Sigma detection rules, expert-reviewed

Malicious Renamed Curl Binary Execution via Original Filename Mismatch

This rule detects execution of a process whose original filename is curl.exe but whose on-disk name has been changed, a masquerade DarkGate uses to fetch payloads while evading name-based detection. The copy-and-rename of curl hides ingress tooling. Detecting the mismatch exposes disguised download activity in the DarkGate to DanaBot chain.

Suspicious Windows Traffic Capture Abuse (via process_creation)

This rule detects use the native Windows sniffer in order to capture sensitive information or credentials.

Suspicious Certutil URLCache Remote Payload Download via process_creation

This rule detects certutil.exe invoked with the urlcache and split flags which downloads a remote file to disk while masquerading as certificate maintenance. Attackers in the SOC web shell case used obfuscated certutil to fetch a 404.aspx web shell onto the server. This living-off-the-land download technique bypasses many application allow lists and is worth alerting on.

Suspicious Onlogon Scheduled Task Pointing to ProgramData Executable

This rule detects creation of an onlogon scheduled task whose action executes a binary staged in ProgramData as used by the NetSupport actor for persistence under a masqueraded task name and this matters because legitimate onlogon tasks rarely launch executables from ProgramData and this pattern reflects malware establishing user triggered persistence.

SparkRAT Service Creation with binPath in C Drivers Directory (via process_creation)

This rule detects sc.exe creating a service whose binary path launches an executable from the C Drivers staging directory used by the Cambodia-focused SparkRAT cluster for SYSTEM persistence. Adversaries register an auto-start service pointing at their sideloading host under C Drivers to run at boot. Service creation referencing that non-standard directory is highly anomalous.

Suspicious Mshta Executed From Non-System Path (via process_creation)

This rule detects the mshta binary running from a location outside System32 which the CarnavalHeist trojan uses after copying mshta to a randomly named file to evade signature and path based detection. A renamed or relocated trusted LOLBin executing user content is a strong masquerading and signed proxy execution signal.

Suspicious LameHug Staging Directory and Info File Creation on Windows

This rule detects command line references to the ProgramData info staging directory and info.txt output file which the LameHug LLM-driven malware creates to collect system reconnaissance and copied documents before exfiltration. This fixed staging path in an unusual location indicates the AI-assisted collection stage of the intrusion.

In-Memory XWorm Injection Target RegAsm Spawned from User AppData (via process_creation)

This rule detects RegAsm.exe launched from a process residing in a user AppData or Temp directory, the PE-hollowing pattern used by the Noodlophile campaign to inject XWorm into a trusted .NET utility. Adversaries leverage RegAsm as a signed developer binary and hollow it in memory so the RAT runs under a Microsoft-signed process, making early detection critical for exposing the injection before remote access is established.

Suspicious Group Policy File System Path Redirection via Directory Service Change

This rule detects Directory Service Changes (Event ID 5136) that modify the gPCFileSysPath attribute of a Group Policy Object. Attackers redirect this path to reference policy files stored outside the trusted SYSVOL share so that domain clients apply attacker-controlled settings. A change to the GPO file system path indicates tampering with group policy storage.

Suspicious PowerShell Hidden Bypass Execution from ProgramData via Command Line

This rule detects PowerShell launched with hidden window, execution-policy bypass and non-interactive flags to run a script staged under C:\ProgramData. This behavior was observed in Operation PhantomControl delivering AsyncRAT, where operators execute obfuscated loader scripts to stay hidden. Detecting it exposes stealthy in-memory execution before RAT deployment.

Suspicious Microsoft Defender Security Components Disabled - PowerShell (via powershell)

This rule detects disable Defender security features in PowerShell.

Suspicious Delphi Runtime DLL Side-Loading by Ahnenblatt Host Process

This rule detects the Ahnenblatt application loading the Borland Delphi runtime DLLs borlndmm.dll or cc32290mt.dll from a user-writable directory. The RenEngine campaign side-loaded these DLL names to execute the HijackLoader stage under a trusted signed process as documented by Kaspersky. Loading these runtime libraries from Temp or AppData indicates DLL search-order hijacking used to run malicious code with a benign parent.

Malicious Userland Rootkit Persistence via ld.so.preload on Linux

This rule detects writing to /etc/ld.so.preload to load a malicious shared object which the TeamTNT Doppelganger campaign uses to deploy the libprocesshider rootkit that hooks readdir to hide attacker mining and backdoor processes from process listings.

Suspicious SQL Server - Connection Attempt Using a Disabled Account (via application)

This rule detects attempts authenticate to the database using a disabled user accont.

Suspicious MeshCentral Remote Command Execution via meshctrl (via process_creation)

This rule detects the MeshCentral meshctrl controller invoking RunCommand, the mechanism ShinyHunters used to push a fanout shell script to compromised PeopleSoft hosts in the education sector campaign. Adversaries abuse remote management platforms like MeshCentral to execute commands at scale across an estate, so controller-driven command execution should be validated against authorized administration.