Sigma detection rules, expert-reviewed

Suspicious Sang Loader Execution with Install or PassUAC Arguments

This rule detects the Sang.exe loader executing with its install, work or passuac operation arguments. HoneyMyte used Sang.exe with these command modes to install the CoolClient implant and bypass user account control as described by Kaspersky. Execution of this loader with these mode arguments indicates implant installation and privilege escalation.

Malicious Windows Defender Tampering via Command Line

This rule detects command line tampering that disables Windows Defender real time and behavior monitoring. The Webrat dropper rasmanesc.exe disabled Defender before fetching the payload from its command and control server as reported by Kaspersky. Disabling endpoint protection is a strong defense evasion indicator that typically precedes malware deployment.

Suspicious Fake Sohu Updater Execution

This rule detects execution of an executable whose name contains sohuva_update which impersonates a Sohu software updater. Evasive Panda delivered a fake updater with this naming pattern via DNS poisoning to drop MgBot as reported by Kaspersky. Execution of this masquerading updater indicates drive by compromise and initial payload execution.

Suspicious PowerShell Execution of AdobeMon Script with Bypass Policy

This rule detects PowerShell running a script named AdobeMon.ps1 with an execution policy bypass. Cloud Atlas launched an AdobeMon PowerShell payload with the bypass policy as documented by Kaspersky. The combination of the bypass flag and this specific script name indicates malicious PowerShell execution and defense evasion.

Malicious Scheduled Task Masquerading as VLC or Adobe Update

This rule detects the creation of a scheduled task named to impersonate a VLC or Adobe update task. Cloud Atlas established persistence with tasks named MicrosoftVLCTaskMachine and MicrosoftAdobeUpdateTaskMachine as reported by Kaspersky. These specific masquerading task names combined with schtasks creation indicate malicious persistence.

Suspicious wscript Execution of MicrosoftEdgeUpdate VBS Masquerade

This rule detects the Windows Script Host running a script named MicrosoftEdgeUpdate.vbs. The Cloud Atlas group used a VBS masquerading as a Microsoft Edge updater executed through wscript as described by Kaspersky. Genuine Edge updates do not run a VBScript by this name so execution through the script host indicates masquerading and malicious script execution.

Suspicious rundll32 Execution of IconCache Masquerading DLL

This rule detects rundll32.exe executing a DLL located in the Explorer icon cache directory with an iconcache prefixed name. In Operation ForumTroll rundll32 was used as a proxy to load the payload DLL dropped to this path as reported by Kaspersky. Proxied execution of a masquerading DLL from a user profile cache directory is a strong signed binary proxy and defense evasion indicator.

Suspicious Reconnaissance and Payload Download by Node Web Process

This rule detects a Node.js process spawning reconnaissance or download utilities such as whoami, wget and curl. Kaspersky observed CVE-2025-55182 exploitation using a deserialization gadget that reaches child_process execSync to run these commands from the web application context. This process ancestry indicates remote code execution and payload staging following successful exploitation.

Suspicious Child Process Spawned by Control Panel DCOM Surrogate

This rule detects the dllhost.exe DCOM surrogate hosting the CoOpenControlPanel CLSID {06622D85-6856-4460-8DE1-A81921B41C4B} and spawning a command shell or interpreter. Kaspersky reported this DCOM object being abused to load a malicious CPL into dllhost.exe for lateral movement. Child process creation under this specific surrogate indicates remote code execution used to move laterally between hosts.

Suspicious DCOM Command Execution with Output Redirection to ADMIN Share

This rule detects cmd.exe running with quiet and command flags while redirecting output to a local ADMIN$ share through a loopback UNC path. This command pattern is used by DCOM based lateral movement tooling that abuses the CoOpenControlPanel object as documented by Kaspersky. Attackers run commands on a remote host and collect the results over SMB which enables stealthy lateral movement across the network.

Suspicious Downloader Writing to Public Libraries Directory

This rule detects download utilities such as bitsadmin, certutil, or curl retrieving files into the Public Libraries directory, a staging location used by the Tomiris APT. The actors fetched Havoc and AdaptixC2 payloads into $public\libraries to blend with rarely inspected shared folders. Using a download LOLBin to write into the Public user profile is a strong indicator of ingress tool transfer for later execution.

Suspicious LSASS Process Enumeration via tasklist Filter

This rule detects tasklist being filtered for the lsass process, a reconnaissance step used before credential dumping in the 2025 NTLM abuse activity. Attackers query tasklist and filter for lsass to obtain its process id ahead of a memory dump. While administrators occasionally enumerate processes, specifically targeting lsass by name is a suspicious precursor to credential access.

Malicious LSASS Credential Dump via rundll32 and comsvcs MiniDump

This rule detects rundll32 invoking the comsvcs.dll MiniDump export to dump the memory of LSASS, a credential theft technique observed in the 2025 NTLM abuse campaigns. Attackers call comsvcs.dll MiniDump against the LSASS process id to write its memory to disk and later extract secrets. This is a well-established living-off-the-land method for harvesting cached credentials and NTLM hashes.

Suspicious PowerShell Execution Bypass Running Script From ProgramData

This rule detects PowerShell launched with an execution policy bypass to run a script stored in C\ProgramData, matching the ToddyCat loader that executed c\programdata\ip445.ps1. Staging scripts in the world-accessible ProgramData directory and bypassing execution policy is a common tradecraft for running attacker tooling with minimal friction. The combination is unusual for legitimate administrative scripts.

Suspicious node.exe Execution From LocalAppData Directory

This rule detects the Node.js runtime node.exe running from a user LocalAppData nodejs directory, the location abused by the Tsundere botnet. The malware ships its own Node.js runtime under %LOCALAPPDATA%\nodejs and executes malicious JavaScript through it. Legitimate Node installations typically live under Program Files, so a node.exe launched from LocalAppData indicates a bundled malicious runtime executing attacker script.