Sigma detection rules, expert-reviewed

Suspicious Silent Installation of ManageEngine Endpoint Central RMM via msiexec

This rule detects msiexec silently installing ManageEngine Endpoint Central agent software, the remote management tool abused by the WhatsApp VBScript campaign for persistent remote access. Unattended RMM deployment on endpoints that do not normally run it indicates attacker-controlled tooling. Legitimate deployments should be allowlisted.

Suspicious wermgr Execution Outside System Directories via process_creation

This rule detects the Windows Error Reporting Manager wermgr.exe running from a path outside System32 and SysWOW64. The MiniPlasma exploitation chain launches a masqueraded wermgr.exe from an unexpected location. A trusted system binary name executing from the wrong directory indicates masquerading and likely process injection.

Suspicious PowerShell Reading Base64 Payload from MI_V Environment Variable via process_creation

This rule detects PowerShell referencing the MI_V or MI_V2 environment variables that the Argamal RAT uses to stage base64 encoded script payloads. Passing encoded stages through custom environment variables hides the command line and defeats simple string logging. This staging pattern is a strong execution and obfuscation indicator.

Suspicious Scheduled Task Masquerading as Windows Color Calibration via schtasks

This rule detects creation of a scheduled task named after WindowsColorSystem Calibration, a masquerade used by the Argamal RAT to persist. Legitimate color calibration is not deployed through ad-hoc schtasks create commands. A benign sounding task name registered by an untrusted process indicates persistence.

Suspicious Power Configuration Change to Prevent Sleep via powercfg

This rule detects powercfg being used to disable system standby and hibernation timeouts so the host stays awake. This behavior is used by the pirated-media cryptomining campaign described by Kaspersky to maximize uninterrupted mining. Keeping a compromised machine perpetually active supports resource hijacking and is worth surfacing.

Malicious Cloud Atlas PowerShower Execution via googleearth Script (via process_creation)

This rule detects PowerShell executing a script named googleearth.ps1, the masqueraded PowerShower component Cloud Atlas deploys to run reconnaissance and staging logic. The benign looking script name conceals malicious PowerShell activity. Detecting this invocation surfaces execution of the group tooling on the host.

Malicious Cloud Atlas UAC Bypass via fodhelper (via process_creation)

This rule detects fodhelper.exe spawning a command interpreter or scripting host, the child processes produced by the fodhelper registry hijack that Cloud Atlas uses to bypass User Account Control. The bypass grants elevated execution without a consent prompt. Detecting fodhelper as the parent of these processes surfaces privilege escalation attempts.

Malicious Kimsuky Scheduled Task Persistence via ChromeCheck and EdgeCheck (via process_creation)

This rule detects schtasks.exe creating a minute interval task named ChromeCheck or EdgeCheck, browser themed names Kimsuky uses to disguise persistence for its PebbleDash based tooling. The frequent task keeps the implant resident and blends with browser maintenance. Detecting these task names surfaces persistence tied to the campaign.

Malicious DAEMON Tools Backdoor Execution via rundll32 mcrypto (via process_creation)

This rule detects rundll32.exe executing an export of the mcrypto module used by the DAEMON Tools supply chain backdoor to run and clean up its payload. The distinctive misspelled chiper export marks the malicious loader invocation. Detecting this command surfaces proxied backdoor execution on the host.

Malicious DAEMON Tools Supply Chain Payload Download via PowerShell WebClient (via process_creation)

This rule detects PowerShell using a WebClient DownloadFile call to stage a payload into the Windows Temp directory, an action tied to the DAEMON Tools supply chain compromise. The download retrieves second stage backdoor components after a trojanized installer runs. Detecting the download to Temp surfaces the payload staging step of the intrusion.

Suspicious Silver Fox Backdoor Execution via pythonw appclient Module (via process_creation)

This rule detects pythonw.exe running the appclient module, the interpreter based execution path of the Silver Fox ABCDoor backdoor that hides its window from the user. Running the implant as a Python module conceals malicious activity behind a legitimate interpreter. Detecting this invocation surfaces backdoor execution on the host.

Malicious Silver Fox PowerShell Download Cradle via irm and iex (via process_creation)

This rule detects PowerShell combining Invoke-RestMethod with Invoke-Expression to download and directly execute remote content, the delivery cradle used by the Silver Fox ABCDoor campaign. The technique retrieves and runs backdoor code in memory following a tax themed phishing lure. Detecting the irm to iex pattern surfaces staged payload execution.

Malicious Lotus Wiper Masqueraded Binary Execution from lotus Directory (via process_creation)

This rule detects execution of the masqueraded binaries nstats.exe or nevent.exe from a lotus directory used by the Lotus Wiper to blend destructive tooling with benign looking names. The false name in an anomalous path signals staged wiper components. Detecting this execution surfaces the wiper toolset on disk.

Malicious Lotus Wiper Disk Wipe via diskpart clean all (via process_creation)

This rule detects diskpart.exe executing the clean all operation which zeroes every sector of a selected disk, a destructive action used by the Lotus Wiper against the energy and utilities sector. Full disk wiping renders systems unbootable and destroys stored data. Detecting this command identifies active destruction-of-data activity.

Malicious Registry Hive Dump for Credential Access via reg save (via process_creation)

This rule detects reg.exe saving the SAM, SECURITY or SYSTEM registry hives to disk, a credential access technique observed with AdaptixC2 operators harvesting local secrets. Exporting these hives enables offline extraction of password hashes and cached credentials. Detecting the hive save surfaces credential theft preparation on a host.