Sigma detection rules, expert-reviewed

Suspicious Sysinternals EULA Acceptance Registry Write Linked to INC Ransomware

This rule detects the EulaAccepted registry value being written under a Sysinternals product key, indicating first-run command-line use of a Sysinternals tool as seen in INC ransomware intrusions. Because operators use PsExec and similar tools with the -accepteula flag, an unexpected EULA write on a server can reveal attacker tool staging, though administrators also trigger it legitimately.

Suspicious Executable Launched From AppData Roaming Linked to GootLoader

This rule detects processes executing directly from the user AppData Roaming directory, a location GootLoader uses to stage and run its payloads. Legitimate installers occasionally run from AppData, so this pattern is heuristic, but user-writable execution paths are a common malware staging behavior warranting review.

Suspicious Execution Delay via Ping to Loopback Address

This rule detects ping.exe being directed at the loopback address which Spectre RAT uses as a time based execution delay to evade sandbox analysis and space out its actions. Pinging localhost in combination with follow on execution is a common defense evasion trick seen in loaders and RATs.

Suspicious Google API DNS Query From Temporary Directory Process Abused for C2

This rule detects DNS queries to Google Sheets or Drive API hosts originating from a process running out of a temporary or user AppData directory, a covert command-and-control channel described by Intel 471. Malware abuses trusted Google API endpoints to blend beacon traffic with normal web activity, so API lookups from temp-resident binaries are a heuristic C2 indicator that benefits from process-path context to reduce noise.

Possible RD Web Access Brute Force via Repeated Login POST Requests

This rule detects HTTP POST requests to the Remote Desktop Web Access login endpoint, matching the RDWeb brute-force activity observed in a terminal server phishing intrusion. Adversaries automate large volumes of credential guesses against the RDWeb form where an HTTP 302 response indicates a successful authentication. High-volume POSTs to this endpoint signal password guessing against externally exposed remote access.

Suspicious Active Directory Web Services Query from Localhost via SOAPHound

This rule detects Directory Service event 1644 activity attributed to a client connecting from the IPv6 loopback address over the Active Directory Web Services path, the local ADWS proxying behavior SOAPHound uses to relay LDAP through port 9389. Running the collector on a domain controller and querying ADWS via localhost obscures the true source of enumeration. A loopback ADWS client issuing bulk directory queries is anomalous and suggests on-host reconnaissance tooling.

Suspicious Remote MSI Install of Dokan Driver via msiexec

This rule detects msiexec installing a Dokan filesystem package, the driver this threat actor deployed to mount a virtual drive for credential and data staging. Dokan has legitimate uses in some software, so this pattern is a low-confidence signal best correlated with subsequent dokanctl mounting and LSASS access.

Possible Illicit Consent Grant to OAuth Application via Azure AD

This rule detects a user or admin consent grant to an OAuth service principal, a technique used in the illicit consent grant attacks documented by Huntress. Adversaries lure victims into consenting to attacker-controlled applications to obtain long-lived access tokens for mail and directory data. Because legitimate app consent is common, this detection is best paired with anomalous application naming or reply URLs and treated as a hunting lead.

Possible Telegram Bot API Command and Control Traffic

This rule detects requests to the Telegram Bot API sendDocument and getUpdates methods which the Dark Pink APT uses to exfiltrate stolen files and receive commands through api.telegram.org. Routing C2 over a trusted messaging service blends malicious traffic with legitimate flows. It matters because it can reveal data theft hidden inside allowed cloud services.

Suspicious Scheduled Task Creation via schtasks

This rule detects creation of scheduled tasks via schtasks.exe with the /create flag. Adversaries frequently register scheduled tasks for persistence and execution, dropping task XML under System32\Tasks. Because administrators also create tasks legitimately, this should be triaged for unexpected task names and payload paths.

Suspicious Node.js Spawning Python or Tar Interpreter

This rule detects node.exe spawning python.exe or tar.exe which reflects the Lazarus loader chain where a malicious server.js executes downloaded Python payloads and unpacks archives. The behaviour extracts and runs second-stage InvisibleFerret and BeaverTail components. It is important because it reveals code execution smuggled through a seemingly benign development runtime.

Possible Krasue Linux RAT Command and Control on Uncommon Port 52699

This rule detects network traffic to the uncommon port 52699 which the Krasue Linux RAT uses for its embedded command and control server on compromised hosts. The rootkit hides this port range while relaying operator commands over it. Detecting connections to it can surface Krasue infected servers despite the kernel level concealment.

Suspicious svchost.exe Loading Unsigned DLL (via image_load)

This rule detects svchost.exe loading an unsigned DLL, a service-hosting abuse pattern highlighted by Group-IB hunting guidance where malicious service DLLs are loaded into the shared Windows service host process. Adversaries leverage service DLL loading to run code under a trusted process and blend with legitimate service activity, making unsigned loads worth surfacing for baselining and outlier review.

Suspicious SonicWall Access With Anomalous Chrome Linux User Agent via Webserver

This rule detects requests to SonicWall SSL-VPN and login endpoints that carry an automated-tool signature combining a Chrome 119 on Linux user agent with the campaign target paths. The reconnaissance campaign against SonicWall firewalls presents this consistent Chrome Linux user agent while probing management endpoints from commercial proxy infrastructure. Correlating the anomalous user agent with SonicWall endpoints surfaces scripted scanning that generic path-only detection may miss.

Suspicious File Concatenation via copy Binary Mode

This rule detects the command shell copy utility used in binary mode to concatenate multiple files into one, a payload-assembly technique observed in a Lumma infostealer campaign that combined an AutoIt interpreter with a script to reconstruct an executable. It captures the joining of staged fragments into a runnable payload on disk. Detecting this is important because copy /b concatenation of separate files is an established malware building technique that reassembles payloads to evade detection.