Sigma detection rules, expert-reviewed

Suspicious DLL Sideloading via Renamed fixmapi Swom.exe Loading Mapistub.dll via Confucius (via image_load)

This rule detects Confucius persistence in which the legitimate fixmapi.exe is copied to Swom.exe in AppData and side loads a malicious Mapistub.dll from LocalAppData. The genuine Mapistub.dll is a system component so loading it beside a renamed fixmapi binary indicates the loader. This chain establishes the backdoor.

Untrusted Disabling of macOS System Integrity Protection (via process_creation)

This rule detects csrutil disable, which turns off System Integrity Protection so an attacker can modify protected system locations and load unsigned kernel code on macOS. Disabling SIP is a defense-evasion technique tracked in the Red Canary Threat Detection Report macOS coverage. Detecting this command surfaces removal of a core macOS protection.

Malicious User Account Control Bypass via Auto-Elevating Binary Hijack (via process_creation)

This rule detects a known auto-elevating Windows binary such as fodhelper, computerdefaults, eventvwr or sdclt spawning a command shell or script interpreter, the tell-tale child-process pattern of a User Account Control bypass. UAC bypasses are a recurring privilege-escalation and defense-evasion technique in the Red Canary Threat Detection Report, letting adversaries obtain a high-integrity process without a prompt. Detecting these parent-child pairs surfaces the elevation attempt.

Suspicious Execution of agent.exe From WinSyncDefender AppData Directory (via process_creation)

This rule detects execution of agent.exe from the Microsoft WinSyncDefender folder under AppData Roaming, the staging path used by Operation ShadowRecruit to host its SheetAgent RAT payload. Running a generically named binary from a fake Microsoft directory in a user-writable location is a wrong-context indicator of the recruitment-themed campaign against Indian job seekers, exposing the malware between delivery and Google Sheets C2.

Malicious DLL Side-Loading of vcomp100 via converter.exe

This rule detects the ImageMagick converter.exe loading vcomp100.dll from outside the Windows system directories. The IDAT loader chain delivering Vidar and ACR stealers abused this signed binary to side-load a malicious vcomp100.dll and execute stager code under a trusted process.

DLL Side-Loading of NvSmartMax via NvSmart Host Process

This rule detects the nvSmartEx.exe host loading NvSmartMax.dll from outside the legitimate NVIDIA program directory, the DLL side-loading pair used by DeadRinger actors to run implant code. A trusted NVIDIA binary loading its companion DLL from an unexpected path indicates search-order hijacking.

Malicious Microsoft Defender Default Action Changed to Allow Any Threat - Command (via process_creation)

This rule detects change Defender default action to allow any threats.

Malicious DNS Hosts File Accessed via Network Share (via security)

This rule detects attempt read the Hosts file content via network share.

Malicious Akira Ransomware Execution via Encryption Command-Line Parameters

This rule detects process execution using the distinctive encryption command-line parameters of the Akira ransomware encryptor, matching intrusions where a renamed akira.exe is run against mounted network shares. The switches control encryption scope and percentage across targeted paths and shares. Detecting these parameters catches the encryptor even when the binary is renamed to evade name-based controls.

Malicious Windows Defender Disabling via DC.exe Defender Control by Elpaco Ransomware

This rule detects execution of the Defender Control utility (DC.exe) with a disable switch to turn off Windows Defender. This behavior is used by the Elpaco ransomware, a Mimic variant, to blind endpoint protection before encryption. Disabling defenses removes the primary barrier to file encryption and lateral movement, making early detection critical.

Suspicious Mock Trusted Directory with Trailing Space (via process_creation)

This rule detects the DBatLoader UAC bypass technique that creates a mock system directory whose name carries a trailing space before the System32 segment to satisfy trusted-directory checks. Any process image path containing Windows followed by a space and then a backslash indicates this masquerade. Legitimate Windows binaries never execute from such a path.

Suspicious Hidden PowerShell Encoded IEX Execution

This rule detects PowerShell launched with stealth flags together with in-memory execution of Base64 content, matching the spyware loader from the Pakistan-targeted fake dating app campaign. The combination of hidden window, bypassed policy and IEX-decoded payload indicates fileless execution of downloaded malware.

Malicious DeadLock Ransomware Encrypted File Extension Creation (via file_event)

This rule detects creation of files carrying the .dlock extension appended by the DeadLock ransomware encryptor as reported by Group-IB. Adversaries rename encrypted files with this extension during impact, so these writes indicate active DeadLock encryption on the host.

Malicious Disabling of macOS Automatic Software Updates via Defaults

This rule detects use of the defaults command to turn off automatic macOS software update checks or downloads. The XCSSET v4.0 malware disables SoftwareUpdate AutomaticCheckEnabled and AutomaticDownload to keep the host on vulnerable software and preserve its foothold. Detecting this configuration change exposes defense evasion that weakens the system patch posture.

Suspicious SSH Reverse Tunnel via Renamed plink Utility on Triofox Host

This rule detects renamed plink or putty binaries sihosts.exe and silcon.exe establishing a reverse SSH tunnel with the -R flag as observed after Triofox exploitation. Attackers proxy RDP over an outbound tunnel to a non standard port to maintain covert remote access.