Sigma detection rules, expert-reviewed

Suspicious Hidden PowerShell Encoded IEX Execution

This rule detects PowerShell launched with stealth flags together with in-memory execution of Base64 content, matching the spyware loader from the Pakistan-targeted fake dating app campaign. The combination of hidden window, bypassed policy and IEX-decoded payload indicates fileless execution of downloaded malware.

Malicious DeadLock Ransomware Encrypted File Extension Creation (via file_event)

This rule detects creation of files carrying the .dlock extension appended by the DeadLock ransomware encryptor as reported by Group-IB. Adversaries rename encrypted files with this extension during impact, so these writes indicate active DeadLock encryption on the host.

Malicious Disabling of macOS Automatic Software Updates via Defaults

This rule detects use of the defaults command to turn off automatic macOS software update checks or downloads. The XCSSET v4.0 malware disables SoftwareUpdate AutomaticCheckEnabled and AutomaticDownload to keep the host on vulnerable software and preserve its foothold. Detecting this configuration change exposes defense evasion that weakens the system patch posture.

Suspicious SSH Reverse Tunnel via Renamed plink Utility on Triofox Host

This rule detects renamed plink or putty binaries sihosts.exe and silcon.exe establishing a reverse SSH tunnel with the -R flag as observed after Triofox exploitation. Attackers proxy RDP over an outbound tunnel to a non standard port to maintain covert remote access.

Suspicious Astaroth Spambot Browser Profile Staging Directory (via file_event)

This rule detects creation of the browser profile staging directory used by the Astaroth spambot component. Astaroth copies the victim browser profile into a ChromeAuto directory under the public temp folder to drive an automated headless browser session. This directory pattern is a high-fidelity host indicator.

Suspicious Shell Spawned by Oracle WebLogic Identity Manager Process (via process_creation)

This rule detects a WebLogic or Oracle Identity Manager Java process spawning a command shell. Such a child process is consistent with post-exploitation of the CVE-2025-61757 remote code execution chain. Identity servers rarely launch interactive shells from the JVM.

Suspicious CoffeeLoader Armoury DLL Dropped to User Writable Path (via file_event)

This rule detects the ArmouryAIOSDK.dll payload being written to ProgramData, LocalAppData or the Temp directory as performed by CoffeeLoader during installation. The genuine ASUS DLL is not expected in these user writable locations.

Suspicious Credential Exfiltration to webhook.site (via dns_query)

This rule detects DNS resolution of webhook.site, the request-catcher service abused by the Shai-Hulud npm worm to exfiltrate stolen .npmrc, cloud and SSH tokens. Enterprise hosts rarely need this testing service, so a lookup from a build or developer machine is a strong exfiltration signal.

Suspicious Crontab Removal via Command Line (via process_creation)

This rule detects use of crontab with the remove flag to wipe scheduled jobs, a cleanup action performed by the Tox based coinminer to erase competing tasks and its own traces. Clearing the crontab helps the miner evade cleanup and hide indicators of prior activity.

Malicious DeadBolt Ransomware Note and Encrypted File Artifacts

This rule detects the creation of the DeadBolt ransom note or files bearing the .deadbolt extension which mark encrypted data on compromised QNAP network attached storage devices. The note and extension appear as the ransomware finishes encrypting shares. It is important because their presence confirms an active DeadBolt impact event requiring immediate response.

Possible Cryptomining Beacon to c3pool Mining Domain

This rule detects DNS lookups for the c3pool mining pool domain used by the cryptominer dropped after SSTI exploitation in this research. Enterprise systems have no reason to resolve public mining pool infrastructure. Detecting the query surfaces resource hijacking following the web compromise.

Suspicious PowerShell Script Execution With Unrestricted Execution Policy

This rule detects PowerShell launched to run a script file while forcing an unrestricted execution policy. The GoPix banking trojan started its payload with an ExecutionPolicy Unrestricted -File command line delivered via a malicious LNK as reported by Kaspersky. Bypassing the execution policy to run an external script is a common defense-evasion step for script-based loaders.

Malicious Vice Society Directory Crawling Script for Data Exfiltration - Via Ps_script (via ps_script)

This rule detects data exfiltration performed by the Vice Society ransomware gang using a custom built PowerShell script. More precisely, the script enumerates the volumes mounted on the system, then starts crawling the different directories before initiating the data exfiltration over HTTP by creating multiple different jobs. As PowerShell script block logs the script execution into multiple events, the detection aggregates the different log chunks using the ScriptBlockId and then ensure that at least 3 of the 4 detection strings are found.

DragonForce Ransomware File Association Registration for Encrypted Extension (via registry_set)

This rule detects registration of a DefaultIcon association for the .dragonforce_encrypted file extension, an impact behavior DragonForce ransomware performs so all encrypted files display an attacker-supplied icon dropped under the public profile. Registering an icon for a novel encrypted extension is a strong post-encryption indicator, making detection useful for scoping ransomware impact across a host.

PowerShell Reflective Shellcode Loader via Dynamic API Delegates (via ps_script)

This rule detects a PowerShell Cobalt Strike loader that resolves Windows APIs through reflection helper functions and allocates executable memory before copying and running shellcode. Adversaries leverage dynamic delegate creation and VirtualAlloc to execute a beacon in memory while avoiding static API imports.