Sigma detection rules, expert-reviewed

Suspicious Chromium Browser Launch With Covert Media Capture Flags via DRILLAPP (via process_creation)

This rule detects an Edge or Chromium browser started with flags that auto-approve and silently select media and screen capture sources, the covert audio and screen recording setup used by the DRILLAPP backdoor. Legitimate browser sessions do not suppress the media capture prompt in this way.

Suspicious Chromium Browser Launch With Remote Debugging for DRILLAPP (via process_creation)

This rule detects an Edge or Chromium browser started with remote debugging and web security disabled, the automation setup used by the DRILLAPP backdoor to drive the browser through the Chrome DevTools Protocol. Everyday browsing does not combine these flags.

Malicious G DATA Avk.exe Masquerading From Public Folder via PlugX (via process_creation)

This rule detects the legitimately named G DATA Avk.exe binary executing from the Users Public GDatas directory, a masquerading and side-loading technique used to run the PlugX RAT. Genuine G DATA components run from Program Files, not the public user folder.

Suspicious Outlook Process Spawning Network Utilities for NotDoor C2 (via process_creation)

This rule detects the Outlook process spawning nslookup or curl, behavior used by the NotDoor backdoor to exfiltrate the username through DNS lookups and HTTP requests to attacker infrastructure. Outlook does not normally launch these command line network utilities.

Suspicious svchost Execution With Anomalous Arguments via DeedRAT (via process_creation)

This rule detects svchost.exe launched with an underscore-delimited uppercase argument pattern and without the standard service host -k switch, an execution anomaly produced when DeedRAT injects into svchost. Genuine svchost instances are started by services.exe with a -k service group argument.

Suspicious MSBuild Execution Spawned by Command Shell for Process Hollowing (via process_creation)

This rule detects MSBuild.exe launched by a command shell or PowerShell without a project or solution file on the command line, an anomaly consistent with the process hollowing target abused by HijackLoader to run AsyncRAT. Genuine MSBuild builds reference a project, solution, or response file.

Suspicious OfficeUpdate.exe Masquerading Word Binary From ProgramData (via process_creation)

This rule detects an executable named OfficeUpdate.exe running from ProgramData, a masqueraded copy of WinWord.exe used to side-load a Cobalt Strike loader. Microsoft Office updates do not execute from this location under that name.

Malicious DLL Side-Loading of Avk.dll by G DATA Binary via PlugX (via image_load)

This rule detects the G DATA Avk.exe binary loading an Avk.dll from the Users Public GDatas directory, the side-loading step that decrypts and injects the PlugX payload. Genuine G DATA installations load their DLLs from the protected Program Files location.

Malicious DLL Side-Loading via Remote Desktop Binaries for DreamLoaders (via image_load)

This rule detects the wksprt.exe or wkspbroker.exe Remote Desktop binaries loading webservices.dll or radcui.dll from outside the Windows system directories, the side-loading step used by the Lazarus DreamLoaders. These signed binaries normally load such DLLs only from System32 or WinSxS.

Malicious DLL Side-Loading of appvisvsubsystems64.dll via Cobalt Strike Loader (via image_load)

This rule detects the AppV appvisvsubsystems64.dll being loaded from the ProgramData directory by a renamed Word binary, the side-loading step that launches a Cobalt Strike beacon. The genuine appvisvsubsystems64.dll ships only inside System32.

Possible ToolShell SharePoint Exploitation via ToolPane.aspx (via webserver)

This rule detects POST requests to the SharePoint ToolPane.aspx endpoint carrying the crafted parameters and SignOut.aspx referer used in the ToolShell exploit chain. ToolShell abused a set of SharePoint vulnerabilities to reach unauthenticated remote code execution on internet-facing servers. This request pattern is an early indicator of exploitation before any implant is dropped.

Possible GhostContainer Exchange Backdoor C2 Request via OWA (via webserver)

This rule detects HTTP requests to Exchange OWA carrying the custom control header and crafted VIEWSTATE prefix used by the GhostContainer backdoor. GhostContainer is an IIS/Exchange module backdoor deployed against high-value organizations in Asia. Operators tunnel commands through legitimate OWA endpoints which lets malicious traffic blend into normal Exchange usage and evade perimeter controls.

Malicious TBK DVR Command Injection via device.rsp Endpoint

This rule detects HTTP requests to the device.rsp endpoint carrying the ___S_O_S_T_R_E_A_MAX___ marker and a shell command which exploits CVE-2024-3721 on TBK DVR devices. A Mirai botnet variant uses this injection to download and run its ARM payload on vulnerable DVRs. The distinctive marker string in the request is a reliable exploitation signal.

Possible Apache Struts2 OGNL Content-Type Exploitation CVE-2017-5638 (via webserver)

This rule detects HTTP requests carrying an OGNL injection payload in the Content-Type header. The NKAbuse intrusion begins by exploiting the Struts2 vulnerability CVE-2017-5638, which smuggles an OGNL expression through a malformed Content-Type to run commands on the server, so this header content indicates attempted remote code execution against a public-facing web application.

Suspicious Group Policy Client-Side Extension Attribute Modification via Directory Service Change

This rule detects Directory Service Changes (Event ID 5136) that add values to the gPCMachineExtensionNames or gPCUserExtensionNames attributes of a Group Policy Object. Attackers modify these client-side extension lists to attach malicious CSE GUIDs that push scheduled tasks or logon scripts domain-wide. Unexpected changes to GPO extension attributes indicate group policy abuse for mass code execution.