Sigma detection rules, expert-reviewed

Malicious Root Certificate Installed via certutil addstore for AiTM Interception

This rule detects certutil.exe adding a certificate to the root or CA store using the addstore and Enterprise options. Microsoft observed Secret Blizzard installing a rogue root certificate to enable adversary-in-the-middle interception of diplomat traffic. Trusting an attacker root certificate allows silent TLS decryption, so this command reveals the interception setup.

Possible macOS TCC Bypass via mdimport Loading Custom Spotlight Importer

This rule detects the macOS mdimport utility run with recursive or explicit importer flags against a user Spotlight directory or a custom mdimporter bundle. Microsoft described this as the Sploitlight technique that abuses Spotlight importers to read TCC-protected data. Loading an attacker-supplied importer lets code harvest private files that Spotlight can reach, so this invocation indicates exploitation.

Suspicious mshta Executing Remote Content via ClickFix Lure

This rule detects mshta.exe launching remote HTA or scriptlet content from an HTTP or HTTPS URL. Microsoft observed Lumma Stealer delivered through ClickFix lures that pasted mshta commands pointing to attacker infrastructure. Using mshta as a proxy to run remote payloads bypasses application controls, so remote invocation is a reliable malicious signal.

Malicious Marbled Dust Backdoor Executing from Public Videos Directory

This rule detects execution of OMServerService.exe from the c\users\public\videos path. Microsoft attributed this GoLang backdoor to Marbled Dust in the Output Messenger espionage campaign. A service executable running from a world-writable public media folder is a clear misplacement of a legitimate-looking name, marking it as the deployed backdoor.

Suspicious node.exe Executing Compiled JavaScript Bytecode File

This rule detects the Node.js runtime launching a compiled JavaScript bytecode file with the .jsc extension. Microsoft observed threat actors distributing malware as .jsc payloads run by node.exe to obfuscate their logic. Executing compiled bytecode hides the script source from defenders and evades signature detection, so this pattern flags likely malicious Node.js execution.

Suspicious Microsoft Defender Exclusion Added for TEMP and PowerShell via Add-MpPreference

This rule detects use of Add-MpPreference to add Microsoft Defender exclusions for the user TEMP directory and the powershell.exe process. This behavior was observed in Node.js malvertising campaigns tracked by Microsoft that stage malicious payloads in TEMP. Attackers use it to blind endpoint protection before executing staged malware, so alerting on it exposes early defense evasion.

Malicious China Chopper Web Shell Command Pattern in IIS Worker Process (via process_creation)

This rule detects the China Chopper web shell command marker &cd&echo in commands run by the IIS worker process, a hallmark of the web shells deployed against on-premises Exchange and SharePoint servers in these attacks. Adversaries use China Chopper to execute arbitrary commands through a compromised web application, so this distinctive command wrapper spawned by w3wp is a high-confidence web-shell indicator.

Suspicious Windows Event Log Cleared via wevtutil during Ransomware Staging (via process_creation)

This rule detects wevtutil clearing an event log, the anti-forensic action taken during the CLFS zero-day intrusion to erase evidence before ransomware encryption. Adversaries clear logs such as Application to hinder response after credential theft and recovery inhibition, so wevtutil cl outside sanctioned maintenance is an indicator of tampering.

Malicious System Recovery Inhibition via bcdedit and wbadmin before Ransomware (via process_creation)

This rule detects recovery-inhibition commands that disable Windows automatic recovery via bcdedit or delete the backup catalog via wbadmin, the pre-encryption destruction step in the CLFS zero-day intrusion that led to ransomware. Adversaries remove recovery options to maximize damage and pressure victims, so these commands appearing together with staging activity are a critical pre-ransomware indicator.

Malicious AutoHotKey Runner AutoNotify Executing AHKBot Looper Script (via process_creation)

This rule detects the legitimate AutoHotKey runner renamed AutoNotify.exe executing an .ahk script, the AHKBot Looper delivery mechanism used in tax-themed phishing campaigns that leads to screenshot exfiltration and follow-on payloads such as BRc4 and Latrodectus. Adversaries pair a benign AutoHotKey interpreter with a malicious script to run under a trusted-looking binary, so AutoNotify.exe driving an .ahk file is a high-signal execution indicator.

Suspicious mshta Launched from Explorer via ClickFix Run Dialog (via process_creation)

This rule detects mshta.exe launched directly by explorer.exe, the fingerprint of a ClickFix social-engineering lure that tricks a user into pasting a malicious command into the Windows Run dialog during this Booking.com impersonation campaign. Adversaries use the Run-dialog vector to execute mshta as a trusted LOLBin that stages XWorm, Lumma, VenomRAT, AsyncRAT, and NetSupport, so explorer spawning mshta is a high-signal execution indicator.

Suspicious Zsh Persistence via zshrc_aliases Appended to Shell Startup (via process_creation)

This rule detects references to a .zshrc_aliases file, the shell-profile persistence artifact that the updated XCSSET malware writes and sources from the user .zshrc to relaunch itself on each new terminal session. Adversaries hide persistence inside auxiliary zsh startup files to avoid altering the more commonly monitored .zshrc directly, so activity touching .zshrc_aliases is an indicator of shell-based persistence.

Malicious Encoded Payload Decoded and Piped to Shell via xxd or base64 (via process_creation)

This rule detects a hex or base64 encoded blob being decoded with xxd or base64 and piped directly into a shell, the obfuscated execution technique used by the updated XCSSET macOS malware to run its payloads. Adversaries encode commands to hide intent from static inspection and decode-and-run them in memory, so a decode utility feeding sh in one pipeline is a reliable indicator of obfuscated script execution.

Suspicious NetSupport Manager Remote Client Execution (via process_creation)

This rule detects execution of the NetSupport Manager remote-control client32.exe, the remote access tool dropped as the final payload of the GitHub-hosted info stealer chain in this malvertising campaign. Adversaries repurpose the legitimate NetSupport client as a covert RAT for hands-on-keyboard control, so client32.exe running in an environment without a sanctioned NetSupport deployment indicates remote-access compromise.

Suspicious Security Software Discovery via findstr Filtering of AV Process Names (via process_creation)

This rule detects findstr filtering a running process list for security-vendor process names such as wrsa, opssvc, AvastUI, AVGUI, and bdservicehost, the environment-fingerprinting step used by the GitHub-hosted info stealers delivered through this malvertising campaign. Adversaries enumerate installed defenses to decide whether to proceed or evade before deploying NetSupport and stealer payloads, making this tasklist-and-findstr pattern an early execution indicator.