Sigma detection rules, expert-reviewed

Malicious APT29 WINELOADER DLL Side-Load of vcruntime140.dll via SqlDumper (via image_load)

This rule detects the Microsoft SqlDumper.exe binary loading a vcruntime140.dll from a non-standard directory, the side-load chain APT29 used to run the WINELOADER backdoor. The actor paired a legitimate signed executable with a malicious runtime DLL to gain trusted execution. SqlDumper loading vcruntime140.dll outside canonical install paths is a high-fidelity side-loading indicator.

Malicious FortiManager Unregistered Device Add Indicating CVE-2024-47575 Exploitation (via application)

This rule detects the FortiManager event log message indicating an unregistered device from localhost was successfully added, the core exploitation artifact of the FGFM protocol zero-day CVE-2024-47575. Successful registration of an attacker-controlled device grants remote access to managed configuration data.

Suspicious systemd Service Persistence via GRIDTIDE xapt

This rule detects creation of a systemd unit file named xapt.service under etc systemd system as used by GRIDTIDE to persist its C backdoor. Attackers install this service so the xapt payload in usr sbin restarts automatically across reboots.

Suspicious macOS LaunchDaemon Masquerading as Apple System Updater

This rule detects creation of a LaunchDaemon named com.apple.system.updater.plist which impersonates an Apple system component as used by UNC1069 for macOS persistence. Attackers register this fake daemon so their payload in Library Caches or Library OSRecovery runs at boot.

Suspicious Creation of PROMPTFLUX Thinking Robot Log in Temp

This rule detects creation of the thinking_robot_log.txt artifact in the Temp directory written by the PROMPTFLUX VBScript dropper that queries the Gemini API to regenerate itself. Attackers use this AI assisted metamorphic loader to evade static signatures.

Malicious ld.so.preload Persistence Modification on Ivanti Connect Secure (via file_event)

This rule detects modification of /etc/ld.so.preload, the dynamic linker preload persistence mechanism abused during CVE-2025-22457 exploitation to auto-load the SPAWN family of implants into every process. Changes to ld.so.preload on an appliance grant stealthy systemwide code execution.

Malicious PHASEJAM Web Shell Written Into Ivanti CGI Endpoints (via file_event)

This rule detects modification of the Ivanti Connect Secure getComponent.cgi or restAuth.cgi files, into which the PHASEJAM web shell was injected during zero-day exploitation. Writes to these trusted CGI endpoints grant persistent remote command execution on the appliance.

Suspicious FortiManager Config Archive Written to /tmp/.tm During CVE-2024-47575 Exploitation (via file_event)

This rule detects creation of the hidden staging archive /tmp/.tm on FortiManager, where the CVE-2024-47575 exploitation flow collected managed device configuration data before exfiltration. A hidden archive in /tmp on an appliance indicates collection activity following exploitation.

Suspicious Thumbs.ini File Written to AppData by UNC2970 MISTPEN (via file_event)

This rule detects creation of a file named Thumbs.ini in a user AppData directory, a working file the UNC2970 MISTPEN backdoor writes while masquerading as the legitimate Thumbs.db thumbnail cache. The anomalous extension in an unexpected location indicates backdoor staging.

Possible Residential Proxyware Beacon to PacketSDK Infrastructure

This rule detects DNS lookups for proxyware SDK command infrastructure such as packetsdk and hexsdk and castarsdk domains used by residential proxy networks. Such beacons indicate a host has been enrolled as a proxy exit node without authorization.

Suspicious Salesforce Connected App OAuth Authorization from VPN Egress

This rule detects a Salesforce OAuth authorization for a connected app based on the Data Loader followed by API access from anonymizing VPN egress, matching UNC6040 abuse of a stolen app token to pivot across SaaS platforms. Granting this token lets the actor read and export data and pivot into Okta and Entra from the same infrastructure.

Suspicious Salesforce Bulk Data Extraction via Bulk and Report APIs

This rule detects Salesforce bulk-processing and report-export events combined with paginated query bursts, matching UNC6040 mass extraction driven through a malicious connected app based on a modified Data Loader. Attackers use these high-volume APIs to enumerate and exfiltrate large volumes of records after voice-phishing a user into authorizing the app.

Suspicious Service Creation Loading TSVIPSrv.DLL via DreamLoaders (via service_creation)

This rule detects the creation of a Windows service whose image path references TSVIPSrv.dll, the loader-execution mechanism used by the Lazarus DreamLoaders to run malicious code under a service. Legitimate services do not register this DLL through a newly created service entry.

Suspicious Registry Run Key Persistence for DeedRAT MicRun Loader (via registry_set)

This rule detects a MicRun Run key value pointing to the ProgramData Micro directory, the persistence mechanism used by DeedRAT to relaunch its side-loading binary at logon. Legitimate software does not autostart executables from this path under the name MicRun.

Suspicious Chromium Browser Launch With Covert Media Capture Flags via DRILLAPP (via process_creation)

This rule detects an Edge or Chromium browser started with flags that auto-approve and silently select media and screen capture sources, the covert audio and screen recording setup used by the DRILLAPP backdoor. Legitimate browser sessions do not suppress the media capture prompt in this way.