Sigma detection rules, expert-reviewed

Suspicious Renamed PowerShell Binary Execution (via process_creation)

This rule detects a process whose original filename is PowerShell but which runs under a different image name. The Dead#Vax campaign executed a renamed PowerShell binary named mbs.exe to evade image based detections.

Suspicious Defender Behavior Monitoring Disable via PowerShell (via process_creation)

This rule detects PowerShell disabling Windows Defender behavior monitoring through Set-MpPreference. The DEEP#DOOR campaign disabled behavior and realtime monitoring to protect its Python backdoor from detection.

Suspicious PowerShell Executing Code from Environment Variable (via process_creation)

This rule detects PowerShell using Invoke-Expression to run code stored in an environment variable. The OBSCURE#BAT campaign staged its malicious PowerShell in a user environment variable and executed it fileless via this pattern.

Suspicious MSBuild Spawned by PowerShell (via process_creation)

This rule detects the .NET build engine MSBuild.exe being spawned as a child of PowerShell, a living-off-the-land pattern used to execute code outside normal build workflows. The SHADOW#REACTOR campaign abused MSBuild to run an in-memory Remcos payload.

Suspicious Windows Defender Real-Time Monitoring Disable (via process_creation)

This rule detects PowerShell disabling Windows Defender real-time monitoring through Set-MpPreference. The PHALT#BLYX loader used this together with extension exclusions to blind the endpoint before payload injection.

Suspicious MSBuild Execution of Project File from ProgramData (via process_creation)

This rule detects MSBuild.exe executing a project file located in the ProgramData directory. The PHALT#BLYX campaign abused MSBuild as a trusted utility to run a malicious v.proj payload dropped there.

Suspicious Dism Spawned by Microsoft Management Console (via process_creation)

This rule detects the Microsoft Management Console mmc.exe spawning the Dism.exe binary. The FLUX#CONSOLE campaign abused a malicious MSC file to launch a copied Dism binary that sideloaded a malicious DismCore.dll.

Suspicious Service or Task Named windowsinspectionupdate (via process_creation)

This rule detects creation of a service or scheduled task using the distinctive name windowsinspectionupdate. The SLOW#TEMPEST campaign used this name to persist a shellcode loader executed from the Windows Temp directory.

Suspicious Guest Account Privilege Escalation (via process_creation)

This rule detects the built-in guest account being added to the local Administrators group. The SLOW#TEMPEST campaign re-enabled the guest account and elevated it to maintain covert privileged access.

Suspicious File Hidden via attrib in Public Documents (via process_creation)

This rule detects attrib.exe setting the system and hidden attributes on a file. The PHANTOM#SPIKE campaign copied its backdoor to the Public Documents folder and hid it with these attributes to evade casual inspection.

Suspicious Domain Admin Account Creation via net (via process_creation)

This rule detects net.exe adding an account to the Domain Admins group over the domain. The FROZEN#SHADOW campaign created a rogue svc_mail account and elevated it into Domain Admins for persistence and takeover.

Suspicious Active Directory Reconnaissance Commands (via process_creation)

This rule detects command shell execution of domain trust and privileged group enumeration commands run in rapid succession. The FROZEN#SHADOW campaign used these commands for post-compromise Active Directory discovery.

Suspicious rundll32 Executing DLL from ProgramData (via process_creation)

This rule detects rundll32.exe executing a DLL located in the ProgramData directory with an exported function name. The FROZEN#SHADOW campaign used this technique to launch its Cobalt Strike beacon staged as msedge.dll.

Suspicious Remote MSI Installation over WebDAV (via process_creation)

This rule detects msiexec.exe installing an MSI package from a remote WebDAV share addressed with an explicit port suffix. The FROZEN#SHADOW campaign delivered SSLoad via a remote slack.msi over a WebDAV UNC path.

Suspicious Rename of Double-Extension PowerShell Script (via process_creation)

This rule detects a command shell renaming a file with a ps12x extension to a ps1 script. The DEEP#GOSU campaign linked to Kimsuky staged its PowerShell payload with this uncommon double extension before renaming and executing it.