Sigma detection rules, expert-reviewed

Malicious AMSI and ETW Patching via PowerShell Script

This rule detects PowerShell script content that references AmsiScanBuffer or EtwEventWrite in order to patch the Antimalware Scan Interface and Event Tracing for Windows, an in-memory evasion step UAT-11795 performs before injecting the Starland RAT as reported by Cisco Talos. Tampering with these logging and scanning interfaces blinds defenses. Detecting the patch strings exposes active defense evasion in the loader.

Malicious PowMix AMSI Bypass via amsiInitFailed

This rule detects PowerShell script content that forces the amsiInitFailed condition to disable the Antimalware Scan Interface, matching the PowMix botnet loader targeting Czech users. Setting amsiInitFailed causes AMSI to skip scanning subsequent in-memory payloads, letting the fileless PowMix stager execute undetected. Presence of this bypass in script telemetry is a high-confidence evasion indicator.

Malicious BadIIS C2 Communication via lwxatisme User-Agent

This rule detects HTTP traffic carrying the User-Agent string lwxatisme, a fixed marker used by the commodity BadIIS ecosystem tracked by Talos to authenticate to its C2. The BadIIS native IIS module keys off this hardcoded agent to gate operator commands. Presence of this User-Agent indicates a BadIIS-infected server communicating with its controller.

Malicious GhostLocker2 C2 Communication via HTTP POST (via proxy)

This rule detects HTTP POST requests to the GhostLocker2 command-and-control endpoints /addInfection and /incrementLaunch used by GhostSec ransomware. These beacons report new infections and launch counts to the operator panel and indicate active ransomware deployment.

Malicious Msiexec Execution of Staged Update Package via Process Creation

This rule detects msiexec.exe executing the update_ms.msi package staged in ProgramData, the installer proxy-execution step that loads the msaRAT lib.dll RUN export as reported by Cisco Talos in the Chaos ransomware campaign. Running a fetched MSI from ProgramData under msiexec launches the covert browser C2 implant. Detecting this execution catches proxy execution of the malicious installer after ingress.

Malicious Curl MSI Download to ProgramData via Process Creation

This rule detects curl.exe downloading a Windows Installer package into the ProgramData directory, the payload staging behavior of the Chaos ransomware msaRAT loader reported by Cisco Talos. The tool fetches update_ms.msi from an attacker IP and writes it to ProgramData before execution. Detecting this retrieval catches ingress of the MSI that unpacks the covert browser-based C2 implant.

Malicious SD-WAN Compromise Credential Theft via loot_run.sh

This rule detects execution of the loot_run.sh script used in the Cisco Catalyst SD-WAN exploitation to harvest credentials from compromised appliances. The named script automates collection of secrets for follow-on access and lateral movement across the network. Any invocation of this campaign-specific script indicates active credential theft.

Malicious UAT-8302 Remote Process Execution via wmic

This rule detects wmic invoking process call create against a remote node, matching UAT-8302 tradecraft that uses WMI to execute commands on other hosts for lateral movement. Remote process creation over WMIC is a hallmark of hands-on-keyboard spread and is rare in normal administration. Correlate the target node and spawned process to scope the intrusion.

Suspicious CloudZ RAT Payload Download via curl to ProgramData

This rule detects curl saving a remote file into the ProgramData Microsoft WindowsDoc directory, matching the CloudZ RAT staging chain that writes update.txt into a fabricated WindowsDoc folder. Downloading a payload directly into a Microsoft-themed ProgramData path masquerades attacker tooling as system content. This ingress behavior indicates active payload retrieval.

Malicious CloudZ RAT Persistence via schtasks Running regasm.exe

This rule detects a scheduled task created to run onstart as SYSTEM that launches regasm.exe, matching the CloudZ RAT which registers a boot-time task to execute its .NET loader through the regasm LOLBin. Chaining an onstart SYSTEM task to a trusted Microsoft signed binary gives the implant privileged persistence while evading application controls. This combination is a strong indicator of CloudZ deployment.

Malicious Bad Apples Remote Apple Events Lateral Movement via osascript

This rule detects osascript invoking an eppc URL, matching the Bad Apples technique that weaponizes Remote Apple Events over TCP 3031 for lateral movement across macOS hosts. Sending AppleScript to a remote host via the eppc scheme lets an operator execute code on another Mac using native primitives. Such cross-host osascript activity is rarely benign and indicates hands-on movement.

Suspicious n8n Campaign RMM Installer Masquerading as OneDrive Document

This rule detects execution of a binary named DownloadedOneDriveDocument.exe, matching the n8n webhook CAPTCHA campaign that delivers a modified Datto RMM agent under a document-themed filename. Naming a remote management installer to look like a downloaded OneDrive document tricks users into running the RMM foothold. Execution of this file indicates delivery of the abused remote access tooling.

Suspicious Axios NPM macOS Persistence Masquerading as Apple Service

This rule detects references to the launchd label com.apple.act.mond spawned through zsh, matching the macOS payload of the Axios NPM supply chain incident. The malware masquerades its persistence agent as a legitimate Apple system service name to blend into launchd inventories. A non-Apple process registering or invoking this fabricated com.apple label indicates supply chain compromise.

Suspicious UAT-10608 Hidden Credential Harvesting Script Execution via nohup

This rule detects a hidden dot-prefixed shell script under /tmp being launched via nohup, matching the UAT-10608 automated credential harvesting operation against web applications. The operators detach a shell script staged as /tmp/.<random> so it survives session termination while iterating credential-theft phases. Backgrounded execution of hidden temporary scripts indicates hands-on-keyboard compromise and warrants immediate triage.

Suspicious Hidden Local Account Creation via Net User by UAT-8099

This rule detects creation of a local account whose name ends with a dollar sign which hides it from standard enumeration. UAT-8099 creates hidden accounts such as admin and mysql with a trailing dollar sign for stealthy persistence. Hidden accounts let an actor retain access while evading routine account audits.