Sigma detection rules, expert-reviewed

Suspicious MSBuild Execution of MSHI Metafile via cmd (via process_creation)

This rule detects cmd.exe launching msbuild with a metafile that has an mshi extension a loader pattern used by the PipeMagic backdoor. PipeMagic was seen in RansomExx activity and in exploitation of the CVE-2025-29824 privilege escalation. Abusing the trusted MSBuild binary to compile and run an inline task lets the operator execute code while evading application controls.

Suspicious Chrome Masquerade Running from ProgramData Google Path (via process_creation)

This rule detects a process named chrome.exe executing from a google folder under ProgramData as used by the GodRAT browser-credential stealer. The genuine Chrome browser installs under Program Files or the user AppData not ProgramData so this path is a masquerade. Running a fake chrome from ALLUSERSPROFILE indicates the stealer harvesting saved browser secrets.

Suspicious GodRAT Shellcode Injection via Puppet Argument (via process_creation)

This rule detects execution of curl.exe or cmd.exe with a -Puppet argument which GodRAT abuses as an injection target and marker to run its shellcode inside a benign process. GodRAT is a remote access tool targeting financial institutions and delivered through Skype using script and screensaver files. The unusual -Puppet switch on these system binaries is a distinctive sign of the loader.

Suspicious wscript Executing Single-Letter VBS Loader

This rule detects wscript or cscript running one of the single-letter helper scripts a.vbs b.vbs or m.vbs dropped by the malicious Cursor extension chain. These VBScripts stage the ScreenConnect installer and downstream Quasar and PureLogs payloads. The specific script names invoked by the Windows Script Host are a reliable campaign artifact.

Suspicious Cursor Editor Process Spawning PowerShell

This rule detects the Cursor AI editor spawning PowerShell which a malicious open-source extension abuses to run its payload through the trusted editor process. This supply-chain compromise turned a Cursor package into a crypto heist that deployed Quasar and PureLogs via ScreenConnect. A code editor launching PowerShell is an uncommon and high-value execution path to monitor.

Suspicious computerdefaults.exe Spawning Child Process

This rule detects computerdefaults.exe launching a child process which indicates the auto-elevating binary is being abused for a ms-settings UAC bypass. The Batavia spyware chains this to run its payload with elevated privileges without a consent prompt. A child process under computerdefaults.exe is unusual since the tool normally opens a settings UI only.

Malicious Root Certificate Installation via certutil

This rule detects certutil adding a certificate to the LocalMachine Root store which BrowserVenom performs so its proxy can transparently intercept TLS traffic. Installing an attacker certificate into the trusted root store undermines HTTPS validation across the whole system. Root store additions by certutil outside managed deployments deserve scrutiny.

Suspicious Browser Launched With Injected Proxy Server Argument

This rule detects a web browser process started with a --proxy-server argument which BrowserVenom injects through a malicious shortcut to route all victim traffic through an attacker-controlled proxy. This lets the operator intercept and manipulate browsing including credential and cryptocurrency theft. A browser forced onto an external proxy via its command line is a strong tampering signal.

Suspicious tmp Download and Execute Chain on Embedded Linux

This rule detects a shell chain that changes into the tmp directory fetches a payload with wget grants it full permissions with chmod and executes it which is the classic Mirai infection sequence on DVR and IoT devices. This variant uses it to deploy an ARM Mirai bot after exploiting CVE-2024-3721. The download and chmod and execute pattern in tmp is a strong IoT botnet indicator.

Suspicious blat Utility Used for SMTP Data Exfiltration

This rule detects use of the blat command-line mailer with server and attachment arguments which the Librarian Ghouls APT abuses to email stolen data out over SMTP. Blat is a legitimate but uncommon utility that provides a simple exfiltration channel over an alternate protocol. Its presence sending attachments to an external server on endpoints is suspicious.

Suspicious Scheduled Task for Nightly Wake and Shutdown Automation

This rule detects schtasks creating tasks that wake the machine and launch a browser or shut it down at fixed early-morning hours which the Librarian Ghouls APT uses to operate while victims are away. This nocturnal scheduling hides data theft and mining activity from users. Task names combining wake or shutdown with power configuration are characteristic of the campaign.

Suspicious masscan Scanning Docker API Port 2375

This rule detects masscan being launched with port 2375 as a target which the Dero miner worm uses to discover exposed unauthenticated Docker Engine APIs for propagation. Finding open 2375 endpoints is the first step in the container cryptojacking spread. A masscan invocation aimed at the Docker daemon port on an infected host indicates active worming.

Suspicious kswapd0 Masquerading Miner Process

This rule detects a process named kswapd0 executing from a user-writable path rather than existing only as a kernel thread which the Outlaw botnet uses to disguise its UPX-packed XMRig miner. Naming the miner after a legitimate kernel worker hides it from casual process inspection. Any on-disk kswapd0 binary in a home or tmp directory is anomalous.

Malicious SSH authorized_keys Overwrite With Outlaw Marker

This rule detects shell activity that writes the attacker marker mdrfckr into an SSH authorized_keys file which the Outlaw botnet uses to plant its own key and lock out other access. This grants durable remote access to the compromised Linux host for the mining operation. The hardcoded comment string alongside authorized_keys manipulation is a strong Outlaw indicator.

Suspicious PIF AutoIt Interpreter Executing a3x Compiled Script

This rule detects a renamed AutoIt interpreter with a .pif extension executing a compiled .a3x script. This packaging is used in Lumma Stealer delivery to run obfuscated AutoIt payloads while hiding the interpreter behind an unusual extension. The .pif image plus .a3x argument is a strong behavioral indicator of AutoIt-based loaders.