Sigma detection rules, expert-reviewed

Possible UAC Bypass via easinvoker Spawning Batch Script (via process_creation)

This rule detects the trusted Windows binary easinvoker.exe spawning a command shell running a batch script. This mock-trusted-directory DLL hijack UAC bypass was observed in the MULTI#STORM campaign to elevate and execute KDECO.bat.

Suspicious Payload Staging in ProgramData IntelDriver Folder (via file_event)

This rule detects creation of an encrypted shellcode container named boot64x.w inside an IntelDriver directory under ProgramData. The Dead#Vax campaign staged its AsyncRAT shellcode at this path before process injection.

Suspicious Fake ACPIx86 Driver File Creation (via file_event)

This rule detects creation of a driver file named ACPIx86.sys in the system drivers directory. The OBSCURE#BAT campaign dropped this fake driver, whose name imitates a legitimate Windows component, as part of its rootkit deployment.

Suspicious Keylogger Output File in Windows Themes Folder (via file_event)

This rule detects creation of a version.xml file under the Windows Themes directory. The DEEP#GOSU campaign wrote captured keystrokes and clipboard data to this path, disguising keylog output as a theme resource.

Malicious WordPress Core SQL Injection Scanner via User-Agent

This rule detects HTTP requests carrying a User-Agent string that self identifies the CVE-2026-63030 exploitation tool. Attackers probe the WordPress REST batch endpoint for a UNION based SQL injection using this distinctive automated client marker.

Suspicious In-Memory Runspace Execution via PowerShell Script Block

This rule detects PowerShell script content that creates a new runspace and passes deobfuscated code to Invoke-Expression. A profile resident backdoor uses a dedicated runspace and script block to run its command and control loop in memory without touching disk.

Suspicious PowerShell Payload Extraction from PNG Polyglot via findstr

This rule detects use of the findstr utility to extract an appended PowerShell payload from a PNG image and pipe it into PowerShell for execution. This polyglot steganography technique conceals script code after the PNG end marker so it can be recovered with a native search utility and run in memory.

Suspicious Python Inline Deobfuscation and Execution One-Liner

This rule detects a Python process executing an inline one liner that base64 decodes and zlib decompresses a blob and passes it to exec. Stealer payloads wrap their real logic in dozens of nested decode and decompress layers invoked through this pattern to defeat static analysis.

Suspicious Hidden PowerShell WebClient DownloadFile Cradle

This rule detects a hidden PowerShell process using the WebClient DownloadFile method to retrieve a remote file. A crypto stealer campaign uses this cradle with a hidden window to pull a decoy document and a bundled Python runtime from cloud file hosting.

Possible DarkGate Process Injection via iTunesHelper Spawning vbc.exe

This rule detects the Apple iTunesHelper binary spawning the Visual Basic command line compiler vbc.exe. DarkGate hollows out vbc.exe as a benign looking host process to execute its final shellcode after DLL sideloading, a parent child relationship that does not occur in normal iTunes operation.

Suspicious PowerShell Download Cradle with Spoofed User-Agent via MSIX

This rule detects a PowerShell download cradle that fetches and executes remote content while presenting a spoofed browser User-Agent string. A malicious MSIX package runs an obfuscated startup script that combines Invoke-WebRequest and Invoke-Expression to pull a next stage from an attacker server.

Suspicious .NET LOLBin Execution via CasPol or RegAsm

This rule detects execution of the .NET Framework utilities CasPol.exe or RegAsm.exe spawned by a script interpreter. Batch and PowerShell loaders abuse these signed developer tools to load and run reflectively decrypted assemblies while bypassing application control.

Suspicious Renamed PowerShell Copied from System32 via Batch Loader

This rule detects a command that copies the legitimate PowerShell executable from System32 to a new filename ending in exe. A multi payload batch loader clones powershell.exe under an attacker chosen name so its hidden execution of embedded base64 payloads evades name based detection.

Suspicious Python Process Establishing PostgreSQL Command and Control Channel

This rule detects a Python interpreter initiating outbound connections to the PostgreSQL service port. A commodity stealer abuses a PostgreSQL database as its command-and-control transport, storing victim registration and retrieving tasking through SQL queries instead of HTTP.

Possible DarkGate DLL Sideloading via iTunesHelper Loading CoreFoundation

This rule detects the signed Apple iTunesHelper binary loading a CoreFoundation DLL from a non standard directory. DarkGate abuses DLL search order hijacking by placing a malicious CoreFoundation.dll next to a legitimate Apple executable to proxy execution of its packed payload.