Sigma detection rules, expert-reviewed

Suspicious Contagious Interview Disk Enumeration via Node Spawning Wmic

This rule detects a Node.js or npm process spawning wmic to enumerate logical disks which the North Korean Contagious Interview malware runs for host reconnaissance after a fake coding challenge executes. Developer-tooling parents launching WMI discovery is anomalous and marks the malicious interview package. It reveals early victim profiling before credential theft.

Malicious Regsvr32 Executing DLL From Windows Temp

This rule detects regsvr32.exe registering or executing a DLL located in the Windows Temp directory which the ALPHV intrusion used after a VBS dropper wrote a payload there and this matters because regsvr32 loading a DLL from Temp is a common proxy execution and squiblydoo style evasion pattern that legitimate software does not exhibit.

Suspicious Process Memory Read from Proc Mem for Secret Extraction

This rule detects a command that reads another process memory through the proc mem pseudo-file, a technique malicious npm packages use to scrape OIDC tokens and other in-memory secrets from CI runners. This vector appears in the npm supply chain attacks tracked by Unit 42. Detecting direct proc mem reads exposes runtime credential theft that never touches disk.

Masquerading Exchange Server Impersonation via PrivExchange Relay Attack (via security)

This rule detects relays Exchange server authentication to abuse Exchange servers permissions and escalate privileges.

Suspicious Access to Cloud and Database Credential Files via Process

This rule detects command lines reading AWS credential and PostgreSQL password files that an LLM-driven attacker harvested after gaining marimo RCE to pivot toward an internal database. Reading these unattended credential stores is a common post-exploitation credential-access step. Access outside of expected tooling indicates credential theft in progress.

Suspicious Inline node.exe Command Executing Network and Process Spawning Code

This rule detects node.exe invoked with inline evaluated code that references network, command execution, and filesystem modules such as http, execSync, spawn, fs, and zlib. Microsoft attributed this pattern to Node.js malware that downloads and runs additional payloads directly from the command line. Inline module chaining lets the attacker fetch and execute code without dropping a script file, making it a strong indicator of malicious activity.

SilentMare Loader C2 Beacon via Custom GatewayClient User-Agent (via proxy)

This rule detects outbound HTTP requests carrying the hardcoded GatewayClient and Metrics User-Agent strings used by the SilentMare and HollowMare trojan families distributed through Google Search ads. These custom agents identify updater check-ins that pull AES-encrypted .NET payloads from attacker infrastructure, making them a reliable network fingerprint for the loader stage.

Malicious Remote Shell Execution via SMB Admin Share (via security)

This rule detects execute a remote shell via the admin share.

Suspicious DUser DLL Sideloading by credwiz via Image Load

This rule detects the Credential Wizard binary or its renamed variants loading DUser.dll from outside the System32 directory, the DLL side-loading technique Secret Blizzard used to launch its TwoDash and related backdoors. A signed host binary loading a same-named DLL from a non-system path is a hallmark of side-loading based execution.

Suspicious Denied RDP Login with Valid Credentials (via security)

This rule detects tries to move laterally using RDP and access attempt is blocked due to restricted logon policies.

Malicious BitLocker Abuse for Ransomware via PowerShell (via ps_script)

This rule detects PowerShell that enables BitLocker while removing the key protectors which the ShrinkLocker ransomware does to encrypt drives and lock out the legitimate owner without leaving a recovery key.

Malicious WinGUP Updater Sideloading libcurl via gup.exe (via image_load)

This rule detects the WinGUP updater gup.exe loading a libcurl.dll from outside its normal install directories. The BoryptGrab-lineage infostealer distributed through fake GitHub repositories abused this signed updater to sideload its malicious loader DLL from user-writable paths.

Suspicious Masqueraded Windows Update Python Script Execution

This rule detects the Python interpreter executing a script masquerading as a Windows update named Windows Update Script.pyw, as dropped by the DeceptiveDevelopment ClickFix chain alongside drvUpdate.exe. The naming disguises attacker code as a benign system task, so catching the interpreter launching this file exposes the initial foothold.

Suspicious GoGRPC Screen Capture Log File Creation (via file_event)

This rule detects creation of the appscreen.log artifact under the ProgramData appscreen directory that the GoGRPC backdoor writes while capturing screen data. This specific path and filename combination is unique to the malware.

Malicious Defender Exclusion Added via Add-MpPreference During Medusa Intrusion (via process_creation)

This rule detects PowerShell adding a Microsoft Defender path exclusion via Add-MpPreference, a defense-evasion step Storm-1175 uses to carve out an excluded location such as the C drive root before staging tools during Medusa ransomware operations. Adversaries blind Defender in this way to run payloads without detection, so an exclusion added from the command line ahead of impact is a high-confidence sign of an active intrusion.