Sigma detection rules, expert-reviewed

Suspicious DLL Side-Loading of wbemcomn From Non-System Path

This rule detects loading of wbemcomn.dll from a directory outside the Windows system folders, indicating DLL side-loading. In CVE-2025-31324 SAP NetWeaver intrusions a planted wbemcomn.dll was side-loaded by svchost to run a Cobalt Strike beacon. Because the legitimate library lives only in system directories, execution from other paths is a strong compromise signal.

Malicious ESXi Virtual Machine Termination and Snapshot Removal

This rule detects ESXi command-line activity that force-kills running virtual machines or removes all snapshots, the hypervisor sabotage Qilin ransomware performed via esxcli and vim-cmd before encryption. Mass termination of VMs and snapshot deletion inhibits recovery and is characteristic of ransomware targeting virtualized infrastructure.

Malicious Veeam Credential Theft via PowerShell (via ps_script)

This rule detects a PowerShell script that decrypts stored Veeam Backup and Replication credentials using the ProtectedData Unprotect method against the Veeam database. Fog ransomware operators ran a Veeam-Get-Creds script to harvest backup infrastructure credentials.

Obfuscated Base64-Decoded Payload Piped to a Shell (via process_creation)

This rule detects a base64 decode operation piped directly into bash, sh or eval, a one-liner adversaries use to reconstruct and immediately run an obfuscated payload on Linux. Base64 deobfuscation into a shell is a defense-evasion and execution technique in the Red Canary Threat Detection Report. Detecting the decode-and-execute chain surfaces hidden command execution as it runs.

Suspicious Fog Ransomware File Artifacts (via file_event)

This rule detects creation of the Fog ransomware DbgLog.sys operational log or files bearing the .fog and .flocked encrypted extensions. These artifacts are dropped during Fog ransomware encryption on compromised hosts.

SwimSnake Driver Execution Persistence via Session Manager PlatformExecute (via registry_set)

This rule detects writes to the Session Manager PlatformExecute registry value, an unusual boot-time execution key the fake FinalShell SwimSnake campaign abuses to trigger a released driver (BEB.exe) for security-software tampering. Adversaries plant execution entries under Session Manager to run code very early and outside common autostart monitoring, making early detection critical for catching driver-based defense evasion before shellcode injection into explorer.exe.

FireWood Backdoor Persistence Files in Hidden kde-root Directory (via file_event)

This rule detects creation of the FireWood backdoor working files inside a hidden .kde-root directory, where the Linux implant stores its loader and PID artifacts under either a system library path or a user home directory. The masquerade as KDE runtime files combined with the hidden directory reflects the backdoor establishing itself on the host.

Suspicious Scheduled Task Creation for Efimer Controller (via process_creation)

This rule detects schtasks.exe registering a task that references controller.xml the scheduled-task definition used by the Efimer Trojan for persistence. Efimer establishes a recurring task to keep its clipboard clipper and Tor-based command channel running. A task built from an XML file named controller in user-writable space is an indicator of this infection.

Obfuscated Certutil Payload Download - Command (via process_creation)

This rule detects abuse certutil command to download obfuscated malicious payload.

Suspicious TransferLoader Configuration Storage in Phone Config Registry Key (via registry_set)

This rule detects creation of registry values under the Windows Phone Config key that TransferLoader abuses to store its C2 server, sleep timeout, encryption key and in-memory PE payload. Legitimate software rarely writes rmi, to, id or md values under this path.

Malicious OilRig Solar and Mango C2 URI Pattern via Proxy (via proxy)

This rule detects outbound HTTP requests matching the Solar and Mango command-and-control URI pattern used by OilRig, where template.aspx is queried with the rt=d and sun= parameters. This structured URI encodes tasking and exfiltration for the group's downloaders and marks active C2 traffic.

Suspicious Discovery Command Spawned by Java Process

This rule detects the Cleo Java runtime spawning Windows discovery utilities such as nltest, whoami, and ipconfig, the hands-on-keyboard reconnaissance seen after exploitation of Cleo file transfer software and the Malichus malware. A Java service process launching domain and host enumeration is not part of normal operation. This lineage indicates active post-exploitation of an internet-facing Cleo server.

Suspicious Persistence via pcalua Launching rundll32 Control_RunDLL

This rule detects the Program Compatibility Assistant pcalua being abused to launch rundll32 with the Control_RunDLL export against a user profile DLL. RedCurl uses this scheduled task chain to persist its BrowserSpec loader while masking the parent process.

Possible Log4Shell JNDI Exploitation Attempt in Web Request

This rule detects Log4Shell (CVE-2021-44228) exploitation strings such as JNDI LDAP/RMI/DNS lookups and Log4j lookup obfuscation appearing in web request URIs and User-Agent headers. Attackers embed these expressions to force vulnerable Log4j2 loggers into resolving attacker-controlled JNDI references, leading to remote code execution.

Malicious Lazarus SIGNBT DLL Side-Loading via PCHealthCheck Host (via image_load)

This rule detects the Microsoft PC Health Check binary PCHealthCheck.exe loading a PCHealthCheck.dll from outside standard program directories, the DLL side-loading technique the Lazarus SIGNBT cluster uses to execute malicious code under a signed utility. Restricting to non-program paths separates the abuse from the legitimately installed application.