Sigma detection rules, expert-reviewed

Malicious DBatLoader DLL Sideloading via easinvoker.exe Loading netutils.dll (via image_load)

This rule detects the auto-elevating binary easinvoker.exe loading a netutils.dll from outside System32, the DLL hijacking and UAC bypass chain DBatLoader uses to run malicious code with elevated privileges. Adversaries place the legitimate signed executable alongside a rogue netutils.dll to inherit auto-elevation, making early detection critical for catching privilege escalation before injection into SndVol.exe or iexpress.exe.

Malicious JSP Webshell Deployment in Ivanti EPMM Tomcat (via file_event)

This rule detects creation of JSP files under the Ivanti EPMM Tomcat mifs webapps directory, where exploitation of CVE-2026-1281 and CVE-2026-1340 plants webshells such as 401.jsp and 403.jsp. A webshell in this application path gives attackers persistent authenticated command execution on the appliance.

Malicious EtherRAT SSH authorized_keys Backdoor Injection via Shell (via process_creation)

This rule detects the injection of an SSH public key carrying the root@vps identifier into an authorized_keys file on Linux hosts. This activity is performed by the EtherRAT React2Shell implant to establish persistent root access over SSH. Writing an attacker controlled key into authorized_keys grants durable remote access and should be treated as a compromise.

Malicious DEVMAN Ransomware Encrypted File and Note Artifacts

This rule detects files encrypted by DEVMAN ransomware, identified by the .DEVMAN extension and the deterministically renamed ransom note e47qfsnz2trbkhnt.devman. DEVMAN is a DragonForce variant that encrypts its own note, producing this fixed filename.

Malicious TeamPCP systemd User Unit Dropper via sysmon.py Persistence (via file_event)

This rule detects creation of a Python dropper named sysmon.py inside the per-user systemd unit directory which the TeamPCP compromise of Trivy writes on developer machines to gain persistent execution. The dropper polls an attacker C2 and downloads a follow-on payload so its presence indicates an active supply-chain implant that harvests cloud and SSH credentials.

Malicious TeamPCP durabletask Payload python3 managed.pyz from tmp (via process_creation)

This rule detects execution of python3 against /tmp/managed.pyz which is the primary payload dropped by the trojanized durabletask PyPI releases from the TeamPCP campaign. Running a zipapp from /tmp under python3 in this exact form indicates the supply-chain implant is active and harvesting cloud and Kubernetes credentials.

Suspicious DLL Load from Public Directory by svchost (via image_load)

This rule detects svchost.exe loading a DLL from the C:\Users\Public staging directory, an abnormal side-loading pattern used by the Ashen Lepus AshTag suite with modules such as netutils.dll and wtsapi32.dll. Legitimate svchost service DLLs load from System32, so a load out of a world-writable staging path indicates side-loaded malware.

In-Memory AMSI Bypass via amsiInitFailed Field Manipulation in PowerShell (via ps_script)

This rule detects a PowerShell script block that sets the amsiInitFailed field to True, the in-memory AMSI bypass used by the agent1.ps1 stage of an Azorult campaign smuggled through Google Sites. Forcing amsiInitFailed disables Antimalware Scan Interface inspection so later stages run unscanned, making this a high-confidence defense-evasion signal.

Suspicious CTFMON Masqueraded Binary Execution (via process_creation)

This rule detects execution of CTFM0N.exe, a filename crafted to impersonate the legitimate Windows ctfmon.exe by replacing the letter O with a zero. SugarGh0st deployed this binary as its persistent RAT component.

Malicious Volume Shadow Copy Deletion via Vssadmin

This rule detects vssadmin deleting all volume shadow copies which the actors in the Sliver and PoshC2 toolkit intrusion ran to inhibit recovery ahead of impact and this matters because deleting every shadow copy removes the primary local restore path and is a defining pre encryption ransomware action rarely performed by legitimate administrators.

Malicious ms-settings DelegateExecute UAC Bypass Registry Change

This rule detects creation of the ms-settings Shell Open command key together with the DelegateExecute value which is the registry state used to bypass UAC through computerdefaults.exe. The Batavia spyware abuses this technique to elevate silently before stealing data from Russian organizations. Writes to this ms-settings hijack path are almost always malicious.

Malicious KB Document Masqueraded Executable Spawned by Script Interpreter via RoKRAT Loader (via process_creation)

This rule detects execution of an executable named to impersonate a Windows KB update document such as KB400928_doc.exe when launched by cmd.exe or powershell.exe, as seen in the APT37 ToyBox Story cmd to powershell to payload chain delivering RoKRAT. The KB prefix with a _doc.exe suffix masquerades the payload as a benign document while it runs as a program. Catching this masqueraded binary being spawned by a script interpreter exposes the final loader execution stage.

Malicious aspnet_compiler.exe Injection Host Spawned by PowerShell via process_creation

This rule detects the .NET build utility aspnet_compiler.exe being launched by PowerShell, the process-injection host abused by the multi-stage Phantom Stealer campaign to run reflectively loaded payload code. Spawning the signed compiler from a scripting engine is a wrong-context indicator that the stealer is hollowing a trusted binary to evade detection, exposing the injection before credential theft and SMTP exfiltration.

Malicious Akira Ransomware Encrypted File Extension via File Event

This rule detects files being renamed with the .akira extension appended during encryption by Akira ransomware. Mass creation of .akira files indicates active encryption of the host.

Malicious Regsvr32 Executing DLL From Windows Temp

This rule detects regsvr32.exe registering or executing a DLL located in the Windows Temp directory which the ALPHV intrusion used after a VBS dropper wrote a payload there and this matters because regsvr32 loading a DLL from Temp is a common proxy execution and squiblydoo style evasion pattern that legitimate software does not exhibit.