Sigma detection rules, expert-reviewed

Suspicious Microsoft Office Test Persistence Key Creation (via registry_set)

This rule detects creation or modification of the Office test Special Perf registry value which forces Microsoft Office applications to load an arbitrary DLL at startup. This rarely used key gives adversaries stealthy persistence through trusted Office processes.

Suspicious Boot Verification Program Persistence via Registry (via registry_set)

This rule detects modification of the BootVerificationProgram ImagePath registry value which the Service Control Manager launches at boot instead of the default boot verification routine. Adversaries abuse this rarely used key to gain SYSTEM level persistence that survives reboots.

Malicious Empyrean Stealer Staging Files in AppData (via file_event)

This rule detects creation of Empyrean stealer staging files such as run.bat and dat.txt inside an empyrean folder under AppData. The malware writes its batch runner and collected system data to this directory before exfiltration over Discord.

Suspicious COM Hijack of ClickOnce Deployment Service CLSID (via registry_set)

This rule detects hijacking of the ClickOnce deployment service COM object by registering a LocalServer32 or InprocServer32 handler under its CLSID in the current user hive. Attackers point this CLSID at an attacker-controlled executable or DLL so that dfsvc activation launches their code. Per-user registration of this specific CLSID is a strong COM-hijack indicator.

Suspicious SCATTERED SPIDER Chisel Tunnel to Cloudflare Quick Tunnel (via process_creation)

This rule detects a Chisel client establishing a tunnel through a Cloudflare quick tunnel subdomain. SCATTERED SPIDER configured Chisel with trycloudflare subdomains to proxy traffic and maintain covert remote access. The combination of a client tunnel argument and the trycloudflare host is a strong indicator of protocol tunneling.

Suspicious LLMNR and NBT-NS Poisoning Tooling via ALPHA SPIDER (via process_creation)

This rule detects execution of Responder or mitm6, tools used to poison LLMNR, NBT-NS, and IPv6 name resolution. ALPHA SPIDER deployed these utilities to coerce authentication and capture credentials on internal networks. Their presence on production hosts is a strong credential-access indicator.

Suspicious ALPHA SPIDER Veeam Backup Credential Extraction (via process_creation)

This rule detects extraction of stored credentials from Veeam backup infrastructure. ALPHA SPIDER decrypted Veeam.Backup.Common.dll secrets and ran a Veeam credential recovery script over WinRM to harvest privileged accounts. References to the Veeam credential script or backup DLL decryption in a command line indicate credential access.

Suspicious ALPHA SPIDER Rclone Exfiltration Tool Masquerading as System Binary (via process_creation)

This rule detects the Rclone data-transfer utility executing under a renamed file name. ALPHA SPIDER renamed rclone to svchost.exe and to a misspelled cloud-software name to blend exfiltration traffic with normal activity. A process whose original file name is rclone but whose on-disk name differs indicates masquerading for exfiltration.

Suspicious COOKIE SPIDER LaunchDaemon Persistence via com.finder.helper Property List (via file_event)

This rule detects creation of the com.finder.helper property list used for persistence on macOS. The SHAMOS stealer writes this plist into the LaunchDaemons directory so the payload re-executes across reboots. This masqueraded property list name is a specific persistence indicator.

Suspicious Vulnerable Intel Ethernet Driver Load for BYOVD via SCATTERED SPIDER (via driver_load)

This rule detects loading of the vulnerable Intel Ethernet diagnostics driver iqvw64.sys. SCATTERED SPIDER abused this signed driver via a bring-your-own-vulnerable-driver technique to disable endpoint security products including CrowdStrike, Microsoft Defender, SentinelOne, and Cortex XDR. Loading of this rarely used driver on production hosts is suspicious.

Malicious HarborWatch RAT Command and Control Beacon by User Agent (via proxy)

This rule detects outbound HTTP requests carrying the HarborWatchAgent user agent string used by the custom monitoring RAT delivered through a fake Amazon ClickFix lure. This hardcoded agent value is specific to the malware and should not appear in normal traffic.

Suspicious Remote Script Transfer via Bitsadmin (via process_creation)

This rule detects bitsadmin.exe transferring a Windows Script Host file, matching the WebDAV delivery chain that uses a bitsadmin transfer job to stage a wsh payload into the temp directory before execution. Administrative bitsadmin usage rarely targets script files.

Suspicious MSHTA Execution Spawned by Browser or Document Reader via Mispadu (via process_creation)

This rule detects mshta.exe launched by a web browser, PDF reader or mail client, matching the Mispadu delivery chain that moves from an attached PDF to a remotely hosted HTA file. These parent to child relationships are not part of normal document viewing.

Suspicious PowerShell Download Cradle via ClickFix Fake CAPTCHA (via process_creation)

This rule detects a PowerShell download cradle where Invoke-WebRequest output is piped directly into Invoke-Expression, a pattern used by ClickFix fake CAPTCHA lures to fetch and execute remote script payloads. This exact one-liner is rarely produced by legitimate administration.

Malicious AquaShell Webshell Access on Cisco Secure Email Gateway by UAT-9686

This rule detects HTTP POST requests to the AquaShell Python webshell planted at the euq_webui index.py endpoint on Cisco Secure Email appliances. UAT-9686 uses this unauthenticated webshell to execute arbitrary commands on compromised gateways. Requests to this appliance path indicate active exploitation and remote command execution.