Sigma detection rules, expert-reviewed

Malicious Run Key Persistence Masquerading as VCRuntime or Edge Update

This rule detects Run key persistence values named VCRuntineSync or EdgeCriticalUpdateService. The Horns and Hooves campaign used these fake autorun entries, including the misspelled VCRuntineSync, to relaunch the NetSupport client at logon while imitating legitimate software.

Malicious Microsoft Defender Disable via Registry by Key Group

This rule detects registry modifications that disable Microsoft Defender antispyware or real-time monitoring, a tamper action Key Group ransomware uses to blind endpoint protection before encryption. Setting these policy values to enabled-disable is a hallmark of ransomware pre-encryption defense evasion.

Malicious Head Mare Run Key Persistence Masquerading as MicrosoftUpdate

This rule detects a Run key named MicrosoftUpdateCore or MicrosoftUpdateCoree pointing to srvhost.exe, the persistence and masquerading technique used by the Head Mare group. The combination of a legitimate-looking update name with a srvhost.exe payload that impersonates svchost is a strong indicator of the group's foothold.

Malicious Coyote Persistence via UserInitMprLogonScript Environment Value (via registry_set)

This rule detects a write to the HKCU\Environment\UserInitMprLogonScript registry value pointing at an executable. The Coyote banking trojan sets this logon-script value to run obs-browser-page.exe at each user logon for persistence, so modification of this rarely-used key indicates a logon-script persistence mechanism being installed.

Suspicious HrServ Registry Command Channel under IdentityStore RemoteFile (via registry_set)

This rule detects writes to the HKLM\SOFTWARE\Microsoft\IdentityStore\RemoteFile registry value. The HrServ web shell abuses this uncommon key as a covert channel to stage and exchange data, so modification of this specific path indicates the implant storing operator content in the registry.

Malicious ServiceDll Hijack Of FontCacheSvc via Registry Set

This rule detects the ServiceDll value of the Font Cache service being pointed at apibridge.dll. ToddyCat hijacks the svchost-hosted FontCacheSvc service to load its malicious apibridge.dll for stealthy persistence, masquerading as a legitimate system service.

Suspicious SOCKS Proxy Autorun Registry Persistence via Registry Set

This rule detects a Run key persistence entry whose value references a SOCKS5 proxy component or the PerfLogs staging path. SystemBC establishes a SOCKS5 proxy for command-and-control and anchors it via an autorun registry value, combining persistence with proxy-based C2 tunneling.

Suspicious Process Made Critical via RtlSetProcessIsCritical (via ps_script)

This rule detects PowerShell invoking RtlSetProcessIsCritical to mark a process as critical as done by VenomRAT in the RevengeHotels campaign. Flagging a process critical causes the system to bugcheck if it is terminated which frustrates analyst attempts to kill the implant. This anti-analysis call is not used by normal PowerShell workloads.

Malicious Defender Exclusion Added for User Profile Path

This rule detects PowerShell using Add-MpPreference to add a Microsoft Defender exclusion covering the user profile directory which BrowserVenom uses to shield its staged payload from scanning. Excluding a broad writable path like the user profile is a common evasion before dropping the next stage. This weakening of Defender coverage is rarely legitimate on endpoints.

Malicious Active Directory ACL Manipulation via PowerView

This rule detects PowerView functions that grant domain object permissions or add members to privileged groups. The Twelve group abused Add-DomainObjectAcl and Add-DomainGroupMember to escalate privileges and establish persistence in Active Directory, which enables long-term domain control.

Suspicious Scheduled Task Enumeration for User_Feed_Sync via PowerShell (via ps_script)

This rule detects PowerShell enumerating scheduled tasks matching the User_Feed_Sync name pattern which the DuneQuixote campaign uses to locate its CR4T implant persistence task on compromised Middle Eastern government systems.

Malicious SessionGopher Credential Extraction via PowerShell (via ps_script)

This rule detects invocation of the SessionGopher tool through PowerShell which LockBit builder-based ransomware operators use to extract saved session credentials from PuTTY WinSCP and RDP prior to lateral movement and encryption.

Malicious FakeWallet Crypto Stealer C2 via Rsakey Endpoints (via proxy)

This rule detects requests to the FakeWallet server endpoints containing the distinctive Rsakeycatch and Rsakeyword paths used by the iOS crypto stealer to exfiltrate wallet data. FakeWallet spread through App Store applications to harvest cryptocurrency wallet secrets. Detecting these fixed endpoint paths exposes active data exfiltration to attacker infrastructure.

Malicious AdaptixC2 Beacon via X-Beacon-Id Header and Default User Agent (via proxy)

This rule detects HTTP traffic carrying the AdaptixC2 specific X-Beacon-Id header or the framework default Firefox 20.0 user agent string. AdaptixC2 is a post-exploitation command-and-control framework used for beaconing and tunneling. Detecting either the custom header or the anachronistic user agent exposes agent check-ins to an AdaptixC2 listener.

Possible JanelaRAT C2 Beacon via Structured HTTP Query (via proxy)

This rule detects outbound HTTP requests carrying the structured beacon query parameters VS, PL and AN that JanelaRAT appends when checking in to its command-and-control server. This behavior is associated with the JanelaRAT financial trojan operating over daily-rotating dynamic DNS infrastructure in Latin America. Identifying the fixed parameter layout reveals active C2 communication independent of the rotating domain.