Sigma detection rules, expert-reviewed

Obfuscated Extended Rights Backdoor Obfuscation - Via localizationDisplayId Attribute (via security)

This rule detects modifies the "configuration" partition in order to obfuscate sneaky changes that will allow him to introduce a stealthy AdminSDholder backdoor.

Suspicious Sednit Guardrailed Loader DLL Loaded Outside System32

This rule detects the Sednit SlimAgent and BeardShell loaders masquerading as eapphost.dll or tcpiphlpsvc.dll being loaded into their guardrail host processes explorer.exe, taskhost.exe or taskhostw.exe from a location outside the System32 directory. The genuine libraries live in System32, so a same-named module loaded from elsewhere into these processes indicates the impersonating implant.

Malicious SQL Server Spawning Command Interpreter via Mallox Ransomware

This rule detects the MS SQL Server process sqlservr.exe spawning a command interpreter such as cmd, PowerShell, or sqlps, the initial code-execution step in Mallox ransomware intrusions following database compromise. A database engine launching shells almost always reflects abuse of SQL for command execution and should be treated as an active intrusion.

Malicious Windows Defender Exclusion Path Addition via process_creation

This rule detects PowerShell using Add-MpPreference with the ExclusionPath parameter to exclude a directory from Windows Defender scanning. The Arcane stealer added Defender exclusions so its staged payloads under attacker controlled folders would not be inspected. Creating antivirus exclusions is a deliberate defense evasion step that usually precedes payload deployment.

APT28 NotDoor Outlook Macro Security Bypass (via registry_set)

This rule detects Outlook security policy changes that lower the macro security Level to one and enable LoadMacroProviderOnBoot, the registry tampering APT28 performs to auto-load its NotDoor VBA backdoor at Outlook startup. Adversaries leverage these values to run malicious macros without prompts, making detection of either change important for catching mail-client persistence.

Suspicious Event Log Clearing via Get-WinEvent ClearLog (Qilin)

This rule detects PowerShell clearing Windows event logs by enumerating logs with Get-WinEvent and invoking ClearLog. The Qilin group wipes logs to destroy forensic evidence around encryption. Programmatic clearing of event logs is a hallmark anti-forensic action.

Suspicious Regsvr32 Squiblydoo Remote Scriptlet Execution via Command Line (via process_creation)

This rule detects regsvr32.exe launched with the silent registration flags together with a remote scrobj.dll scriptlet reference, the classic Squiblydoo application whitelisting bypass. It is associated with campaigns that deliver regsvr32 execution through malicious Office documents as reported by Uptycs. Attackers use this to run remote COM scriptlets and proxy code execution past application controls, making it a high-value detection.

Suspicious SSH Daemon Spawning Shell via xz Backdoor (via process_creation)

This rule detects the SSH daemon spawning an interactive shell without an intervening login shell, a behavior associated with the xz-utils supply chain backdoor CVE-2024-3094. Observed in Elastic Security Labs live malware lab telemetry where sshd directly launching sh or bash signals unauthenticated command execution enabling remote access.

Malicious JSP Webshell Written to SAP NetWeaver Servlet Directory

This rule detects creation of JSP webshell files with names observed in exploitation of the SAP NetWeaver CVE-2025-31324 file upload vulnerability inside servlet_jsp working directories. Adversaries drop these webshells to gain persistent remote command execution on the compromised application server. Detecting the file write surfaces web shell installation immediately after exploitation.

Malicious Web Shell Child Process Spawned by SAP Java Process (via process_creation)

This rule detects a SAP NetWeaver Java process spawning a command interpreter or reconnaissance utility such as cmd, PowerShell or whoami. Exploitation of CVE-2025-31324 drops a JSP web shell that executes commands through the Java runtime, so an interpreter child under the SAP Java process indicates post-exploitation web shell activity.

Suspicious Alternate Data Stream Creation by MuddyWater (via file_event)

This rule detects creation of an alternate data stream named wtfbbq, an NTFS ADS MuddyWater uses to hide payload content from ordinary file listings. Storing data in a named stream conceals it from users and many tools. Detecting this distinctive stream name exposes ADS-based defense evasion.

Malicious Winlogon Automatic Logon Persistence via Registry AutoAdminLogon (via process_creation)

This rule detects reg.exe writing Winlogon automatic-logon values by setting DefaultPassword together with AutoAdminLogon, a persistence and privilege-retention technique used in the Nitrogen BlackCat intrusion to plant a hardcoded backup domain account for reboot survival. Adversaries abuse AutoAdminLogon to store cleartext credentials and regain an interactive SYSTEM-adjacent session after the safeboot reboot, making it critical to surface before encryption.

Suspicious PythonLauncher Scheduled Task Creation via PowerShell Script

This rule detects PowerShell creating a scheduled task named with the PythonLauncher prefix, the logon persistence UAT-11795 registers for its Starland RAT as reported by Cisco Talos. The operators combine New-ScheduledTask with a PythonLauncher task name to relaunch the implant elevated at each logon. Matching this naming and API pattern reveals attacker persistence distinct from routine task creation.

Malicious Cloudflared Tunnel Established with Token

This rule detects cloudflared.exe running a tunnel with a token argument, a covert channel Huntress observed being launched through RMM tooling such as AgentPackageRunCommandInteractive to reach compromised MSP endpoints. Attackers use Cloudflare tunnels to proxy remote access past perimeter controls without inbound firewall changes. Token-based tunnel creation by cloudflared is a strong command-and-control indicator.

Malicious Silver Fox Run Key Persistence via AppClient (via registry_set)

This rule detects creation of a Run key value named AppClient, a registry autostart used by the Silver Fox ABCDoor backdoor to persist across reboots. The value launches the implant at user logon following a tax themed phishing intrusion. Detecting this autostart entry surfaces backdoor persistence in the registry.