Sigma detection rules, expert-reviewed

SparkRAT Service Creation with binPath in C Drivers Directory (via process_creation)

This rule detects sc.exe creating a service whose binary path launches an executable from the C Drivers staging directory used by the Cambodia-focused SparkRAT cluster for SYSTEM persistence. Adversaries register an auto-start service pointing at their sideloading host under C Drivers to run at boot. Service creation referencing that non-standard directory is highly anomalous.

Suspicious Mshta Executed From Non-System Path (via process_creation)

This rule detects the mshta binary running from a location outside System32 which the CarnavalHeist trojan uses after copying mshta to a randomly named file to evade signature and path based detection. A renamed or relocated trusted LOLBin executing user content is a strong masquerading and signed proxy execution signal.

Suspicious LameHug Staging Directory and Info File Creation on Windows

This rule detects command line references to the ProgramData info staging directory and info.txt output file which the LameHug LLM-driven malware creates to collect system reconnaissance and copied documents before exfiltration. This fixed staging path in an unusual location indicates the AI-assisted collection stage of the intrusion.

Suspicious PowerShell Hidden Bypass Execution from ProgramData via Command Line

This rule detects PowerShell launched with hidden window, execution-policy bypass and non-interactive flags to run a script staged under C:\ProgramData. This behavior was observed in Operation PhantomControl delivering AsyncRAT, where operators execute obfuscated loader scripts to stay hidden. Detecting it exposes stealthy in-memory execution before RAT deployment.

Suspicious Delphi Runtime DLL Side-Loading by Ahnenblatt Host Process

This rule detects the Ahnenblatt application loading the Borland Delphi runtime DLLs borlndmm.dll or cc32290mt.dll from a user-writable directory. The RenEngine campaign side-loaded these DLL names to execute the HijackLoader stage under a trusted signed process as documented by Kaspersky. Loading these runtime libraries from Temp or AppData indicates DLL search-order hijacking used to run malicious code with a benign parent.

Malicious Userland Rootkit Persistence via ld.so.preload on Linux

This rule detects writing to /etc/ld.so.preload to load a malicious shared object which the TeamTNT Doppelganger campaign uses to deploy the libprocesshider rootkit that hooks readdir to hide attacker mining and backdoor processes from process listings.

Malicious WSUS Service Spawning Command Shell via Remote Code Execution

This rule detects the WSUS service or its IIS worker process spawning cmd or PowerShell, matching in-the-wild exploitation of the Windows Server Update Services remote code execution vulnerability. Successful exploitation grants command execution as the WSUS service account for reconnaissance and exfiltration. WSUS components have no legitimate reason to launch interactive interpreters.

Suspicious msimg32 DLL Hijack in AppData Templates

This rule detects msimg32.dll being loaded from the AppData Roaming Templates directory. AdaptixC2 plants a malicious msimg32.dll in this user path to hijack the DLL search order and gain execution. A system DLL name resolving from a user profile Templates folder is a clear DLL hijack indicator.

Malicious C2 Download Embedding Host Reconnaissance in URL

This rule detects wget or curl fetching a URL that embeds command substitution such as the current username, a beaconing pattern where the backdoor reports host context to its C2 while retrieving the next stage. Encoding whoami output into the request lets the operator track and profile infected hosts.

Malicious ZharkBot Execution via Explert Masquerade in Temp via process_creation

This rule detects the ZharkBot payload running as explert.exe from a Temp directory, a name chosen to mimic the legitimate Windows explorer process. Execution of an explorer look alike out of a user Temp folder is highly abnormal and reflects the loader staging its main module. The combined misspelled name and untrusted path make this a strong indicator of ZharkBot activity.

Malicious Inhibit System Recovery via Shadow Copy Deletion and Boot Configuration

This rule detects deletion of volume shadow copies and disabling of Windows recovery via bcdedit which active ransomware families execute before encryption. Observed in NCC Group research into active ransomware families including a BlackCat incident response engagement. Removing recovery options maximizes ransomware impact which makes this a high-confidence pre-encryption indicator.

Suspicious Remote Scheduled Task Creation Running As SYSTEM

This rule detects schtasks.exe creating a task on a remote host that runs as SYSTEM at startup. In the WithSecure Catching Lazarus Part Two research the actor uses schtasks Create with a remote server, ONSTART schedule and the SYSTEM account for lateral movement and persistence. Attackers use remote task creation to execute code with high privilege on other machines.

Malicious Scheduled Task Masquerading as Windows Update by Screening Serpens (via process_creation)

This rule detects creation of scheduled tasks named WindowsSecurityUpdate or Synchronize OS via schtasks, a persistence technique used by the Iranian APT Screening Serpens. The tasks masquerade as legitimate system maintenance to relaunch the group's implants on a daily schedule.

Suspicious User Shell Folders Startup Path Modification (via registry_set)

This rule detects modification of the Startup entry under the Explorer User Shell Folders registry key. Adversaries redirect the Startup path to an attacker-controlled directory so that arbitrary programs launch at logon without touching the visible Startup folder. Changing this shell folder mapping is rare in normal operation and is a stealthy persistence technique.

CHCP CodePage Locale Lookup

Detects use of chcp to look up the system locale value as part of host discovery