Sigma detection rules, expert-reviewed

Suspicious Event Log Clearing via wevtutil During Ransomware Activity

This rule detects wevtutil clearing Windows event logs which ransomware operators perform to destroy evidence of intrusion and lateral movement. Clearing logs immediately before or after encryption impairs incident response and timeline reconstruction.

Malicious Scheduled Task Masquerading as Auto Update via schtasks (via process_creation)

This rule detects creation of a scheduled task named Auto apdate that launches Trays.exe at logon with highest privileges, the persistence mechanism used in the AnyDesk phishing campaign targeting Russian aerospace firms. The misspelled update-themed task name masquerades as a benign auto-updater to hide malicious auto-start, so catching the task registration exposes the persistence before the tool executes.

Malicious Brutforce on Windows OpenSSH Server with Valid Users (via security)

This rule detects sSH brutforce a Windows OpenSSH server with a valid user.

Malicious Word Spawning Rundll32 Loading DLL from Roaming Word Folder

This rule detects winword.exe launching rundll32.exe to load a DLL staged under the AppData Roaming Microsoft Word directory which is the Hancitor maldoc execution chain preceding Cuba ransomware. The malicious macro drops and side loads the loader from a user writable path. It is important because this parent child pattern reliably marks initial Hancitor infection.

Malicious wp2shell Batch Endpoint Exploitation (via webserver)

This rule detects POST requests to the WordPress batch REST endpoint that return HTTP 207 multi-status, matching in-the-wild exploitation of wp2shell for CVE-2026-63030 and CVE-2026-60137. Attackers chain requests through the batch route to reach vulnerable handlers and drop a web shell. The 207 response to the batch route is characteristic of this exploitation.

Suspicious Service DLL Persistence Under Masquerading Service Names

This rule detects a ServiceDll value being set under the COMSysConfig or StorSyncSvc service keys which the ColunmTK APT41 cluster registers to load a malicious DLL through a svchost hosted service. The names impersonate legitimate Windows components to blend in. It is important because ServiceDll hijacking grants stealthy SYSTEM level persistence.

Suspicious Kernel Service Creation for BYOVD Driver Loading (Qilin)

This rule detects creation of a kernel-type Windows service via sc create with a kernel service type, used by the Qilin group to load a vulnerable driver for bring-your-own-vulnerable-driver attacks. Loading a kernel driver through a newly created service enables disabling security products from kernel space. Unexpected kernel service creation is a strong defense-evasion signal.

Malicious PlugX Run Key Persistence via AvastSvcpCP Path

This rule detects a Run key value pointing at the AvastSvcpCP directory under the user profile used by the PlugX USB worm for persistence. PlugX copies its sideloading set into this folder and registers it for autostart, masquerading as Avast to survive reboots.

Malicious Cactus Ransomware Ransom Note Creation (via file_event)

This rule detects creation of Cactus ransomware ransom notes, which embed the fixed C.A.c_T.U-S-R.e-a_D.m-e marker between randomized prefixes and postfixes in the note filename. Adversaries leverage mass note deployment during the encryption stage, making detection of this distinctive embedded string a reliable late-stage indicator of a Cactus impact event.

Malicious Disabling of Huntress Updater via systemctl Stop

This rule detects systemctl being used to stop the huntress-updater service, an anti-forensic and defense-evasion action observed in a Huntress Linux intrusion where the actor disabled the security agent before continuing cryptomining. Stopping the endpoint agent blinds detection and prevents updates. Targeted termination of a named security service by an attacker is high-confidence malicious activity.

Suspicious Scheduled Task Masquerading as MicrosoftEdgeUpdate with Minute Interval (via process_creation)

This rule detects creation of a scheduled task that impersonates the Microsoft Edge updater while triggering on a very short minute-based interval. The AsyncRAT phishing campaign registers a task named MicrosoftEdgeUpdate500 that runs every two minutes for persistence. Legitimate updaters do not run on such aggressive schedules, so this pairing of a trusted name with an abnormal trigger reveals the persistence mechanism.

Suspicious Scheduled Task Launching svczHost Masquerading Binary via schtasks

This rule detects schtasks creating a task that runs svczHost.exe, a masquerading binary imitating the legitimate svchost service name used for persistence in the Ducktail campaign. Attackers pick a lookalike host name so the scheduled task and running process blend into normal system activity.

AteraAgent malicious installations

Detects potentially malicious AteraAgent installations when the IntegratorLogin parameter is used to register a non-business email.

Malicious svchost Masquerading Binary scvhost Executed from Common Files

This rule detects execution of scvhost.exe, a typosquatted masquerade of the legitimate svchost.exe, deployed as a fake SQLlite service under Program Files Common Files by the Nezha threat actor. The misspelled name and non-system path reveal a persistence and masquerading attempt. Genuine svchost only runs from System32, so any scvhost binary is malicious.

Suspicious Service Creation for APT41 Loader via sc create (via process_creation)

This rule detects creation of a Windows service named server power via sc.exe as seen in the APT41 Africa campaign. The group used this service to gain SYSTEM level persistence for a sideloaded payload. A service with this whitespace-separated cover name combined with sc create points to hands-on-keyboard persistence rather than legitimate software installation.