Sigma detection rules, expert-reviewed

Suspicious HrServ Registry Command Channel under IdentityStore RemoteFile (via registry_set)

This rule detects writes to the HKLM\SOFTWARE\Microsoft\IdentityStore\RemoteFile registry value. The HrServ web shell abuses this uncommon key as a covert channel to stage and exchange data, so modification of this specific path indicates the implant storing operator content in the registry.

Malicious ServiceDll Hijack Of FontCacheSvc via Registry Set

This rule detects the ServiceDll value of the Font Cache service being pointed at apibridge.dll. ToddyCat hijacks the svchost-hosted FontCacheSvc service to load its malicious apibridge.dll for stealthy persistence, masquerading as a legitimate system service.

Suspicious SOCKS Proxy Autorun Registry Persistence via Registry Set

This rule detects a Run key persistence entry whose value references a SOCKS5 proxy component or the PerfLogs staging path. SystemBC establishes a SOCKS5 proxy for command-and-control and anchors it via an autorun registry value, combining persistence with proxy-based C2 tunneling.

Suspicious Process Made Critical via RtlSetProcessIsCritical (via ps_script)

This rule detects PowerShell invoking RtlSetProcessIsCritical to mark a process as critical as done by VenomRAT in the RevengeHotels campaign. Flagging a process critical causes the system to bugcheck if it is terminated which frustrates analyst attempts to kill the implant. This anti-analysis call is not used by normal PowerShell workloads.

Malicious Defender Exclusion Added for User Profile Path

This rule detects PowerShell using Add-MpPreference to add a Microsoft Defender exclusion covering the user profile directory which BrowserVenom uses to shield its staged payload from scanning. Excluding a broad writable path like the user profile is a common evasion before dropping the next stage. This weakening of Defender coverage is rarely legitimate on endpoints.

Malicious Active Directory ACL Manipulation via PowerView

This rule detects PowerView functions that grant domain object permissions or add members to privileged groups. The Twelve group abused Add-DomainObjectAcl and Add-DomainGroupMember to escalate privileges and establish persistence in Active Directory, which enables long-term domain control.

Suspicious Scheduled Task Enumeration for User_Feed_Sync via PowerShell (via ps_script)

This rule detects PowerShell enumerating scheduled tasks matching the User_Feed_Sync name pattern which the DuneQuixote campaign uses to locate its CR4T implant persistence task on compromised Middle Eastern government systems.

Malicious SessionGopher Credential Extraction via PowerShell (via ps_script)

This rule detects invocation of the SessionGopher tool through PowerShell which LockBit builder-based ransomware operators use to extract saved session credentials from PuTTY WinSCP and RDP prior to lateral movement and encryption.

Possible FakeWallet Wallet Exfiltration via Structured POST Parameters (via proxy)

This rule detects POST requests carrying the FakeWallet specific parameters ciyu, ciyuType and wallet used to transmit stolen cryptocurrency wallet material to the operator. This parameter layout is unique to the FakeWallet iOS stealer campaign. Detecting the structured parameters surfaces exfiltration even when the destination domain changes.

Malicious FakeWallet Crypto Stealer C2 via Rsakey Endpoints (via proxy)

This rule detects requests to the FakeWallet server endpoints containing the distinctive Rsakeycatch and Rsakeyword paths used by the iOS crypto stealer to exfiltrate wallet data. FakeWallet spread through App Store applications to harvest cryptocurrency wallet secrets. Detecting these fixed endpoint paths exposes active data exfiltration to attacker infrastructure.

Malicious AdaptixC2 Beacon via X-Beacon-Id Header and Default User Agent (via proxy)

This rule detects HTTP traffic carrying the AdaptixC2 specific X-Beacon-Id header or the framework default Firefox 20.0 user agent string. AdaptixC2 is a post-exploitation command-and-control framework used for beaconing and tunneling. Detecting either the custom header or the anachronistic user agent exposes agent check-ins to an AdaptixC2 listener.

Possible JanelaRAT C2 Beacon via Structured HTTP Query (via proxy)

This rule detects outbound HTTP requests carrying the structured beacon query parameters VS, PL and AN that JanelaRAT appends when checking in to its command-and-control server. This behavior is associated with the JanelaRAT financial trojan operating over daily-rotating dynamic DNS infrastructure in Latin America. Identifying the fixed parameter layout reveals active C2 communication independent of the rotating domain.

Possible Malicious MCP Server Credential Exfiltration via DevTools-Assistant Agent (via proxy)

This rule detects outbound HTTP requests carrying the DevTools-Assistant user agent or destined for the api.github-analytics.com host used by the trojanized MCP server to exfiltrate stolen developer credentials. The custom user agent string and attacker controlled domain are distinctive network markers of this supply-chain compromise. Such traffic represents active data theft from a developer workstation.

Suspicious SparkKitty Photo Exfiltration API Pattern

This rule detects network requests to the SparkKitty spyware image-collection API paths such as getImageStatus putImages and putDataInfo used to upload stolen photos from infected mobile devices. This Trojan spy embedded in App Store and Google Play apps harvests gallery images that may contain wallet seed phrases. The structured API endpoint set is a distinctive server-side indicator.

Suspicious StupidSandwichAgent User-Agent in C2 Traffic by StaryDobry

This rule detects outbound HTTP requests carrying the hardcoded StupidSandwichAgent User-Agent string used by the StaryDobry campaign loader. This unusual and unique agent value identifies command-and-control and payload retrieval traffic from the miner dropper. Presence of this User-Agent indicates StaryDobry C2 communication.