Sigma detection rules, expert-reviewed

Malicious GS-Netcat Command and Control via Global Socket Relay Network (via dns_query)

This rule detects DNS resolution of the Global Socket Relay Network domain used by the GS-Netcat backdoor. In Operation Highland the Velvet Ant actor deployed GS-Netcat configured to reach single character subdomains of the relay network for reverse shell access. Resolution of this domain on servers is not expected in enterprise environments.

Malicious NodeSnake RAT Persistence via Scheduled Task and Node.js (via process_creation)

This rule detects the creation of a scheduled task that launches a portable Node.js runtime from a Roaming AppData node directory to execute the NodeSnake remote access trojan payload disguised as a log file. The Interlock operator hid this task under a Windows Defrag path so that the malicious JavaScript payload runs persistently.

Malicious Credential Extraction via Volatility Memory Analysis (via process_creation)

This rule detects the abuse of the Volatility memory forensics framework to dump password hashes and cached domain credentials from a captured memory image, a technique used by the Interlock ransomware operator to turn a defensive DFIR tool into a credential access capability. The hashdump and cachedump plugins recover NTLM and cached credentials for offline cracking.

Malicious Java Backdoor Execution from Public Documents via javaw (via process_creation)

This rule detects execution of the MailQueue-Handler Java archive by javaw, a proxy backdoor deployed by the STAC5143 threat cluster after abusing Microsoft Teams to gain remote control. The archive establishes a command and control channel and is staged under a Public Documents MailQueue-Handler directory alongside a bundled Java runtime.

Malicious Qilin Chrome Credential Harvesting Script Execution via IPScanner (via process_creation)

This rule detects execution of the IPScanner.ps1 PowerShell script used by a Qilin affiliate to harvest credentials stored in Google Chrome across the domain. The script was distributed through a Group Policy logon script and writes stolen credentials into an SQLite database and a text log named on each compromised host.

Malicious EDR Evasion Driver Load from AnyDesk Directory via k.sys (via image_load)

This rule detects the loading of the k.sys kernel driver from a ProgramData AnyDesk directory, the PhantomKiller EDR evasion driver dropped after exploitation of N-able N-central. Placing an EDR killer driver inside a remote management tool directory disguises it as a legitimate component while it disables endpoint protection.

Suspicious DLL Sideloading via OneDriveStandaloneUpdater (via image_load)

This rule detects the legitimate OneDriveStandaloneUpdater binary loading a winhttp.dll from outside the System32 directory, matching the DLL sideloading technique used by the STAC5777 threat cluster to run a keylogging and credential theft payload. The malicious DLL is staged in an AppData Local OneDriveUpdate folder to masquerade as a trusted update component.

Suspicious EDRKillShifter Vulnerable Driver Load from User Temp Directory (via image_load)

This rule detects a kernel driver being loaded from a user profile temporary directory, matching the behavior of the EDRKillShifter loader which drops a vulnerable BYOVD driver with a randomized name into AppData Local Temp and starts it to disable security tooling. Loading a signed but vulnerable driver from a user writable temp path is highly unusual for legitimate software.

Malicious Zemana Vulnerable Driver Load for EDR Termination (via image_load)

This rule detects the loading of the vulnerable Zemana Anti-Logger and Anti-Malware kernel drivers abused by the Terminator tool and its variants to terminate endpoint protection from kernel space. Attackers also deploy the same driver renamed as updatedrv.sys. The driver is exploited through IOCTL codes to add processes to an allowlist and kill protected security processes.

Malicious AuKill EDR Killer Kernel Driver Load via Process Explorer Driver (via image_load)

This rule detects the loading of the malicious Process Explorer kernel driver dropped by the AuKill EDR killer to terminate endpoint protection processes. AuKill drops a driver named PROCEXP.SYS or WindowsKernelExplorer.sys and loads it to gain kernel level access for disabling security tooling. Legitimate Process Explorer instead loads a driver named PROCEXP152.sys.

Malicious Scheduled Task Masquerading as Windows Defender Sync via schtasks (via process_creation)

This rule detects registration of a scheduled task named WindowsDefenderSyncService that repeatedly runs agent.exe, the persistence used by Operation ShadowRecruit to relaunch its ControlR-based RAT every few minutes. The Defender-themed task name impersonates a Microsoft security component to disguise recurring malicious execution against Indian job seekers, so detecting the task creation exposes the foothold early.

Suspicious AnyDesk Unattended Access Configuration via Command Line (via process_creation)

This rule detects AnyDesk invoked with the --set-password parameter to configure unattended remote access, the remote-access foothold established in the phishing campaign against Russian aerospace organizations. Adversaries pipe a static password into AnyDesk to guarantee persistent hands-on-keyboard access to victim hosts, so detecting silent password provisioning surfaces unauthorized remote-control staging.

Malicious Browser Credential Dump File Drop by Phantom Stealer via file_event

This rule detects creation of files named Chromium_passwords_<host>.txt, the browser credential dump written by the multi-stage Phantom Stealer campaign after harvesting saved logins. The predictable filename marks the collection stage where stolen Chromium passwords are staged for SMTP exfiltration, so detecting the drop catches the theft before the data leaves the host.

Malicious Startup Persistence via WindowsDefenderSync Shortcut (via file_event)

This rule detects a shortcut named WindowsDefenderSync.lnk being written into a Windows Startup folder, the auto-run persistence dropped by Operation ShadowRecruit to launch its payload at every user logon. The Defender-themed shortcut name masquerades as a security component while ensuring the ControlR RAT survives reboots, so catching the Startup write reveals the persistence installation.

Malicious PXA Stealer Persistence via Windows Update Service Run Key (via registry_set)

This rule detects PXA Stealer establishing persistence by writing a Run key named Windows Update Service that launches a payload from the public user directory. The value masquerades as a Windows update while pointing at an attacker binary under C drive Users Public. Legitimate autostart entries rarely execute from that location.