Sigma detection rules, expert-reviewed

Suspicious Startup Folder Redirection via User Shell Folders by MuddyWater (via registry_set)

This rule detects modification of the Startup value under the Explorer User Shell Folders registry key, a persistence technique MuddyWater uses to redirect the startup directory so its payload autoruns at logon. Tampering with this key silently changes where Windows looks for startup items. Detecting the change exposes stealthy persistence.

Malicious Octo Tempest Credential Theft Tooling (via process_creation)

This rule detects execution of credential theft tools including LaZagne gosecretsdump and ADFSDump. Octo Tempest used these utilities to harvest local secrets and AD FS token-signing material for federation abuse.

Masquerading Cuckoo Stealer LaunchAgent Masquerading as Homebrew Updater (via file_event)

This rule detects creation of a LaunchAgent plist named com.homebrew.brewupdater used by Cuckoo Stealer to persist on macOS after a fake Homebrew ClickFix lure. Adversaries leverage a Homebrew-themed LaunchAgent label so the stealer relaunches at login while appearing to be a legitimate package updater.

Malicious LitterDrifter VBScript Execution via wscript trash.dll

This rule detects wscript.exe running a file named trash.dll through the VBScript engine with LitterDrifter specific arguments. This behavior belongs to the Gamaredon LitterDrifter USB worm which uses the Windows script host to launch its orchestrator module. Detecting it exposes initial execution of the worm on the host.

Suspicious msiexec Remote Package Installation over HTTP

This rule detects msiexec.exe installing a package directly from an http or https URL in quiet mode, a NetSupport RAT delivery vector in the ClickFix campaign. The loaders invoked msiexec with a remote URL and the /qn switch to silently install the RAT from attacker infrastructure. Remote quiet MSI installation is a LOLBin abuse pattern used to bypass download controls.

Suspicious notepad Outbound Network Connection after Early Bird Injection

This rule detects the Windows notepad process initiating outbound internet connections which it never does legitimately. The TryCloudflare delivered XWorm and AsyncRAT chain used Early Bird APC injection into notepad to run C2 from a benign host. Network activity from notepad reliably indicates injected code beaconing out.

Suspicious Firewall Rule Masquerading As Windows Update (via process_creation)

This rule detects netsh adding an advfirewall rule named Windows Update, a masquerade used in Rhysida intrusions to open remote access ports while hiding behind a trusted name. Attacker-created firewall rules with system-service names often enable inbound RDP or C2 channels and merit investigation.

LeakyStealer Persistence via EdgeUpdateCore Run Key Masquerade (via registry_set)

This rule detects a Run key named EdgeUpdateCore that points to a MicrosoftEdgeUpdateCore executable staged under the user AppData directory, the persistence mechanism used by the LeakyInjector and LeakyStealer duo to survive reboot while masquerading as a Microsoft Edge update component. Adversaries mimic trusted update tooling so the autorun entry blends into normal software update activity.

Suspicious Encoded PowerShell with Hidden Window via Process Creation

This rule detects PowerShell invoked with a base64-encoded command while suppressing its window, the launcher behavior of the UAC-0099 LonePage VBS chain that decodes and runs a hidden beacon. Combining encoded payloads with a hidden window is a strong indicator of covert script execution rather than administrative use.

Suspicious msiexec Spawning Hidden Command Script (via process_creation)

This rule detects msiexec.exe launching cmd.exe to run a minimized .cmd script which was the initial delivery chain for EtherRat and TukTuk C2. The MSI dropped and executed a hidden batch file to stage the loader. Command scripts launched minimized from an installer are a common way to hide first-stage execution.

Malicious PowerShell Download from bullethost.cloud Staging Server

This rule detects PowerShell reaching out to the attacker-controlled staging host upload.bullethost.cloud to fetch a second stage archive into the user temp directory. This behavior was observed in the MUT-4831 campaign where trojanized npm packages ran a postinstall script that downloaded the Vidar infostealer. Blocking this early denies the actor credential and wallet theft capability.

Suspicious Encoded PowerShell Host Reconnaissance via Get-ComputerInfo via ps_script

This rule detects PowerShell script content invoking the Get-ComputerInfo cmdlet to enumerate detailed system information. A threat actor abusing a free Elastic Cloud SIEM trial ran this command to profile compromised hosts before exfiltrating the results, so its appearance in encoded or automated PowerShell is an early indicator of system discovery ahead of data theft.

Possible ITG05 Headlace Staging via Mocky and Mockbin Services (via proxy)

This rule detects ITG05 Headlace retrieving staged payloads from the mocky and mockbin request-mocking services used as disposable command-and-control. Requests to these API-mocking hosts from enterprise endpoints are unusual and warrant review. The services return next-stage scripts to the infection chain.

Malicious Renamed Curl Binary Execution via Original Filename Mismatch

This rule detects execution of a process whose original filename is curl.exe but whose on-disk name has been changed, a masquerade DarkGate uses to fetch payloads while evading name-based detection. The copy-and-rename of curl hides ingress tooling. Detecting the mismatch exposes disguised download activity in the DarkGate to DanaBot chain.

Suspicious Windows Traffic Capture Abuse (via process_creation)

This rule detects use the native Windows sniffer in order to capture sensitive information or credentials.