Sigma detection rules, expert-reviewed

Malicious Print Spooler Privilege Escalation via Printer Added - CVE-2020-1048 (via powershell)

This rule detects abuse the printer spooler features to load a DLL. The attack is composed by 4 steps > 1) create a printer that points to a missing DLL 2) print to that port 3) crash the printer spool 4) have his original DLL registered for privilege escalation.

Malicious WARMCOOKIE DLL Execution from RtlUpd Path via rundll32

This rule detects rundll32.exe executing a DLL from the C:\ProgramData\RtlUpd directory, the fixed drop path and loader behavior of the WARMCOOKIE backdoor. The malware writes RtlUpd.dll to this ProgramData location and runs it via rundll32 to establish its foothold.

Malicious DLL Sideloading of BrMod104.dll by Stately Taurus (via image_load)

This rule detects the loading of BrMod104.dll, a malicious module sideloaded by the Stately Taurus (Mustang Panda) group to deploy the Bookworm and PubLoad malware families. DLL sideloading via a signed host executable lets the actor execute code while evading application controls and blending with legitimate processes.

Malicious SesameOp Netapi64 Artifact Files Written to Windows Temp (via file_event)

This rule detects creation of SesameOp working files such as Netapi64.start and Netapi64.Exception in Windows Temp along with files carrying the .Netapi64 extension. These artifacts are dropped by the SesameOp backdoor while it decrypts payloads and stores state for its OpenAI Assistants API C2 relay. Surfacing these distinctive on-disk markers reveals an active backdoor foothold that hides its traffic inside a legitimate cloud API.

Suspicious fontdrvhost Execution with Config Argument

This rule detects a process named fontdrvhost.exe executed with a config file argument, a masquerading pattern from the REF7707 campaign where a renamed tool was staged via a scheduled task named EPolicyManager. The genuine Windows font driver host takes no such command line arguments so this indicates an impostor binary. Combined with scheduled task execution this reveals attacker persistence and execution.

Suspicious Scheduled Task Persistence Masquerading as TeamViewer (Qilin)

This rule detects creation of a scheduled task named TVInstallRestore configured to run at user logon. The Qilin ransomware group creates this task, masquerading as a TeamViewer component, to persist and restore access. Logon-triggered scheduled tasks with deceptive names are a common persistence technique.

Malicious Fake Homebrew Installer Execution via curl to Typosquatted Domain (via process_creation)

This rule detects a shell one-liner that curls an install script from the typosquatted homabrews domain and pipes it to bash, the ClickFix delivery behavior for Cuckoo Stealer on macOS. Adversaries leverage a fake Homebrew install command copied from a lure page to fetch and run the first-stage payload.

Reported BINDCLOAK Encrypted Payload File Event

Detects file telemetry for the exact encrypted payload filename shown in the attack-flow image. It covers the file IOC, not the decryption or reflective loading behavior.

Malicious SesameOp Netapi64 Loader DLL Load via Masqueraded Netapi Module (via image_load)

This rule detects loading of Netapi64.dll, a loader module used by the SesameOp backdoor that masquerades as a legitimate Windows networking library while relaying commands through the OpenAI Assistants API for command and control. Adversaries use this .NET loader to decrypt and execute payloads under a trusted-looking name, so catching the module load exposes the implant before its covert C2 channel activates.

Malicious APT-C-60 SpyGlace Masqueraded Artifact Files (via process_creation)

This rule detects command lines referencing the iconcache.dat, Cached2014.tmp, sdll.tmp, or sDll_jj.dll artifacts dropped by APT-C-60 in its 2026 SpyGlace intrusions. These deliberately mundane cache and temp filenames masquerade loader and backdoor components to blend with legitimate system files.

DCOM Lateral Movement - Via MMC20 (via powershell)

This rule detects execute the Impacket DCOMexec tool in order to abuse DCOM services.

Malicious mshta.exe Spawning bitsadmin via ClickFix Phantom Meet

This rule detects mshta.exe spawning bitsadmin.exe, the process chain produced by the ClickFix Phantom Meet campaign where a pasted clipboard command runs a remote HTA that then uses bitsadmin to download follow on executables. Neither mshta launching bitsadmin nor this fake meeting lure is normal user behavior. The parent child relationship is a high confidence detection of the ClickFix delivery chain.

Suspicious Mshta Execution of Remote Payload from Explorer via ClickFix Lure (via process_creation)

This rule detects mshta launched by explorer with a remote http argument, the ClickFix fake CAPTCHA pattern where a user pastes an attacker command into the Run dialog to fetch a remote HTA.

Malicious LockBit Rundll32 Execution With gdll Export and -pass Argument

This rule detects rundll32.exe invoking a DLL export named gdll together with a -pass argument, the loader pattern used by LockBit 3.0 payloads staged from a batch file on the user Desktop. Huntress observed operators abusing a TeamViewer session to drop and run this payload for ransomware deployment. Catching the export and password-flag combination flags encryptor execution before file encryption completes.

Malicious Anonymous Access Performed to Multiple Targets (via security)

This rule detects would attempt to enumerate hosts and collect relevant information using anonymous access. Vulnerability scanners, enumeration software or tool like CrackMapexec may generate such behavior.