Sigma detection rules, expert-reviewed

Suspicious GodRAT Persistence via Run MyStartupApp Value (via registry_set)

This rule detects creation of a MyStartupApp value under the current user Run key used by GodRAT for logon persistence. The RAT and its bundled browser-credential stealer rely on this autorun entry to survive reboots. The specific value name under Run distinguishes this activity from ordinary application startup entries.

Suspicious Security Support Provider Registration for Persistence

This rule detects modification of the LSA Security Packages values under the netsvcs or IKEEXT related keys used to register a malicious Security Support Provider. Lazarus used SSP registration during Operation SyncHole to gain persistence and load ThreatNeedle into LSA. Changes to the Security Packages list are rare outside of authentication package installs and warrant review.

Suspicious Run Key Persistence For CiscoCollabHost via registry_set

This rule detects a Run key persistence entry whose value points to a Cisco named binary under a user AppData path which is how the MysterySnail loader survives reboots. IronHusky registered CiscoCollabHost.exe from an AppData Cisco plugins directory in the CurrentVersion Run key. A Run entry combining a user profile path with Cisco tooling is an abnormal persistence configuration worth alerting on.

Malicious Winlogon Windows Load Registry Persistence via registry_set

This rule detects modification of the Windows NT CurrentVersion Windows Load registry value which is executed at user logon and is a rarely used persistence location. GOFFEE set the Load value to run its payload each time an affected user signed in to targeted Russian organizations. Because legitimate software seldom uses this key any write to it is a high confidence persistence signal.

Suspicious SmartScreen Disable via Registry Modification via registry_set

This rule detects modification of the AppHost registry values that control SmartScreen web content evaluation which attackers disable to suppress reputation-based download warnings. The Arcane stealer turned off EnableWebContentEvaluation and SmartScreenEnabled to let its downloaded tools run without user prompts. Disabling SmartScreen weakens a key browser defense and is rarely legitimate on managed endpoints.

Suspicious Run Key Persistence Masquerading as dmwappushservice by Cloud Atlas

This rule detects creation of a Run key value named dmwappushservice which imitates the legitimate WAP push message service. The Cloud Atlas group uses this autorun entry to persist its VBCloud backdoor. A user or machine Run key masquerading under this service name indicates covert persistence.

Suspicious Ransom Note Delivery via Legal Notice Registry Values

This rule detects modification of the Winlogon legalnoticecaption or legalnoticetext policy values. The Ymir ransomware set these logon banner values to display its ransom message at sign-in, so unexpected changes outside managed policy can indicate ransomware impact.

Malicious Run Key Persistence Masquerading as VCRuntime or Edge Update

This rule detects Run key persistence values named VCRuntineSync or EdgeCriticalUpdateService. The Horns and Hooves campaign used these fake autorun entries, including the misspelled VCRuntineSync, to relaunch the NetSupport client at logon while imitating legitimate software.

Malicious Microsoft Defender Disable via Registry by Key Group

This rule detects registry modifications that disable Microsoft Defender antispyware or real-time monitoring, a tamper action Key Group ransomware uses to blind endpoint protection before encryption. Setting these policy values to enabled-disable is a hallmark of ransomware pre-encryption defense evasion.

Malicious Head Mare Run Key Persistence Masquerading as MicrosoftUpdate

This rule detects a Run key named MicrosoftUpdateCore or MicrosoftUpdateCoree pointing to srvhost.exe, the persistence and masquerading technique used by the Head Mare group. The combination of a legitimate-looking update name with a srvhost.exe payload that impersonates svchost is a strong indicator of the group's foothold.

Malicious Coyote Persistence via UserInitMprLogonScript Environment Value (via registry_set)

This rule detects a write to the HKCU\Environment\UserInitMprLogonScript registry value pointing at an executable. The Coyote banking trojan sets this logon-script value to run obs-browser-page.exe at each user logon for persistence, so modification of this rarely-used key indicates a logon-script persistence mechanism being installed.

Suspicious HrServ Registry Command Channel under IdentityStore RemoteFile (via registry_set)

This rule detects writes to the HKLM\SOFTWARE\Microsoft\IdentityStore\RemoteFile registry value. The HrServ web shell abuses this uncommon key as a covert channel to stage and exchange data, so modification of this specific path indicates the implant storing operator content in the registry.

Malicious ServiceDll Hijack Of FontCacheSvc via Registry Set

This rule detects the ServiceDll value of the Font Cache service being pointed at apibridge.dll. ToddyCat hijacks the svchost-hosted FontCacheSvc service to load its malicious apibridge.dll for stealthy persistence, masquerading as a legitimate system service.

Suspicious SOCKS Proxy Autorun Registry Persistence via Registry Set

This rule detects a Run key persistence entry whose value references a SOCKS5 proxy component or the PerfLogs staging path. SystemBC establishes a SOCKS5 proxy for command-and-control and anchors it via an autorun registry value, combining persistence with proxy-based C2 tunneling.

Suspicious Process Made Critical via RtlSetProcessIsCritical (via ps_script)

This rule detects PowerShell invoking RtlSetProcessIsCritical to mark a process as critical as done by VenomRAT in the RevengeHotels campaign. Flagging a process critical causes the system to bugcheck if it is terminated which frustrates analyst attempts to kill the implant. This anti-analysis call is not used by normal PowerShell workloads.