to disk. Adversaries leverage the worker process to run commands under IIS context, making early detection critical for catching hands-on-keyboard activity following server compromise.