Sigma detection rules, expert-reviewed

Malicious Curl to Shell Dropper from Paste Site via Command Line

This rule detects a shell command that downloads a script from a public paste site such as rentry.co or glot.io and pipes it directly into a shell interpreter. This one-line fetch-and-execute pattern is used by the OpenClaw AI skill marketplace supply chain campaign to deliver macOS stealer payloads. Detecting it exposes ingress tool transfer that bypasses on-disk staging and gives the attacker immediate code execution.

Suspicious RegSvcs Reflective .NET Load from Fake Update Chain

This rule detects PowerShell spawning RegSvcs.exe which is abused as an injection target for reflectively loaded .NET payloads decoded from disguised png files. This behavior was seen in fake browser update campaigns delivering BitRAT and Lumma Stealer. Attackers pick RegSvcs as a signed host to execute malicious code under a trusted image name.

Suspicious HelloNet SSH Reverse Tunnel via frontpage.exe (via process_creation)

This rule detects execution of frontpage.exe with an SSH reverse port-forwarding argument, a renamed SSH client used by the HelloNet campaign to establish an outbound reverse tunnel on port 8443. Attackers use such tunnels to expose internal services and maintain covert remote access to compromised hosts.

Malicious Credential Harvesting via LaZagne (via process_creation)

This rule detects command lines invoking the LaZagne credential-recovery tool, which extracts passwords from browsers, mail clients, Wi-Fi and dozens of other stores in one pass. LaZagne is a credential-access tool observed in intrusions profiled in the Red Canary Threat Detection Report. Detecting its execution surfaces bulk credential theft on the host.

Malicious Shadow Copy and Backup Deletion for Ransomware Recovery Inhibition

This rule detects deletion of volume shadow copies and backup catalogs through vssadmin wmic and wbadmin which Phobos ransomware runs before encryption to prevent victims from restoring their files. Inhibiting system recovery is a common precursor to file encryption and warrants immediate response.

Suspicious mshta Execution of Remote HTA Payload

This rule detects mshta fetching and executing an HTA from a remote URL, a proxy execution step in ACR Stealer intrusion chains that leads to PowerShell staging. Running a remote HTML application through a trusted Windows binary evades application controls and initiates the infostealer delivery chain.

Malicious Octo Tempest Credential Theft Tooling (via process_creation)

This rule detects execution of credential theft tools including LaZagne gosecretsdump and ADFSDump. Octo Tempest used these utilities to harvest local secrets and AD FS token-signing material for federation abuse.

Masquerading Cuckoo Stealer LaunchAgent Masquerading as Homebrew Updater (via file_event)

This rule detects creation of a LaunchAgent plist named com.homebrew.brewupdater used by Cuckoo Stealer to persist on macOS after a fake Homebrew ClickFix lure. Adversaries leverage a Homebrew-themed LaunchAgent label so the stealer relaunches at login while appearing to be a legitimate package updater.

Malicious LitterDrifter VBScript Execution via wscript trash.dll

This rule detects wscript.exe running a file named trash.dll through the VBScript engine with LitterDrifter specific arguments. This behavior belongs to the Gamaredon LitterDrifter USB worm which uses the Windows script host to launch its orchestrator module. Detecting it exposes initial execution of the worm on the host.

Suspicious notepad Outbound Network Connection after Early Bird Injection

This rule detects the Windows notepad process initiating outbound internet connections which it never does legitimately. The TryCloudflare delivered XWorm and AsyncRAT chain used Early Bird APC injection into notepad to run C2 from a benign host. Network activity from notepad reliably indicates injected code beaconing out.

LeakyStealer Persistence via EdgeUpdateCore Run Key Masquerade (via registry_set)

This rule detects a Run key named EdgeUpdateCore that points to a MicrosoftEdgeUpdateCore executable staged under the user AppData directory, the persistence mechanism used by the LeakyInjector and LeakyStealer duo to survive reboot while masquerading as a Microsoft Edge update component. Adversaries mimic trusted update tooling so the autorun entry blends into normal software update activity.

Suspicious Encoded PowerShell with Hidden Window via Process Creation

This rule detects PowerShell invoked with a base64-encoded command while suppressing its window, the launcher behavior of the UAC-0099 LonePage VBS chain that decodes and runs a hidden beacon. Combining encoded payloads with a hidden window is a strong indicator of covert script execution rather than administrative use.

Malicious PowerShell Download from bullethost.cloud Staging Server

This rule detects PowerShell reaching out to the attacker-controlled staging host upload.bullethost.cloud to fetch a second stage archive into the user temp directory. This behavior was observed in the MUT-4831 campaign where trojanized npm packages ran a postinstall script that downloaded the Vidar infostealer. Blocking this early denies the actor credential and wallet theft capability.

Malicious Renamed Curl Binary Execution via Original Filename Mismatch

This rule detects execution of a process whose original filename is curl.exe but whose on-disk name has been changed, a masquerade DarkGate uses to fetch payloads while evading name-based detection. The copy-and-rename of curl hides ingress tooling. Detecting the mismatch exposes disguised download activity in the DarkGate to DanaBot chain.

Suspicious Certutil URLCache Remote Payload Download via process_creation

This rule detects certutil.exe invoked with the urlcache and split flags which downloads a remote file to disk while masquerading as certificate maintenance. Attackers in the SOC web shell case used obfuscated certutil to fetch a 404.aspx web shell onto the server. This living-off-the-land download technique bypasses many application allow lists and is worth alerting on.