Sigma detection rules, expert-reviewed

Suspicious ClickFix RunMRU Entry Recording LOLBIN Command from Run Dialog

This rule detects RunMRU registry values that capture LOLBIN commands such as powershell, mshta, rundll32, or msbuild pasted into the Windows Run dialog. Microsoft describes this as the core artifact of the ClickFix social engineering technique that tricks users into executing attacker commands. A scripting or proxy binary launched from the Run dialog is rare for legitimate users, so these entries flag the user-driven execution step.

Suspicious Firefox Enterprise Root Certificate Trust Enabled

This rule detects the Firefox preference security.enterprise_roots.enabled being set to true, forcing Firefox to trust certificates from the Windows root store. Microsoft observed Secret Blizzard enabling this so their rogue root certificate would be trusted by Firefox for AiTM interception. Because Firefox normally maintains its own trust store, this change extends the attacker root into the browser and enables traffic decryption.

Suspicious RunMRU Entry Launching LOLBIN via ClickFix Run Dialog

This rule detects RunMRU registry values that record LOLBIN commands such as powershell or mshta typed into the Windows Run dialog. Microsoft observed Lumma Stealer ClickFix campaigns instructing victims to paste these commands, leaving artifacts in the RunMRU key. A scripting LOLBIN executed from the Run dialog is unusual for normal users and reveals the social engineering execution step.

Suspicious Access to Chrome Encrypted Preference MAC Registry Values (via registry_set)

This rule detects registry activity touching Chrome PreferenceMACs values, the integrity-hash store that StilachiRAT reads while harvesting browser credentials and manipulating Chrome state during its cryptocurrency-theft workflow. Adversaries interact with these values to validate or bypass Chrome preference protections when stealing saved logins, so unexpected access to PreferenceMACs is an indicator of browser credential theft.

Suspicious Mint Sandstorm VBScript Persistence via Run Key (via registry_set)

This rule detects a Run key value referencing a VBScript file used for persistence. Mint Sandstorm registered scripts such as a.vbs and Persistence.vbs under CurrentVersion Run to maintain access on targeted academic and research hosts.

Suspicious Flax Typhoon Network Level Authentication Disabled via Registry (via registry_set)

This rule detects disabling of Network Level Authentication for RDP by setting the UserAuthentication value to 0 under the RDP-Tcp terminal server key. Flax Typhoon disabled NLA to weaken RDP protections and enable the Sticky Keys logon-screen hijack for remote access.

Malicious Flax Typhoon Accessibility Feature IFEO Debugger Hijack via Registry (via registry_set)

This rule detects creation of an Image File Execution Options debugger value on an accessibility binary such as sethc.exe or utilman.exe pointing to taskmgr or cmd. Flax Typhoon abused this Sticky Keys hijack to gain SYSTEM-level command execution from the logon screen without credentials, enabling stealthy persistence and access.

Suspicious Data Exfiltration to webhook.site via PowerShell Invoke-WebRequest (via ps_script)

This rule detects PowerShell piping command output through Out-String into Invoke-WebRequest targeting webhook.site. Threat actors used this technique to exfiltrate host reconnaissance output to an attacker-controlled request-capture endpoint.

Suspicious Diamond Sleet Anomalous Microsoft Internet Explorer User Agent (via proxy)

This rule detects outbound requests carrying the literal user agent string Microsoft Internet Explorer, which does not match any genuine Internet Explorer user agent. Diamond Sleet LambLoad used this hardcoded user agent when fetching PNG-disguised second-stage payloads.

Suspicious Diamond Sleet C2 via LambLoad Addon PHP URI Pattern (via proxy)

This rule detects outbound web requests to the LambLoad command and control URI structure using the bluemantis addon PHP endpoints. Diamond Sleet used these URIs during the CyberLink supply chain compromise to retrieve second-stage payloads and receive commands.

Suspicious Scheduled Task Persistence Named Autoupdate

This rule detects creation of a scheduled task named Autoupdate via schtasks, the persistence used to relaunch ACR Stealer components. Naming the task Autoupdate helps the infostealer survive reboots while blending into expected update activity on the host.

Suspicious msiexec Remote Passive Install Loader

This rule detects msiexec installing a package from a remote URL in passive mode, a delivery method used to load StealC and Amadey infostealers. Installing an MSI directly from the internet with a suppressed user interface is a proxy execution technique that evades application controls.

Suspicious PowerShell Download and Execute via iwr Piped to iex

This rule detects PowerShell fetching remote content with Invoke-WebRequest and piping it into Invoke-Expression, a loader pattern used to deliver StealC and Amadey infostealers. Downloading and directly executing script content in memory bypasses file based controls and is a common malware staging technique.

Suspicious npm Postinstall node Execution of setup.cjs with Warnings Suppressed

This rule detects node executing a setup.cjs script with the --no-warnings flag, the postinstall behavior used in the Mastra npm supply chain compromise attributed to Sapphire Sleet. A postinstall script suppressing warnings while running an installer stage is characteristic of malicious package code fetching a second stage payload.

Suspicious Vidar Payload Execution from AI-Themed DeepSeek Lure Path

This rule detects process activity from a Downloads Programs directory named after a fake DeepSeek AI build, the staging path used to deliver the Vidar infostealer in an AI-branded social engineering campaign. The distinctive lure path indicates a user was tricked into running a fraudulent AI tool that deploys credential theft malware.