Sigma detection rules, expert-reviewed

Suspicious Scheduled Task Creation for HijackLoader Persistence (via process_creation)

This rule detects the creation of a scheduled task named mlt_Archive through schtasks, the persistence mechanism observed in the IObit side-loading intrusion delivering AsyncRAT. This task name is not associated with legitimate software.

Suspicious Credential Prompt Phishing via osascript (via process_creation)

This rule detects osascript invoking an AppleScript dialog box that prompts the user for a password, a technique used by macOS stealers such as Cthulhu and Atomic to socially engineer credentials. Attackers use fake authentication dialogs to capture the local account password for privilege escalation and keychain access.

Possible AntSword Webshell Access on Ivanti EPMM 403.jsp

This rule detects HTTP POST requests to the 403.jsp resource on Ivanti EPMM carrying the AntSword webshell parameter k. It is tied to a Java webshell appended to the legitimate 403.jsp error page during EPMM exploitation to provide operators remote command execution. Detecting these requests reveals interaction with the deployed webshell.

Malicious Stopping of Security or Backup Services Before Impact (via process_creation)

This rule detects service-control commands (net stop, sc stop or Stop-Service) targeting antivirus, EDR, SQL or backup services, a defense-impairment step ransomware operators run to disable protection and free locked files before encryption. Stopping security and backup services is an impact-precursor technique in the Red Canary Threat Detection Report. Detecting these commands surfaces the final staging move before data is encrypted.

Malicious SCMBanker ClickFix Payload Fetch via Curl Piped to Cmd

This rule detects a curl download of a remote resource piped directly into a cmd.exe interpreter which is the ClickFix delivery step of the SCMBanker Mexican banking-fraud toolkit. Adversaries trick victims into pasting a clipboard command that fetches and runs a staged validation script. Catching this pipe-to-interpreter pattern exposes the initial foothold before the wider toolkit is pulled.

Suspicious BadIIS Service Persistence Masquerading as System Services

This rule detects creation of Windows services under the BadIIS masquerading names Winlogin, FaxService or AudiosService, which imitate legitimate system service names through subtle misspellings. The commodity BadIIS ecosystem installs services under these deceptive names to persist and blend into service inventories. Creation of a service with these typo-squatted names indicates BadIIS persistence.

Malicious Panamorfi DDoS JAR Execution via Java (via process_creation)

This rule detects the Panamorfi campaign running its Java payloads conn.jar and mineping.jar after compromising an exposed Jupyter notebook. conn.jar connects to a Discord channel for command and control while mineping.jar launches TCP flood denial of service attacks. These jar names are unique to the campaign.

Malicious regsvr32 Scriptlet Execution via scrobj.dll

This rule detects regsvr32.exe executing a remote or local scriptlet through scrobj.dll, the Squiblydoo signed-binary proxy execution technique. The CPU-Z watering-hole intrusion used regsvr32 with a .sct scriptlet to run attacker code while bypassing application controls as documented by Kaspersky. This combination of regsvr32 with the scriptlet handler is rarely legitimate and indicates evasive code execution.

Malicious ESX Admins Domain Group Creation via Process Creation

This rule detects creation of or membership changes to a domain group named ESX Admins using net.exe, the core exploitation step for CVE-2024-37085 in which ESXi hypervisors grant full administrative access to any member of that group. Multiple ransomware operators created this group to obtain hypervisor admin rights and mass-encrypt virtual machines.

Suspicious Script Host Spawning PowerShell via BlindEagle Chain

This rule detects a Windows Script Host process (wscript or cscript) spawning PowerShell, the execution chain used by BlindEagle after its VBS downloader retrieves remote payloads. This VBS-to-PowerShell handoff drives multi-stage RAT delivery such as njRAT and AsyncRAT, so the pattern is a strong early indicator of the infection.

PowerShell Base64 Download Cradle via FromBase64String and Invoke-Expression (via ps_script)

This rule detects PowerShell that decodes a base64 blob with FromBase64String and immediately runs it through Invoke-Expression, the staged download-and-execute cradle used by the LNK phishing chains analyzed by STRT to fetch and launch a second-stage script. Adversaries leverage this pattern to reconstruct and execute obfuscated code in memory, so this behavior warrants review during phishing investigation.

Suspicious Rundll32 Loading DLL from User-Writable Path (via process_creation)

This rule detects rundll32.exe loading a DLL from a user-writable directory such as ProgramData or AppData. AresLoader downloads its DLL into %AllUsersProfile% and invokes it through rundll32 with an exported ordinal to run the loader. Rundll32 executing a DLL from a staging directory is a frequent proxy-execution and defense-evasion pattern.

Suspicious Chrome Remote Debugging Port for Browser Session Theft

This rule detects a Chromium based browser being started with a remote debugging port enabled, which exposes a local DevTools protocol endpoint an attacker can drive to read cookies and session data. XCSSET v4.0 launches Chrome with CDP on a local port to hijack authenticated browser sessions. Detecting the debugging port surfaces browser session theft staged through the debugging interface.

Suspicious Winlogon AutoAdminLogon Credential Registration

This rule detects enabling of Winlogon automatic logon by writing AutoAdminLogon, DefaultUserName or DefaultPassword under the Winlogon key. The ToyMaker access broker set these values so a reboot into their controlled session authenticates automatically, cementing persistence and easing the handoff of the compromised host to extortion affiliates.

Possible Andariel Keylogger Output Archive Staged in Temp (via file_event)

This rule detects creation of the password-protected keylog archive and its embedded log file staged in the Temp directory by a keylogger attributed to the North Korean group Andariel. Adversaries write captured keystrokes and clipboard data to a compressed archive on disk before exfiltration, so these named artifacts indicate active credential capture.