Sigma detection rules, expert-reviewed

Suspicious msdt Execution of Audio Diagnostic via UNC1069 ClickFix

This rule detects msdt.exe launching the AudioPlaybackDiagnostic troubleshooter which UNC1069 abuses in ClickFix lures alongside mshta to execute payloads. Attackers use the Microsoft diagnostic tool as a living off the land execution proxy after socially engineering the victim.

Windows Registry: AuthorizedApplications List Enabled Firewall Exceptions

Flags registry updates that enable per-application Microsoft Defender Firewall exceptions via AuthorizedApplications\List.

Windows Registry Modification: Re-enable Microsoft Defender Firewall Exceptions (DoNotAllowExceptions=0)

Alerts when DoNotAllowExceptions is set to 0 in the Defender Firewall policy registry path, re-enabling firewall exceptions.

Suspicious Deletion of Terminal Server Client History via reg by UNC1549

This rule detects reg.exe deleting the Terminal Server Client history keys that store previously connected RDP hosts as observed in UNC1549 anti forensic activity. Attackers remove these keys to hide lateral movement targets from responders.

Suspicious Child Process Spawned by Triofox GladinetCloudMonitor

This rule detects the Triofox GladinetCloudMonitor process spawning a command interpreter which follows exploitation of CVE-2025-12480. Attackers abuse the built in anti virus feature to execute attacker controlled batch and PowerShell commands as SYSTEM.

Suspicious bitsadmin Download of Python Payload via COLDRIVER

This rule detects bitsadmin transferring a Python script such as libsystemhealthcheck.py as used by COLDRIVER to stage its backdoor. Attackers abuse the BITS service as a living off the land download channel that blends with normal update traffic.

Suspicious Registry Class Key Creation for COLDRIVER Persistence

This rule detects reg.exe adding an unusual file extension class key named pietas under HKCU Software Classes with binary data as observed in COLDRIVER intrusions. Attackers abuse custom class associations to hide configuration or trigger loader execution.

Suspicious Scheduled Task Running pythonw From AppData via COLDRIVER

This rule detects creation of a scheduled task that launches pythonw.exe from a Python38-64 directory under AppData as used by COLDRIVER to persist a health check backdoor. Attackers use this to maintain a stealthy Python based foothold masquerading as a system maintenance job.

Suspicious PowerShell Loader Spawned by mshta via UNC5142 ClickFix

This rule detects mshta.exe spawning powershell.exe as observed in UNC5142 EtherHiding campaigns where an HTA disguised as an XLL launches an in-memory VIDAR or LUMMAC.V2 loader. Attackers abuse this chain to execute stager code from a fake browser update lure while evading disk based detection.

Malicious Reverse Shell Spawned from Oracle EBS Java Process

This rule detects an interactive bash reverse shell to /dev/tcp launched by a Java process running as the applmgr account, matching post-exploitation of the Oracle E-Business Suite zero-day. This gives the extortion actor command execution on the application server to stage the GOLDVEIN.JAVA C2 and exfiltrate data.

Suspicious Linux Persistence via sed Edit of Boot and Init Files

This rule detects sed performing an in-place edit of Linux boot and service files such as rc.local, init.d scripts and systemd units, matching BRICKSTORM persistence that injects the Go backdoor into system startup. Modifying these startup mechanisms ensures the espionage implant relaunches after reboot.

Malicious ESX Admins Group Creation via WinRM Host

This rule detects the WinRM provider host wsmprovhost.exe launching net.exe to create or modify a group named ESX Admins, matching the UNC3944 technique that abuses a default vSphere Active Directory integration to grant full administrative rights over the ESXi estate. This privilege escalation precedes VM theft and hypervisor-level ransomware.

Malicious Bash Reverse Shell via /dev/tcp

This rule detects an interactive bash session redirecting its input and output to a /dev/tcp socket, matching the OVERSTEP dobackshell command that opens a reverse shell from a compromised SonicWall SMA appliance. This gives the operator hands-on-keyboard control to stage data theft and additional persistence.

Suspicious Rundll32 Loading Non-DLL Image Extension File

This rule detects rundll32.exe executing an export from a file carrying an image or media extension rather than a DLL, a defense-evasion pattern used by APT41 PLUSDROP to conceal its loader payload. Running exported code from a masqueraded file lets the actor stage process injection into svchost.exe.

Malicious Rundll32 Execution of Image File Export via PLUSDROP

This rule detects rundll32.exe invoking an export from a file with an image extension staged in an image subfolder, matching the APT41 PLUSDROP loader launched from a malicious LNK to run the TOUGHPROGRESS chain. Attackers disguise the payload as a JPG to bypass extension-based inspection while executing an exported function.