Sigma detection rules, expert-reviewed

Malicious TBK DVR Command Injection via device.rsp Endpoint

This rule detects HTTP requests to the device.rsp endpoint carrying the ___S_O_S_T_R_E_A_MAX___ marker and a shell command which exploits CVE-2024-3721 on TBK DVR devices. A Mirai botnet variant uses this injection to download and run its ARM payload on vulnerable DVRs. The distinctive marker string in the request is a reliable exploitation signal.

Possible Apache Struts2 OGNL Content-Type Exploitation CVE-2017-5638 (via webserver)

This rule detects HTTP requests carrying an OGNL injection payload in the Content-Type header. The NKAbuse intrusion begins by exploiting the Struts2 vulnerability CVE-2017-5638, which smuggles an OGNL expression through a malformed Content-Type to run commands on the server, so this header content indicates attempted remote code execution against a public-facing web application.

Suspicious Group Policy Client-Side Extension Attribute Modification via Directory Service Change

This rule detects Directory Service Changes (Event ID 5136) that add values to the gPCMachineExtensionNames or gPCUserExtensionNames attributes of a Group Policy Object. Attackers modify these client-side extension lists to attach malicious CSE GUIDs that push scheduled tasks or logon scripts domain-wide. Unexpected changes to GPO extension attributes indicate group policy abuse for mass code execution.

Malicious HelloNet AppMgmt ServiceDll Persistence via Registry (via registry_set)

This rule detects modification of the AppMgmt service Parameters ServiceDll or ServiceMain registry values, a persistence mechanism used by the HelloNet campaign to load a malicious service DLL into svchost netsvcs. Hijacking a legitimate service DLL grants the attacker persistent SYSTEM-level execution while blending into normal service host activity.

Suspicious Service Masquerading as Thumbcache Loader via registry_set

This rule detects a Windows service registered as ThumbcacheService or backed by a TmcLoader binary, the persistence mechanism of the GoSerpent backdoor that injects into svchost. The thumbnail cache service name is a masquerade for the loader. A service with this benign sounding identity from an untrusted binary indicates backdoor persistence.

Suspicious UAC Bypass by Disabling Admin Consent Prompt via registry_set

This rule detects ConsentPromptBehaviorAdmin being set to zero, which disables the UAC elevation prompt for administrators. The WhatsApp VBScript campaign changes this to silently gain elevated execution before deploying RMM tooling. Lowering the admin consent behavior is a well-known privilege-escalation and defense-evasion move.

Suspicious Modification of CloudFiles BlockedApps Policy via registry_set

This rule detects writes to the CloudFiles BlockedApps policy key under the default user hive, abused during MiniPlasma privilege escalation through a registry symlink to Volatile Environment. This key is not a normal target for user or application configuration. Tampering here supports the exploit primitive used to elevate privileges.

Suspicious COM Hijack via InprocServer32 Pointing to AppData DLL via registry_set

This rule detects a CLSID InprocServer32 default value being redirected to a DLL located under the user AppData directory. The Argamal RAT distributed through hentai games uses this COM hijack for persistence and stealthy code execution. A COM server pointing into a user-writable path is a classic hijack pattern and rarely legitimate.

Suspicious Disabling of Malicious Software Removal Tool via registry_set

This rule detects the DontOfferThroughWUAU value being set under the MRT policy key to stop Windows from offering the Malicious Software Removal Tool. The pirated-media miner campaign sets this to weaken host defenses. Suppressing built-in cleanup tooling is a defense-evasion tactic that precedes long-term persistence.

Suspicious Service Masquerading as Google Update in ProgramData via registry_set

This rule detects a service ImagePath pointing to a Google Update named binary located under ProgramData\Google\Chrome instead of the legitimate Program Files Google Update directory. The pirated-media miner campaign installs a GoogleUpdateTaskMachineQC service from this wrong location to blend in. A signed-looking name in the wrong path is a strong persistence and masquerading signal.

Suspicious Cloud Atlas Run Key Persistence via YandexBrowser Masquerade (via registry_set)

This rule detects creation of a Run key value named YandexBrowser_setup, an autostart name Cloud Atlas uses to disguise persistence as a legitimate browser installer. The value relaunches attacker tooling at logon while masquerading as benign software. Detecting this value name surfaces registry persistence tied to the campaign.

Malicious COM TypeLib Hijack via Persistence CLSID Registration

This rule detects registration of the TypeLib COM object CLSID {EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B} which corresponds to the Internet Explorer browser control abused for stealthy persistence. The CPU-Z watering-hole campaign hijacked this TypeLib to reload attacker code whenever the component is instantiated as reported by Kaspersky. Writing to this TypeLib registry path is a known COM hijacking persistence and defense-evasion technique.

Malicious Run Key Persistence for Masqueraded vcpktsvr Loader

This rule detects a Registry Run key value that points to vcpktsvr.exe inside a vcpacket folder under LOCALAPPDATA. The OceanLotus ZiChatBot campaign delivered via PyPI set a pkt-update autorun entry to relaunch this masqueraded loader at logon as reported by Kaspersky. A Run key referencing this fake service binary in a user directory indicates backdoor persistence.

Malicious Kernel Driver Service Registration for ProjectConfiguration Rootkit

This rule detects a service ImagePath registry value that references the ProjectConfiguration.sys driver. The HoneyMyte APT installed a kernel mode rootkit registered as a service under this driver name as documented by Kaspersky. Registration of this specific driver as a service indicates rootkit installation for persistence and stealth.

Malicious COM Hijacking via Twinapi CLSID InprocServer32 Registration

This rule detects registration of the twinapi.dll CLSID InprocServer32 under HKCU, a COM hijacking technique used by the ForumTroll APT to load the Dante spyware. By pointing a per-user CLSID to a malicious DLL, the attacker forces trusted processes to load their code whenever the hijacked COM object is instantiated. This provides stealthy persistence and execution without touching HKLM.