Sigma detection rules, expert-reviewed

Suspicious PowerShell Decoding Base64 Payload Stored in Registry

This rule detects PowerShell reading a value from the HKLM SOFTWARE\System key and base64 decoding it in memory. The ClipBanker loader stored a base64 PowerShell stage inside a registry Config value and used a scheduled task to decode and run it as documented by Kaspersky. Fileless retrieval of an encoded payload from the registry is a hallmark of staged, evasive execution.

Suspicious vcpktsvr Loader Execution From LOCALAPPDATA vcpacket Directory

This rule detects execution of vcpktsvr.exe from a vcpacket directory under the user LOCALAPPDATA path. The OceanLotus ZiChatBot loader was installed to %LOCALAPPDATA%\vcpacket and launched to side-load its terminate.dll payload as documented by Kaspersky. This masqueraded service-like binary running from a user-writable folder indicates the ZiChatBot foothold.

Suspicious Python Execution of Fake Sysmon Script From Config Directory

This rule detects a Python interpreter executing a sysmon.py script from a hidden .config/sysmon directory on Linux. The LiteLLM AI gateway supply-chain implant masqueraded as a sysmon service under ~/.config/sysmon and installed systemd persistence as reported by Kaspersky. Reusing the Windows Sysmon name for a Linux Python script in a user config path is a masquerading indicator of the backdoor.

Suspicious PowerShell WebClient UploadString Network Beacon

This rule detects PowerShell using a Net.WebClient object with the UploadString method to send data to a remote server. The GoPix banking trojan used LNK-launched PowerShell to POST victim data and receive tasking via WebClient UploadString as documented by Kaspersky. The uploading variant of WebClient is uncommon in benign scripting and indicates outbound command-and-control or data exfiltration.

Suspicious Script Interpreter Spawned by mshta

This rule detects mshta.exe spawning a scripting interpreter such as powershell, wscript or cscript. The Horabot Sapecar infection chain used mshta to launch an HTA that pivoted through JavaScript, VBScript and PowerShell before deploying its Delphi payload as reported by Kaspersky. An mshta process creating a script host child is a strong indicator of a staged living-off-the-land execution chain.

Suspicious Process Execution From Fake Microsoft Edge ExtSvc Directory

This rule detects a process running from a %LOCALAPPDATA%\Microsoft\Edge\ExtSvc directory, a fake path that impersonates the Microsoft Edge browser folder. The CrystalX RAT installs itself under this masquerading Edge subfolder to blend with legitimate browser files as reported by Kaspersky. Execution from this non-existent Edge location indicates the spyware and stealer establishing a hidden foothold.

Suspicious Termination of Telegram Desktop Prior to Session Theft

This rule detects a taskkill command forcibly terminating the Telegram desktop client. The Arkanix stealer kills Telegram.exe before copying its tdata session folder so the locked files can be stolen and used for account takeover as reported by Kaspersky. Forced termination of Telegram by a non-interactive process is a strong precursor to messaging session credential theft.

Suspicious NetSupport Manager Remote Client Execution From User-Writable Path

This rule detects the NetSupport Manager remote control client client32.exe launching from a user AppData or Temp directory instead of a standard installation path. The Stan Ghouls intrusions weaponized NetSupport RAT by dropping client32.exe alongside PCICHEK.DLL into user-writable folders as reported by Kaspersky. Running this legitimate remote access tool from the wrong location indicates unauthorized remote control rather than sanctioned IT usage.

Suspicious Scheduled Task Persistence Running a Batch File at Logon

This rule detects creation of a scheduled task that runs a batch script at user logon with limited run level. The Stan Ghouls campaign delivering NetSupport RAT registered an ONLOGON task pointing at run.bat to survive reboots as reported by Kaspersky. Attackers abuse schtasks logon persistence to relaunch their loader on every session, so this pattern surfaces early foothold establishment.

Suspicious Child Process Spawned by Notepad++ Updater GUP

This rule detects the Notepad++ updater GUP.exe spawning a command shell, curl or a secondary update.exe process. The Notepad++ supply chain attack abused GUP.exe to launch downstream execution chains and a Cobalt Strike loader as documented by Kaspersky. The trusted updater spawning these child processes indicates a compromised update and supply chain execution.

Suspicious Host Reconnaissance Command Chain via cmd

This rule detects a single command shell invocation chaining whoami, tasklist, systeminfo and netstat reconnaissance commands. The Notepad++ supply chain attack ran this exact recon chain and redirected the results to a file as reported by Kaspersky. Bundling these discovery commands in one shell line is a strong automated reconnaissance indicator.

Suspicious Download of Edge Login Data Stealer via curl

This rule detects curl.exe downloading a payload named getlogindataedge.exe. HoneyMyte retrieved this browser credential stealer from its command and control host to harvest Edge login data as documented by Kaspersky. Download of this specifically named stealer indicates tool ingress and credential theft preparation.

Suspicious Sang Loader Execution with Install or PassUAC Arguments

This rule detects the Sang.exe loader executing with its install, work or passuac operation arguments. HoneyMyte used Sang.exe with these command modes to install the CoolClient implant and bypass user account control as described by Kaspersky. Execution of this loader with these mode arguments indicates implant installation and privilege escalation.

Malicious Windows Defender Tampering via Command Line

This rule detects command line tampering that disables Windows Defender real time and behavior monitoring. The Webrat dropper rasmanesc.exe disabled Defender before fetching the payload from its command and control server as reported by Kaspersky. Disabling endpoint protection is a strong defense evasion indicator that typically precedes malware deployment.

Suspicious Fake Sohu Updater Execution

This rule detects execution of an executable whose name contains sohuva_update which impersonates a Sohu software updater. Evasive Panda delivered a fake updater with this naming pattern via DNS poisoning to drop MgBot as reported by Kaspersky. Execution of this masquerading updater indicates drive by compromise and initial payload execution.