Sigma detection rules, expert-reviewed

Suspicious Rundll32 Execution of Timestamp-Named DLL

This rule detects rundll32 executing a DLL whose file name is a 14-digit timestamp such as YYYYMMDDHHmmSS.dll. The Lampion malware chain drops and runs a payload DLL named after the current date and time to evade static signatures. This automatically generated naming pattern combined with rundll32 proxy execution indicates malicious loading.

Malicious File Copy via Esentutl Volume Shadow Access (via process_creation)

This rule detects esentutl.exe invoked with the /vss switch to copy a locked file such as ntds.dit or a credential database from a volume shadow copy, a credential-access technique that sidesteps file locks. Esentutl shadow-copy abuse is tracked in the Red Canary Threat Detection Report. Detecting this invocation surfaces theft of protected credential material.

Suspicious MSC File with Double Extension (via file_event)

This rule detects creation of a Microsoft Management Console file that uses a document double extension to disguise itself as a PDF. The FLUX#CONSOLE campaign delivered an ARRVL themed pdf.msc file to exploit MMC for payload execution.

Suspicious Shai-Hulud Worm Stager Execution from Temp (via process_creation)

This rule detects execution of the processor.sh or migrate-repos.sh shell scripts from the tmp directory used by the Shai-Hulud npm supply-chain worm. These stagers harvest cloud and repository credentials then drive self-propagation by republishing infected packages. Running these named scripts out of tmp is a direct indicator of the worm on a developer or build host.

Suspicious Host Recon via ConvertFrom-Csv and ConvertTo-Json

This rule detects PowerShell piping CSV-formatted system inventory output into ConvertFrom-Csv and ConvertTo-Json, a recon idiom used by the Interlock backdoor. The malware wrapped systeminfo, tasklist and drive enumeration in this JSON conversion pipeline to serialize host data for exfiltration to its C2. The structured serialization of native recon commands distinguishes automated collection from routine administration.

Suspicious RisePro Stealer Password Dump File in Temp (via file_event)

This rule detects creation of a passwords.txt file inside a Temp folder which the RisePro information stealer writes when dumping harvested browser credentials before exfiltration. The stealer occasionally fails to clean up this artifact and leaves it on disk.

Suspicious TSVIPSrv.DLL Loaded From Non-System Path via DreamLoaders (via image_load)

This rule detects the TSVIPSrv.dll module being loaded from a location outside the Windows system directories, a technique used by DreamLoaders to run its loader through a malicious service. The genuine TSVIPSrv.dll ships only inside System32.

Suspicious RMM Daisy-Chain Action1 Spawning ScreenConnect via process_creation

This rule detects the Action1 RMM agent spawning a ScreenConnect client process. Threat actors daisy-chain remote management tools by using one deployed RMM to install and launch a second, giving them redundant remote access, so an Action1 process launching ScreenConnect indicates chained rogue RMM deployment rather than normal single-vendor management.

Suspicious IIS Logging Disabled via appcmd

This rule detects appcmd.exe being used to disable IIS request logging with the dontLog setting, matching defense-evasion activity in the Defence Impairment intrusion. Adversaries turn off IIS logging to hide webshell and web-based command execution from server logs. Disabling logging on a web server is a strong anti-forensic signal.

Suspicious Salesforce Query History Deletion Anti-Forensics

This rule detects deletion of Salesforce query or event history records. After exfiltrating data through compromised Drift OAuth tokens the actors delete query logs to hinder investigation. Removal of query history is an anti-forensic step that follows the bulk export activity.

Suspicious SES Account Sending Enablement and Identity Verification via CloudTrail

This rule detects UpdateAccountSendingEnabled and VerifyEmailIdentity events against Amazon SES. Adversaries who compromise valid AWS credentials verify new sending identities and re-enable account sending so they can abuse SES to distribute spam or phishing from the victim account. Re-enabling sending and verifying new identities together is characteristic of SES abuse rather than normal onboarding.

Suspicious Rundll32 Loading DLL from LocalAppData with Short Export (via process_creation)

This rule detects rundll32.exe invoking a DLL staged in the user LocalAppData directory with a single character export ordinal, the loader behavior of the KimJongRAT sys.dll module that Kimsuky drops into the user profile. Adversaries leverage rundll32 as a signed proxy to execute their DLL under a trusted process, making early detection critical for surfacing loader activity before browser and credential theft.

Suspicious Deletion of System Logs Under var log on Linux Appliance

This rule detects shell commands that remove or truncate files under the /var/log directory, the anti-forensic behavior seen after Cisco SD-WAN exploitation to erase authentication and system logs. Clearing /var/log destroys evidence of intrusion and hides the addition of rogue peers or SSH keys. Deleting log files on an appliance is not part of normal operation.

Suspicious type Command Piping Encoded Log to Renamed git Binary (via process_creation)

This rule detects a command line that pipes the contents of glog.txt via the type command into the renamed git binary, the staging technique used by APT-C-60 to feed an encoded payload to its execution proxy. Reading a benign-looking log file and piping it into a proxied binary conceals the true payload source.

Suspicious Run Key Masquerading as GoogleUpdate From Wrong Path via Registry Set (via registry_set)

This rule detects a Run key autostart entry masquerading as GoogleUpdate but pointing to a payload outside the legitimate Google update directory, a persistence and masquerading technique used by malware from MSIX installers per Red Canary. A trusted-looking name paired with the wrong file path is a high-confidence indicator of a malicious autorun disguised as software updater.