Sigma detection rules, expert-reviewed

Suspicious Microsoft 365 File Download with Scripting User Agent and Spoofed Office Client (via m365)

This rule detects Microsoft 365 audit file access and download events that carry a python-requests or Windows PowerShell user agent while presenting the client application identifier of Microsoft Office, an anomaly seen in the BlackFile vishing extortion operation where operators used stolen tokens to bulk-pull SharePoint and OneDrive content. Legitimate Office clients do not present scripting user agents, so this mismatch signals programmatic data theft under a spoofed application identity.

Suspicious CANONSTAGER DLL Side-Loading via cnmpaui Executable

This rule detects the legitimate Canon utility cnmpaui.exe loading a DLL from a user-writable directory outside its normal Program Files location, matching the PRC-Nexus CANONSTAGER side-loading that launches the SOGU.SEC backdoor. Abusing a signed printer binary lets the actor execute malicious code under a trusted process during espionage against diplomats.

Malicious APT29 WINELOADER DLL Side-Load of vcruntime140.dll via SqlDumper (via image_load)

This rule detects the Microsoft SqlDumper.exe binary loading a vcruntime140.dll from a non-standard directory, the side-load chain APT29 used to run the WINELOADER backdoor. The actor paired a legitimate signed executable with a malicious runtime DLL to gain trusted execution. SqlDumper loading vcruntime140.dll outside canonical install paths is a high-fidelity side-loading indicator.

Malicious FortiManager Unregistered Device Add Indicating CVE-2024-47575 Exploitation (via application)

This rule detects the FortiManager event log message indicating an unregistered device from localhost was successfully added, the core exploitation artifact of the FGFM protocol zero-day CVE-2024-47575. Successful registration of an attacker-controlled device grants remote access to managed configuration data.

Suspicious systemd Service Persistence via GRIDTIDE xapt

This rule detects creation of a systemd unit file named xapt.service under etc systemd system as used by GRIDTIDE to persist its C backdoor. Attackers install this service so the xapt payload in usr sbin restarts automatically across reboots.

Suspicious macOS LaunchDaemon Masquerading as Apple System Updater

This rule detects creation of a LaunchDaemon named com.apple.system.updater.plist which impersonates an Apple system component as used by UNC1069 for macOS persistence. Attackers register this fake daemon so their payload in Library Caches or Library OSRecovery runs at boot.

Malicious ld.so.preload Persistence Modification on Ivanti Connect Secure (via file_event)

This rule detects modification of /etc/ld.so.preload, the dynamic linker preload persistence mechanism abused during CVE-2025-22457 exploitation to auto-load the SPAWN family of implants into every process. Changes to ld.so.preload on an appliance grant stealthy systemwide code execution.

Malicious PHASEJAM Web Shell Written Into Ivanti CGI Endpoints (via file_event)

This rule detects modification of the Ivanti Connect Secure getComponent.cgi or restAuth.cgi files, into which the PHASEJAM web shell was injected during zero-day exploitation. Writes to these trusted CGI endpoints grant persistent remote command execution on the appliance.

Suspicious Registry Run Key Persistence for DeedRAT MicRun Loader (via registry_set)

This rule detects a MicRun Run key value pointing to the ProgramData Micro directory, the persistence mechanism used by DeedRAT to relaunch its side-loading binary at logon. Legitimate software does not autostart executables from this path under the name MicRun.

Malicious G DATA Avk.exe Masquerading From Public Folder via PlugX (via process_creation)

This rule detects the legitimately named G DATA Avk.exe binary executing from the Users Public GDatas directory, a masquerading and side-loading technique used to run the PlugX RAT. Genuine G DATA components run from Program Files, not the public user folder.

Suspicious Outlook Process Spawning Network Utilities for NotDoor C2 (via process_creation)

This rule detects the Outlook process spawning nslookup or curl, behavior used by the NotDoor backdoor to exfiltrate the username through DNS lookups and HTTP requests to attacker infrastructure. Outlook does not normally launch these command line network utilities.

Suspicious svchost Execution With Anomalous Arguments via DeedRAT (via process_creation)

This rule detects svchost.exe launched with an underscore-delimited uppercase argument pattern and without the standard service host -k switch, an execution anomaly produced when DeedRAT injects into svchost. Genuine svchost instances are started by services.exe with a -k service group argument.

Malicious DLL Side-Loading of Avk.dll by G DATA Binary via PlugX (via image_load)

This rule detects the G DATA Avk.exe binary loading an Avk.dll from the Users Public GDatas directory, the side-loading step that decrypts and injects the PlugX payload. Genuine G DATA installations load their DLLs from the protected Program Files location.

Malicious DLL Side-Loading via Remote Desktop Binaries for DreamLoaders (via image_load)

This rule detects the wksprt.exe or wkspbroker.exe Remote Desktop binaries loading webservices.dll or radcui.dll from outside the Windows system directories, the side-loading step used by the Lazarus DreamLoaders. These signed binaries normally load such DLLs only from System32 or WinSxS.

Malicious DLL Side-Loading of appvisvsubsystems64.dll via Cobalt Strike Loader (via image_load)

This rule detects the AppV appvisvsubsystems64.dll being loaded from the ProgramData directory by a renamed Word binary, the side-loading step that launches a Cobalt Strike beacon. The genuine appvisvsubsystems64.dll ships only inside System32.