Sigma detection rules, expert-reviewed

AteraAgent malicious installations

Detects potentially malicious AteraAgent installations when the IntegratorLogin parameter is used to register a non-business email.

Malicious svchost Masquerading Binary scvhost Executed from Common Files

This rule detects execution of scvhost.exe, a typosquatted masquerade of the legitimate svchost.exe, deployed as a fake SQLlite service under Program Files Common Files by the Nezha threat actor. The misspelled name and non-system path reveal a persistence and masquerading attempt. Genuine svchost only runs from System32, so any scvhost binary is malicious.

Suspicious Local Account Creation on Linux (via process_creation)

This rule detects useradd or adduser execution or a direct append to /etc/passwd, an account-creation technique attackers use to plant a durable local login on a compromised Linux host. Creating a rogue local account is a persistence technique tracked in the Red Canary Threat Detection Report. Detecting it surfaces a new attacker-controlled account.

Suspicious Service Creation for APT41 Loader via sc create (via process_creation)

This rule detects creation of a Windows service named server power via sc.exe as seen in the APT41 Africa campaign. The group used this service to gain SYSTEM level persistence for a sideloaded payload. A service with this whitespace-separated cover name combined with sc create points to hands-on-keyboard persistence rather than legitimate software installation.

Malicious Exchange or SharePoint Worker Process Spawning Command Shell from Web Shell (via process_creation)

This rule detects the IIS worker process w3wp.exe spawning command shells or the net utility on on-premises Exchange or SharePoint servers, the web-shell execution behavior these attacks use after deploying pages such as getidtoken.aspx or signout.aspx. Adversaries drop web shells into OWA auth and LAYOUTS directories to run commands in the server context, so command interpreters descending from w3wp indicate server-side compromise.

Suspicious Service Creation With Auto Start via process_creation

This rule detects use of sc.exe to create a new auto-start service which is a common persistence mechanism for miners and loaders. SilentCryptoMiner registered a service named to mimic the Windows Image Acquisition driver with an automatic start binary path. Alerting on service creation from sc.exe surfaces persistence attempts that survive reboots.

Suspicious Minimized Command Shell Launching Decoy PDF (via process_creation)

This rule detects a command shell started in a minimized window that echoes and opens a decoy NotaFiscal PDF which the CarnavalHeist banking trojan LNK uses to distract the victim while it stages its loader. Minimized window execution with an invoice-themed decoy is a social engineering and defense evasion pattern in Brazilian banking malware.

Malicious BLOODALCHEMY DLL Side-Loading via BrDifxapi Executable

This rule detects DLL side-loading where the BrDifxapi executable loads a BrLogAPI DLL which is the loading chain the BLOODALCHEMY backdoor abuses to execute its payload. Pairing this specific host binary with this specific module name reflects a known malicious side-loading combination rather than legitimate Brother software behavior.

BitLocker Feature Configuration - Reg via Command (via process_creation)

This rule detects configures BitLocker for ransomware purposes.

Suspicious osascript Execution of Encoded AppleScript on macOS (via process_creation)

This rule detects osascript invoking a shell command through AppleScript, a pattern Poseidon Stealer uses to run base64 and hex decoded payloads before terminating the Terminal window. The combination of osascript with an inline do shell script and a decoding utility indicates obfuscated execution rather than normal automation. This behavior stages the stealer while evading casual inspection.

Suspicious File Upload via curl Multipart Form

This rule detects curl.exe uploading a local file using a multipart form field. In the Notepad++ supply chain attack the operators used curl with a form file argument to exfiltrate collected reconnaissance output as reported by Kaspersky. Command line file upload via curl can indicate staged data exfiltration although some administrative scripts also use this pattern.

Malicious Bring-Your-Own-Vulnerable-Driver Load for EDR Killing

This rule detects loading of vulnerable signed drivers abused by EDR-killer tooling including BdApiUtil.sys, TfSysMon.sys, K7RKScan.sys, ThrottleStop.sys and HwRwDrv.sys. Attackers load these drivers to gain kernel primitives for terminating security processes via DeviceIoControl, so their presence signals an imminent defense-disabling attempt.

Suspicious RegAsm or RegSvcs Spawned by Script Host (via process_creation)

This rule detects RegAsm.exe or RegSvcs.exe launched by a script host such as PowerShell, wscript, or cscript, the injection target abused in the Cascading Shadows phishing chain. The actor hollows these signed .NET utilities to run Agent Tesla, Remcos, or XLoader while evading defenses through trusted binary proxy execution.

Suspicious Exposed Ollama API Service Connection

This rule detects network connections to the default Ollama LLM service port, exposure that attackers abuse to hijack local AI inference in the evolved LLMjacking campaign. An internet-reachable Ollama endpoint allows unauthenticated model access and resource theft. Connections from untrusted sources to this port warrant review of the exposed service.

Suspicious Scheduled Task Masquerading as Edge Update Running as SYSTEM via schtasks

This rule detects creation of a scheduled task that masquerades as a Microsoft Edge update while running as SYSTEM. This technique was observed in a DLL hijacking campaign analyzed by Kaspersky where attackers created a task named \Microsoft\Windows\Edge\Edgeupdates to gain persistent SYSTEM-level execution. Abusing a legitimate-looking task name in the wrong namespace lets an adversary blend malicious persistence with benign updater activity.