Sigma detection rules, expert-reviewed

Suspicious Loading of Masqueraded EndpointDlp.dll Backdoor

This rule detects loading of a DLL named EndpointDlp.dll, which is Backdoor.Mistic masquerading as a Microsoft data loss prevention component. It is sideloaded through the legitimate MpExtMs.exe to gain covert execution.

Suspicious SentinelOne Binary Sideloading sentinelagentcore.dll

This rule detects sentinelmemoryscanner.exe loading a sentinelagentcore.dll from its directory, a DLL sideloading pair abused by Seedworm to run the ChromElevator credential tool under the guise of a security product.

Suspicious Trend Micro Binary Sideloading tmdglog.dll

This rule detects the legitimate Trend Micro tmdbglog.exe loading a malicious tmdglog.dll from its directory. Billbug used this DLL sideloading chain to run the Sagerunex backdoor in Southeast Asian espionage intrusions.

Possible Backdoor Mistic Command and Control Domain Lookup

This rule detects DNS lookups for update-themed command and control domains used by Backdoor.Mistic and the associated ModeloRAT intrusion set. The names impersonate software update services to blend with normal traffic.

Possible PlugX and NPS Proxy Command and Control Domain Lookup

This rule detects DNS lookups for domains used as command and control by a PlugX variant and an NPS proxy tool in a China-linked espionage and ransomware intrusion. The typosquatted jetbrians domain impersonates JetBrains.

Malicious SharePoint ToolShell Post-Exploitation via Encoded PowerShell (via process_creation)

This rule detects the SharePoint IIS worker process w3wp.exe spawning PowerShell with an encoded command argument. Following exploitation of the ToolShell vulnerabilities CVE-2025-49704 and CVE-2025-49706, attackers executed encoded PowerShell from the web service context to steal machine keys and deploy web shells. This parent child chain rarely occurs during normal SharePoint operation.

Malicious Unsigned VIB Installation on ESXi Host via esxcli (via process_creation)

This rule detects installation of a VMware Installation Bundle on an ESXi host with signature verification bypassed through a forced or no signature check flag. Fire Ant deployed malicious unsigned VIB packages with a lowered acceptance level to gain persistence beneath the hypervisor. Forcing unsigned package installation is rarely part of legitimate ESXi maintenance.

Malicious Web Server Process Spawning Command Interpreter via Web Shell (via process_creation)

This rule detects IIS or Java web server worker processes spawning a command interpreter or reconnaissance utility. Weaver Ant operated web shells on internet facing servers and executed living off the land commands directly from the web service context, a chain that is uncommon during normal web application activity.

Suspicious In-Memory PowerShell Execution from Web Server via Automation Assembly (via image_load)

This rule detects an IIS worker process loading the System Management Automation assembly, which enables PowerShell execution without launching powershell.exe. Weaver Ant used this technique from a web shell to run PowerShell in memory while evading process based detection. Web server worker processes do not normally load this assembly.

Malicious Velvet Ant Linux Backdoor and Credential Harvesting Artifacts (via file_event)

This rule detects creation of file artifacts tied to the Velvet Ant Operation Highland intrusion, including a renamed GS-Netcat backdoor and hidden logs written by backdoored SSH and PAM components to store harvested credentials and keystrokes. These specific paths are not part of a standard Linux installation.

Malicious Web Shell Written to SharePoint LAYOUTS Directory by Worker Process (via file_event)

This rule detects the SharePoint IIS worker process writing an ASPX file into the LAYOUTS template directory. ToolShell exploitation dropped web shells such as spinstall0.aspx into this path to steal ASP.NET machine keys and maintain credential less access. Web shell files are not created here during normal SharePoint use.

Malicious Fire Ant Hypervisor Backdoor Artifacts on ESXi and vCenter (via file_event)

This rule detects creation of file artifacts associated with Fire Ant persistence on ESXi and vCenter systems, including a Python HTTP backdoor and a listening implant along with extracted trust certificates. These specific paths correspond to backdoors deployed beneath the hypervisor to maintain covert access and are not part of a standard VMware installation.

Malicious Abyss Locker wmihelper SSH Backdoor Deployment (via file_event)

This rule detects creation of the Abyss Locker persistence backdoor, an SSH client wrapped as a service under the Microsoft WMI application data directory together with its private key and service configuration. The actor installed this component as a service named WMI Helper Agent using a service wrapper to maintain covert reverse tunnel access. These paths are not associated with legitimate WMI functionality.

Malicious GS-Netcat Command and Control via Global Socket Relay Network (via dns_query)

This rule detects DNS resolution of the Global Socket Relay Network domain used by the GS-Netcat backdoor. In Operation Highland the Velvet Ant actor deployed GS-Netcat configured to reach single character subdomains of the relay network for reverse shell access. Resolution of this domain on servers is not expected in enterprise environments.

Malicious NodeSnake RAT Persistence via Scheduled Task and Node.js (via process_creation)

This rule detects the creation of a scheduled task that launches a portable Node.js runtime from a Roaming AppData node directory to execute the NodeSnake remote access trojan payload disguised as a log file. The Interlock operator hid this task under a Windows Defrag path so that the malicious JavaScript payload runs persistently.