Sigma detection rules, expert-reviewed

Suspicious Doenerium Host Fingerprinting via cmd.exe

This rule detects the Doenerium stealer fingerprinting a host by running chcp or tasklist through cmd.exe with the /d /s /c flags. The stealer enumerates the code page and running processes early in execution to profile the victim and evade sandboxes.

Suspicious HijackLoader Component Execution via ClearFake

This rule detects execution of the AiStubX64 and KSPSService binaries dropped by the ClearFake APPX payload to stage HijackLoader. These named components accompany the fake-update infection chain and their execution indicates the loader is running.

Malicious Microsoft Defender Services Stopped via sc.exe

This rule detects sc.exe stopping core Microsoft Defender services such as WinDefend, Sense or WdNisSvc. Disabling these services terminates endpoint and EDR telemetry, a defense evasion step used by intruders before continuing their operation as described by Sekoia.

Suspicious Microsoft Defender Definitions Removed via MpCmdRun

This rule detects MpCmdRun.exe being used to remove all Defender signature definitions. Adversaries strip antivirus definitions to degrade detection coverage before executing malware, an evasion behaviour highlighted in Sekoia Defender tampering research.

Suspicious Okta SSO Access to Many Applications in Short Window

This rule detects a single Okta actor authenticating via SSO into six or more distinct application instances within five minutes. A rapid fan-out across many apps is consistent with a hijacked session enumerating available resources rather than normal user behaviour.

Malicious AddInProcess32 Network Beacon on PureRAT C2 Ports

This rule detects the .NET AddInProcess32.exe host process establishing outbound connections to TCP ports 56001 through 56003. Attackers reflectively load the PureRAT payload into AddInProcess32.exe to blend malicious traffic with a signed Microsoft binary. Outbound traffic from this process to the fixed high port range is a strong indicator of PureRAT command and control.

Suspicious ctfmon.exe Network Connection to PikaBot C2 Ports

This rule detects the injected ctfmon.exe process establishing outbound connections to uncommon high ports used by PikaBot command and control such as 2078, 2083, 2222 and the 13720-13786 range. Because ctfmon.exe never initiates network traffic legitimately, any such connection indicates the malware beacon operating from hijacked memory. This helps surface active C2 that evaded process based detection.

Possible Trojanised Python Native Extension Load of gradient Module

This rule detects a Python process loading a gradient native extension module which was used to deliver a Python RAT to vulnerability researchers. The ChocoPoCs campaign ships trojanised packages whose native gradient extension executes attacker code on import. Because the module name is generic this pattern needs corroboration from the surrounding package before it is treated as malicious.

Possible python311 DLL Side-Loading by Non Python Host Process

This rule detects a process that is not a Python interpreter loading python311.dll which can indicate DLL side-loading. Silver Fox side-loads a malicious python311.dll alongside a decoy executable to run ValleyRAT shellcode. Because many legitimate applications embed Python this pattern requires context before it can be confirmed as malicious.

Suspicious HTA File Dropped into Startup Folder

This rule detects creation of an HTA file inside the user Startup folder. Gamaredon abuses a WinRAR path traversal flaw to place an HTA into Startup for persistence in the GammaPhish chain. Auto-executed HTML applications in a Startup directory are almost always malicious persistence.

Suspicious Autostart Desktop Entry Persistence via Linux File Creation

This rule detects creation of a system-backup.desktop autostart entry under the user config autostart directory on Linux. TransparentTribe uses this masqueraded desktop file together with a systemd unit and a per-minute crontab to persist the DeskRAT implant. A backup themed autostart entry is a low effort way to regain execution at every login which is why it warrants review.

Malicious PolarEdge QNAP Backdoor Dropper Script in Temp (via file_event)

This rule detects creation of the hidden dropper script used by the PolarEdge QNAP backdoor in the temp directory. After exploiting CVE-2023-20118 the implant writes a hidden qnax shell script to stage its components. A hidden script with this name in tmp is a specific artifact of the PolarEdge implant.

Malicious Interlock Ransomware Encrypted File and Note Creation (via file_event)

This rule detects creation of files bearing the Interlock ransomware extension or its ransom note marker. The Interlock ransomware appends the interlock extension to encrypted files and drops a note referencing !NT3R10CK. Observing these file artifacts confirms active encryption on the host.

Malicious MuddyRot Payload Drop in ProgramData SoftwareMemory Directory

This rule detects creation of documentsmanagerreporter.exe inside a softwarememory folder under ProgramData, the staging path used by the MuddyWater MuddyRot implant during installation. Writing this specific file marks the initial deployment of the backdoor before persistence and C2 are established. Early detection at the drop stage allows containment before execution.

Suspicious Microsoft Entra Device Code Authentication Flow

This rule detects sign-ins that complete through the OAuth device code authentication protocol in Microsoft Entra. The EvilTokens phishing-as-a-service kit abuses the device code flow to trick victims into authorising attacker controlled devices and harvest refresh tokens. Because device code is uncommon for ordinary interactive users its appearance should be reviewed against expected device enrollment activity.