Sigma detection rules, expert-reviewed

Malicious TeamPCP durabletask Payload python3 managed.pyz from tmp (via process_creation)

This rule detects execution of python3 against /tmp/managed.pyz which is the primary payload dropped by the trojanized durabletask PyPI releases from the TeamPCP campaign. Running a zipapp from /tmp under python3 in this exact form indicates the supply-chain implant is active and harvesting cloud and Kubernetes credentials.

Suspicious DLL Load from Public Directory by svchost (via image_load)

This rule detects svchost.exe loading a DLL from the C:\Users\Public staging directory, an abnormal side-loading pattern used by the Ashen Lepus AshTag suite with modules such as netutils.dll and wtsapi32.dll. Legitimate svchost service DLLs load from System32, so a load out of a world-writable staging path indicates side-loaded malware.

In-Memory AMSI Bypass via amsiInitFailed Field Manipulation in PowerShell (via ps_script)

This rule detects a PowerShell script block that sets the amsiInitFailed field to True, the in-memory AMSI bypass used by the agent1.ps1 stage of an Azorult campaign smuggled through Google Sites. Forcing amsiInitFailed disables Antimalware Scan Interface inspection so later stages run unscanned, making this a high-confidence defense-evasion signal.

Suspicious Outbound Firewall Block Rule Added via Netsh Advfirewall

This rule detects netsh advfirewall being used to add a rule that blocks outbound traffic, a technique observed in the ESXi intrusion to sever host communication with external security or management services. Attackers block outbound connections to prevent EDR telemetry and updates from reaching the network. An added block rule targeting outbound direction on a server is an atypical administrative action worth reviewing.

Suspicious CTFMON Masqueraded Binary Execution (via process_creation)

This rule detects execution of CTFM0N.exe, a filename crafted to impersonate the legitimate Windows ctfmon.exe by replacing the letter O with a zero. SugarGh0st deployed this binary as its persistent RAT component.

Suspicious Cisco ASA WebVPN Login Scanning with Spoofed Chrome User-Agent

This rule detects inbound requests to Cisco ASA web login endpoints /+CSCOE+/logon.html and /+webvpn+/index.html that carry the single spoofed browser identifier Chrome/102.0.5005.63 used across a coordinated scanning botnet. The activity mapped a surge of 25,000 IPs probing Cisco ASA devices, frequently a precursor to a newly disclosed vulnerability being weaponized for initial access.

Malicious Volume Shadow Copy Deletion via Vssadmin

This rule detects vssadmin deleting all volume shadow copies which the actors in the Sliver and PoshC2 toolkit intrusion ran to inhibit recovery ahead of impact and this matters because deleting every shadow copy removes the primary local restore path and is a defining pre encryption ransomware action rarely performed by legitimate administrators.

Suspicious Flax Typhoon System Utility Masquerade Outside System32 via Renamed VPN Client (via process_creation)

This rule detects processes named conhost.exe or dllhost.exe executing from a directory other than the Windows system folders. Flax Typhoon renamed the SoftEther VPN client to these trusted binary names to blend in while tunneling traffic over TCP 443 for covert remote access.

Suspicious dllhost.exe Spawned with CLSID and Anomalous Parent (via process_creation)

This rule detects dllhost.exe running with a GUID/CLSID on its command line while not being parented by svchost.exe. Medusa ransomware leverages a COM elevation moniker so that dllhost hosts a malicious auto-approved COM object, and the abnormal parent process reveals the UAC bypass rather than legitimate COM surrogate activity.

Malicious ms-settings DelegateExecute UAC Bypass Registry Change

This rule detects creation of the ms-settings Shell Open command key together with the DelegateExecute value which is the registry state used to bypass UAC through computerdefaults.exe. The Batavia spyware abuses this technique to elevate silently before stealing data from Russian organizations. Writes to this ms-settings hijack path are almost always malicious.

Malicious KB Document Masqueraded Executable Spawned by Script Interpreter via RoKRAT Loader (via process_creation)

This rule detects execution of an executable named to impersonate a Windows KB update document such as KB400928_doc.exe when launched by cmd.exe or powershell.exe, as seen in the APT37 ToyBox Story cmd to powershell to payload chain delivering RoKRAT. The KB prefix with a _doc.exe suffix masquerades the payload as a benign document while it runs as a program. Catching this masqueraded binary being spawned by a script interpreter exposes the final loader execution stage.

Malicious aspnet_compiler.exe Injection Host Spawned by PowerShell via process_creation

This rule detects the .NET build utility aspnet_compiler.exe being launched by PowerShell, the process-injection host abused by the multi-stage Phantom Stealer campaign to run reflectively loaded payload code. Spawning the signed compiler from a scripting engine is a wrong-context indicator that the stealer is hollowing a trusted binary to evade detection, exposing the injection before credential theft and SMTP exfiltration.

Suspicious Windows Subsystem for Linux (WSL) Package Turned on - Native (via setup)

This rule detects enables the WSL to cary out malicious activities in a virtual instance to avoid detection.

Malicious Akira Ransomware Encrypted File Extension via File Event

This rule detects files being renamed with the .akira extension appended during encryption by Akira ransomware. Mass creation of .akira files indicates active encryption of the host.

Suspicious Contagious Interview Disk Enumeration via Node Spawning Wmic

This rule detects a Node.js or npm process spawning wmic to enumerate logical disks which the North Korean Contagious Interview malware runs for host reconnaissance after a fake coding challenge executes. Developer-tooling parents launching WMI discovery is anomalous and marks the malicious interview package. It reveals early victim profiling before credential theft.