Sigma detection rules, expert-reviewed

Malicious Silver Fox PowerShell Download Cradle via irm and iex (via process_creation)

This rule detects PowerShell combining Invoke-RestMethod with Invoke-Expression to download and directly execute remote content, the delivery cradle used by the Silver Fox ABCDoor campaign. The technique retrieves and runs backdoor code in memory following a tax themed phishing lure. Detecting the irm to iex pattern surfaces staged payload execution.

Malicious Lotus Wiper Masqueraded Binary Execution from lotus Directory (via process_creation)

This rule detects execution of the masqueraded binaries nstats.exe or nevent.exe from a lotus directory used by the Lotus Wiper to blend destructive tooling with benign looking names. The false name in an anomalous path signals staged wiper components. Detecting this execution surfaces the wiper toolset on disk.

Malicious Lotus Wiper Disk Wipe via diskpart clean all (via process_creation)

This rule detects diskpart.exe executing the clean all operation which zeroes every sector of a selected disk, a destructive action used by the Lotus Wiper against the energy and utilities sector. Full disk wiping renders systems unbootable and destroys stored data. Detecting this command identifies active destruction-of-data activity.

Malicious Registry Hive Dump for Credential Access via reg save (via process_creation)

This rule detects reg.exe saving the SAM, SECURITY or SYSTEM registry hives to disk, a credential access technique observed with AdaptixC2 operators harvesting local secrets. Exporting these hives enables offline extraction of password hashes and cached credentials. Detecting the hive save surfaces credential theft preparation on a host.

Suspicious vcpktsvr Loader Execution From LOCALAPPDATA vcpacket Directory

This rule detects execution of vcpktsvr.exe from a vcpacket directory under the user LOCALAPPDATA path. The OceanLotus ZiChatBot loader was installed to %LOCALAPPDATA%\vcpacket and launched to side-load its terminate.dll payload as documented by Kaspersky. This masqueraded service-like binary running from a user-writable folder indicates the ZiChatBot foothold.

Suspicious Python Execution of Fake Sysmon Script From Config Directory

This rule detects a Python interpreter executing a sysmon.py script from a hidden .config/sysmon directory on Linux. The LiteLLM AI gateway supply-chain implant masqueraded as a sysmon service under ~/.config/sysmon and installed systemd persistence as reported by Kaspersky. Reusing the Windows Sysmon name for a Linux Python script in a user config path is a masquerading indicator of the backdoor.

Suspicious Script Interpreter Spawned by mshta

This rule detects mshta.exe spawning a scripting interpreter such as powershell, wscript or cscript. The Horabot Sapecar infection chain used mshta to launch an HTA that pivoted through JavaScript, VBScript and PowerShell before deploying its Delphi payload as reported by Kaspersky. An mshta process creating a script host child is a strong indicator of a staged living-off-the-land execution chain.

Suspicious Process Execution From Fake Microsoft Edge ExtSvc Directory

This rule detects a process running from a %LOCALAPPDATA%\Microsoft\Edge\ExtSvc directory, a fake path that impersonates the Microsoft Edge browser folder. The CrystalX RAT installs itself under this masquerading Edge subfolder to blend with legitimate browser files as reported by Kaspersky. Execution from this non-existent Edge location indicates the spyware and stealer establishing a hidden foothold.

Suspicious Child Process Spawned by Notepad++ Updater GUP

This rule detects the Notepad++ updater GUP.exe spawning a command shell, curl or a secondary update.exe process. The Notepad++ supply chain attack abused GUP.exe to launch downstream execution chains and a Cobalt Strike loader as documented by Kaspersky. The trusted updater spawning these child processes indicates a compromised update and supply chain execution.

Suspicious Host Reconnaissance Command Chain via cmd

This rule detects a single command shell invocation chaining whoami, tasklist, systeminfo and netstat reconnaissance commands. The Notepad++ supply chain attack ran this exact recon chain and redirected the results to a file as reported by Kaspersky. Bundling these discovery commands in one shell line is a strong automated reconnaissance indicator.

Suspicious Download of Edge Login Data Stealer via curl

This rule detects curl.exe downloading a payload named getlogindataedge.exe. HoneyMyte retrieved this browser credential stealer from its command and control host to harvest Edge login data as documented by Kaspersky. Download of this specifically named stealer indicates tool ingress and credential theft preparation.

Suspicious Sang Loader Execution with Install or PassUAC Arguments

This rule detects the Sang.exe loader executing with its install, work or passuac operation arguments. HoneyMyte used Sang.exe with these command modes to install the CoolClient implant and bypass user account control as described by Kaspersky. Execution of this loader with these mode arguments indicates implant installation and privilege escalation.

Malicious Windows Defender Tampering via Command Line

This rule detects command line tampering that disables Windows Defender real time and behavior monitoring. The Webrat dropper rasmanesc.exe disabled Defender before fetching the payload from its command and control server as reported by Kaspersky. Disabling endpoint protection is a strong defense evasion indicator that typically precedes malware deployment.

Suspicious PowerShell Execution of AdobeMon Script with Bypass Policy

This rule detects PowerShell running a script named AdobeMon.ps1 with an execution policy bypass. Cloud Atlas launched an AdobeMon PowerShell payload with the bypass policy as documented by Kaspersky. The combination of the bypass flag and this specific script name indicates malicious PowerShell execution and defense evasion.

Malicious Scheduled Task Masquerading as VLC or Adobe Update

This rule detects the creation of a scheduled task named to impersonate a VLC or Adobe update task. Cloud Atlas established persistence with tasks named MicrosoftVLCTaskMachine and MicrosoftAdobeUpdateTaskMachine as reported by Kaspersky. These specific masquerading task names combined with schtasks creation indicate malicious persistence.