Sigma detection rules, expert-reviewed

Malicious BlueNoroff C2 Communication via cur1-agent User-Agent (via proxy)

This rule detects outbound HTTP traffic carrying the distinctive cur1-agent User-Agent string used by BlueNoroff implants, in which the numeral one replaces the letter l in the word curl. This hardcoded agent string identifies the malware download and C2 requests. No legitimate client emits this User-Agent.

Suspicious svchost.exe Execution from Public Directory (via process_creation)

This rule detects a process named svchost.exe running from the public user directory, a masquerade used by PXA Stealer where a disguised Python interpreter impersonated the Windows service host. Genuine svchost.exe only executes from the Windows system directories. Execution from Users Public indicates process name masquerading.

Malicious PXA Stealer Archive Extraction via Renamed WinRAR images.png (via process_creation)

This rule detects execution of a WinRAR command-line binary renamed to images.png, which PXA Stealer used to extract password-protected archives while masquerading as an image file. A process image ending in an image extension is a strong sign of masquerading. The extraction unpacks the next-stage payload to a public directory.

Malicious FIN7 AvNeutralizer EDR Killer Execution via Masqueraded Binary (via process_creation)

This rule detects execution of the FIN7 userland components that tamper with and disable endpoint security products. The binaries follow a consistent naming convention that references specific security vendors. Their execution indicates an attempt to blind defensive tooling before deploying ransomware or implants.

Malicious HUI Loader DLL Side-Loading via McAfee mfeann.exe (via image_load)

This rule detects HUI Loader side-loading, where the legitimate signed McAfee binary mfeann.exe loads an attacker-supplied LockDown.dll. This pairing was used against the Asian gambling sector to run encrypted payloads under a trusted process. The DLL name loaded by this specific host executable is a strong side-loading indicator.

Malicious NimDoor Loader Persistence via Masqueraded Google Updater (via file_event)

This rule detects the NimDoor loader binary that DPRK actors dropped under Application Support while impersonating a Google updater, using a capital letter I in place of the lowercase l in the file name GoogIe LLC. The loader launches the CoreKitAgent trojan and installs a LaunchAgent for persistence. The homoglyph file name is a reliable indicator of this macOS implant.

Malicious BlueNoroff Zshenv Persistence Marker Creation via tmp Init File (via file_event)

This rule detects the marker file that BlueNoroff writes to signal successful installation of its novel Zshenv persistence during the Hidden Risk campaign. The malware abuses the shell configuration file that is sourced for every Zsh session and drops a hidden success marker under tmp. The marker file name is unique to this implant.

Suspicious NetSupport client32 Persistence via Run Key from ProgramData

This rule detects a Run key value referencing client32.exe staged under ProgramData. ClickFix operators deploy the NetSupport remote access tool as client32.exe and persist it through the CurrentVersion Run key. A remote control agent auto-started from ProgramData is a common abuse of otherwise legitimate NetSupport Manager software.

Suspicious Run Key Persistence Named NvidiaDriverUpdate (via registry_set)

This rule detects creation of a Run key value named NvidiaDriverUpdate for persistence. The Lazarus ClickFake Interview campaign registers this autorun entry to relaunch its loader while impersonating a driver updater. A Run value with this masquerading name is characteristic of the campaign persistence.

Suspicious TermService ServiceDll Hijack via Registry (via registry_set)

This rule detects modification of the TermService ServiceDll registry value used to hijack the Remote Desktop service host. The RATatouille intrusion repoints this value to a malicious DLL so its code loads inside the legitimate service for stealthy persistence and remote access. Overwriting the TermService ServiceDll is rarely legitimate and strongly indicates a service DLL hijack.

Malicious Windows Defender Tampering via Set-MpPreference and Add-MpPreference (via ps_script)

This rule detects PowerShell disabling Windows Defender sample submission and adding path exclusions through Set-MpPreference and Add-MpPreference. The RATatouille intrusion uses these commands to blind the antivirus by setting SubmitSamplesConsent to NeverSend and excluding its payload directory. Tampering with Defender preferences is a strong signal of attacker defense evasion.

Suspicious PowerShell AMSI Bypass via 8220 Gang Hadooken Loader

This rule detects PowerShell code that patches the Anti-Malware Scan Interface by reflectively accessing amsiInitFailed or the AmsiUtils type to disable in memory scanning. The 8220 gang uses an AMSI bypass before launching its CCleaner64.exe branded loader in the Hadooken campaign. Disabling AMSI is a common precursor to fileless payload execution and rarely appears in benign scripts.

Malicious Silver Fox Stealer Exfiltration Using WhatsAppBackup User Agent

This rule detects outbound requests using the WhatsAppBackup 1.0 user agent associated with the Silver Fox Python stealer. The stealer uploads collected victim data to a web service while presenting this custom agent. Because no legitimate WhatsApp client uses this string it is a reliable exfiltration indicator.

Suspicious Interlock Backdoor C2 Beacon to init1234 Endpoint (via proxy)

This rule detects HTTP POST requests to the init1234 endpoint used by the Interlock PowerShell backdoor for command and control. The Interlock ransomware operators register their compromised hosts by beaconing to this fixed URI. The specific init1234 path combined with the POST method reveals active backdoor communication.

Malicious DDoSia Client C2 Check-In via Fixed User-Agent

This rule detects the NoName057(16) DDoSia client registering with its C2 by POSTing to a /client/login endpoint using a hardcoded legacy Gecko User-Agent. The combination of that outdated User-Agent string and the login path identifies the DDoS bot fetching its target list.