Sigma detection rules, expert-reviewed

Suspicious Execution of agent.exe From WinSyncDefender AppData Directory (via process_creation)

This rule detects execution of agent.exe from the Microsoft WinSyncDefender folder under AppData Roaming, the staging path used by Operation ShadowRecruit to host its SheetAgent RAT payload. Running a generically named binary from a fake Microsoft directory in a user-writable location is a wrong-context indicator of the recruitment-themed campaign against Indian job seekers, exposing the malware between delivery and Google Sheets C2.

Suspicious Hidden PowerShell Downloading Payload via ClickFix (via process_creation)

This rule detects PowerShell launched with a hidden window that immediately downloads and executes remote content. The ClearFake ClickFix lure tricks users into pasting a mixed-case PowerShell command that runs with a suppressed window to fetch its next stage. A hidden PowerShell window combined with download and execution cmdlets is characteristic of ClickFix social engineering.

Suspicious Double Extension docx Executable Execution (via process_creation)

This rule detects execution of a binary whose filename carries a double extension combining a document extension and padded spaces before .exe, the lure delivery technique used by Kimsuky against Japanese organizations. The masqueraded filename is designed to trick users into launching an executable they believe is a Word document.

Malicious DLL Side-Loading of vcomp100 via converter.exe

This rule detects the ImageMagick converter.exe loading vcomp100.dll from outside the Windows system directories. The IDAT loader chain delivering Vidar and ACR stealers abused this signed binary to side-load a malicious vcomp100.dll and execute stager code under a trusted process.

In-Memory Remcos RAT Keylog Store Created Under ProgramData rema (via file_event)

This rule detects creation of the logs.dat file inside the ProgramData rema directory, the local store used by this Remcos RAT variant to buffer keystroke and clipboard capture before exfiltration. Adversaries leverage this staging file to accumulate stolen input on disk, making detection of the fixed path a useful indicator of active collection.

DLL Side-Loading of NvSmartMax via NvSmart Host Process

This rule detects the nvSmartEx.exe host loading NvSmartMax.dll from outside the legitimate NVIDIA program directory, the DLL side-loading pair used by DeadRinger actors to run implant code. A trusted NVIDIA binary loading its companion DLL from an unexpected path indicates search-order hijacking.

Malicious Microsoft Defender Default Action Changed to Allow Any Threat - Command (via process_creation)

This rule detects change Defender default action to allow any threats.

Malicious DNS Hosts File Accessed via Network Share (via security)

This rule detects attempt read the Hosts file content via network share.

Malicious Akira Ransomware Execution via Encryption Command-Line Parameters

This rule detects process execution using the distinctive encryption command-line parameters of the Akira ransomware encryptor, matching intrusions where a renamed akira.exe is run against mounted network shares. The switches control encryption scope and percentage across targeted paths and shares. Detecting these parameters catches the encryptor even when the binary is renamed to evade name-based controls.

Malicious Windows Defender Disabling via DC.exe Defender Control by Elpaco Ransomware

This rule detects execution of the Defender Control utility (DC.exe) with a disable switch to turn off Windows Defender. This behavior is used by the Elpaco ransomware, a Mimic variant, to blind endpoint protection before encryption. Disabling defenses removes the primary barrier to file encryption and lateral movement, making early detection critical.

Suspicious Python Startup .pth File Creation for Interpreter Persistence

This rule detects creation of the litellm_init.pth Python path-configuration file. The LiteLLM supply-chain attack abused a .pth file that Python auto-executes at interpreter startup to run attacker code whenever the environment is used as documented by Kaspersky. A malicious .pth dropped into a site-packages directory grants stealthy persistence tied to every Python invocation.

Suspicious Firewall Configuration Enumerated - PowerShell (via powershell)

This rule detects extract current Windows firewall configuration to prepare an attack.

Suspicious Mock Trusted Directory with Trailing Space (via process_creation)

This rule detects the DBatLoader UAC bypass technique that creates a mock system directory whose name carries a trailing space before the System32 segment to satisfy trusted-directory checks. Any process image path containing Windows followed by a space and then a backslash indicates this masquerade. Legitimate Windows binaries never execute from such a path.

Suspicious Remote Script Execution via Wget or Curl Piped to Shell (via process_creation)

This rule detects downloading a remote script and piping it directly into a shell, an execution technique observed in attacks against Kubernetes environments to run attacker tooling on compromised nodes. Fetching and executing code in a single command leaves no script on disk and is a common initial execution pattern following container compromise.

Suspicious Compute Disk IAM Policy Modification Granting Owner Role via GCP Audit

This rule detects v1.compute.disks.setIamPolicy operations that modify the IAM policy on a Compute Engine disk. Adversaries bind privileged roles such as roles/owner to an external principal to share a disk out of the victim project for data exfiltration. Granting broad access to a disk resource enables theft of the data stored on it without directly reading the volume.