Sigma detection rules, expert-reviewed

Malicious APT29 Certutil Decode of Disguised Text File to Archive (via process_creation)

This rule detects certutil decoding a .txt file into a .zip archive, the staging step APT29 used to reconstruct a WINELOADER payload from a disguised invite. Delivering the archive as Base64 text and decoding it locally with certutil evades transfer-time inspection. Certutil decoding text into an archive is a deobfuscation behavior tied to this intrusion set.

Suspicious Masqueraded Rundll32 with Mismatched Original Filename (via process_creation)

This rule detects a process whose embedded original filename is RUNDLL32.EXE but whose on-disk name is something else. Nokoyawa intrusions run IcedID by copying rundll32 to a decoy name such as Calc.exe to blend into normal activity. A binary lying about its identity through a renamed copy is a reliable masquerading indicator.

Malicious Recovery Environment Tampering via Bcdedit

This rule detects bcdedit being used to disable Windows automatic recovery, a boot-configuration change ransomware performs to block system restoration after encryption. It is associated with REvil ransomware-as-a-service affiliate operations that pair this step with shadow copy deletion. Detecting recovery tampering flags impending or in-progress impact activity.

Malicious SQL Server Database Auditing Deactivated (via application)

This rule detects deactivates SQL Server database auditing capacities. SQL auditing requires previous configuration on each SQL instance.

JanaWare Ransomware Ransom Note _ONEMLI_NOT_ Written to Disk (via file_event)

This rule detects the JanaWare ransomware writing its _ONEMLI_NOT_ ransom note across folders as it completes encryption in attacks against Turkish organizations. Adversaries drop this hardcoded Turkish-language note filename in every encrypted directory. The fixed prefix is a reliable post-impact detection anchor.

Malicious Mini Shai-Hulud gh-token-monitor Persistence Service (via file_event)

This rule detects creation of the gh-token-monitor LaunchAgent plist or systemd user service dropped by the Mini Shai-Hulud TanStack npm compromise to poll for GitHub tokens every 60 seconds. This fixed persistence artifact indicates the trojanized package has installed its credential-monitoring daemon.

Suspicious LNK Launch of WebDAV Batch via TryCloudflare Tunnel

This rule detects command lines referencing a trycloudflare tunnel host serving a batch script over WebDAV. The Quartet campaign shipped a zipped lnk that pulled new or startup batch files from a TryCloudflare share to stage Python payloads. Fetching executables from an ephemeral trycloudflare tunnel is a delivery pattern used to bypass domain reputation controls.

Malicious rundll32 Loading dat Payload via afunix Export

This rule detects rundll32.exe loading a file with a .dat extension and invoking the afunix export with a key argument. This loader pattern is used by the Lazarus group during Operation SyncHole watering-hole attacks to execute the ThreatNeedle and related malware via a trusted signed binary. The non-DLL extension plus specific export name distinguishes it from normal rundll32 usage.

Possible Process Injection into Attrib via Mispadu AutoIt Loader (via process_creation)

This rule detects attrib.exe being spawned by the AutoIt3 interpreter, which corresponds to the Mispadu loader injecting its payload into an attrib.exe process. A legitimate AutoIt application launching attrib in this way is not expected.

Suspicious perfctl Hidden IPC Directory Creation in tmp (via file_event)

This rule detects the perfctl malware creating its hidden inter process communication directory /tmp/.xdiag which holds a Unix socket and state files such as the victim IP, event log and TOR data. The hidden dot prefixed directory under tmp is used to coordinate the cryptominer and rootkit and is unique to this threat.

Suspicious Reconnaissance Commands Spawned by Samsung MagicINFO Server

This rule detects the Samsung MagicINFO application spawning cmd.exe to run reconnaissance commands such as whoami or arp, observed by Huntress following exploitation of the MagicINFO 9 server flaw. Attackers run host and network discovery immediately after gaining code execution through the vulnerable web application. Reconnaissance shells parented by the MagicINFO service indicate active post-exploitation.

Suspicious lmadmin License Manager DLL Sideload from Public Path via image_load

This rule detects the Schneider Electric license manager lmadmin.exe loading a DLL from the world-writable Users Public directory, the exploitation path for CVE-2024-2658. The service is coerced into loading an attacker-planted library from a writable location. This DLL hijack grants code execution in the context of the license service.

Suspicious LaunchAgent Masquerading as coreaudiod (via file_event)

This rule detects creation of a LaunchAgent property list that masquerades as the legitimate coreaudiod system daemon inside a user LaunchAgents directory. The JINX-0164 actor dropped such plists to persist a macOS implant under a trusted-looking name. A user-writable LaunchAgent named after a core system daemon is a strong sign of persistence in a false context.

Malicious LSASS Memory Dump via dllhost with comsvcs MiniDump Arguments (via process_creation)

This rule detects dllhost.exe dumping LSASS memory using comsvcs-style MiniDump arguments, the credential-theft step observed in the intrusion where a CLFS zero-day was exploited before ransomware deployment. Adversaries dump LSASS to c:\programdata to harvest credentials for lateral movement ahead of encryption, so dllhost invoking a MiniDump against lsass is a high-confidence credential-access indicator.

Malicious UNC4841 SSH Backdoor Persistence via Non-Standard Port and AllowUsers Restriction (via process_creation)

This rule detects an sshd process being launched on a high non-standard port while restricting logins to a hardcoded attacker account through the -oAllowUsers option. UNC4841 used this technique to maintain covert SSH access to compromised Barracuda ESG appliances following CVE-2023-2868 exploitation. Establishing a dedicated backdoor listener scoped to a single attacker user provides resilient remote access that blends with legitimate SSH traffic.