Sigma detection rules, expert-reviewed

Malicious Remote HTA Execution Disguised as Media File via mshta (via process_creation)

This rule detects mshta.exe executing a remote HTA payload whose URL is disguised with an audio or video file extension. The ClearFake ClickFix variant delivers its loader as an HTA masquerading as an mp3 mp4 or m4a file fetched over HTTP. Combining the mshta living-off-the-land binary with a remote media-named URL is a reliable indicator of drive-by compromise.

Suspicious COM Handler Hijack of MsCtfMonitor CLSID via CharmingCypress

This rule detects registration of a COM InprocServer32 handler under the MsCtfMonitor task CLSID which CharmingCypress hijacked for persistence and code execution. Hijacking this scheduled-task COM object causes attacker code to load when the task triggers. This technique blends malicious execution into legitimate Windows components.

Malicious Volume Shadow Copy Deletion via WMI PowerShell (via process_creation)

This rule detects PowerShell querying the Win32_Shadowcopy WMI class and invoking a delete or remove operation to destroy volume shadow copies. Akira used this to inhibit system recovery before encryption. Removing shadow copies prevents victims from restoring files without paying the ransom.

Malicious Wscript Executing Temp File as JavaScript (via process_creation)

This rule detects wscript or cscript invoking the JavaScript engine against a file with a tmp extension, the execution behavior of a Konni AsyncRAT chain that runs 83972.tmp as JavaScript from ProgramData. Adversaries leverage the engine override switch to run script content from a mismatched temp extension while evading extension based controls, making early detection critical for surfacing the scripting stage before further payload execution.

Malicious Webserver IIS Module Installed - Command (via process_creation)

This rule detects deploy an IIS module.

Malicious Account Added to Domain Admins Group via net Command

This rule detects the net command adding an account to the Domain Admins group, a privilege escalation step observed during Gootloader post-exploitation where a rogue account was joined to Domain Admins. Elevating an attacker-controlled account to domain administrator grants full directory control. Domain Admins membership changes from the command line are rare and high risk.

Suspicious rundll32 Loading DEEPDATA data.dll with mod.dat Key via BrazenBamboo

This rule detects rundll32 loading data.dll together with a mod.dat argument the loading pattern of the BrazenBamboo DEEPDATA malware framework. DEEPDATA decrypts its payload using the mod.dat key file. Proxy execution via rundll32 helps evade application controls and disguise malware as a signed process.

Malicious Silver Fox Scheduled Task Persistence via AppClient (via process_creation)

This rule detects schtasks.exe creating a minute interval task named AppClient, the persistence mechanism used by the Silver Fox ABCDoor backdoor to repeatedly relaunch itself. The high frequency task keeps the implant resident after a tax notification phishing compromise. Detecting the AppClient task creation surfaces backdoor persistence.

Malicious Volume Shadow Copy Deletion via vssadmin by Medusa Ransomware

This rule detects use of vssadmin to delete all volume shadow copies quietly, matching the inhibit-recovery step performed by Medusa ransomware before encryption per Unit 42. Ransomware wipes shadow copies to prevent victims from restoring files which is a strong pre-encryption indicator of an active ransomware attack.

Malicious Fileless PowerShell Registry Payload Execution via Process Creation

This rule detects hidden PowerShell that reads a payload from a registry value and pipes it to Invoke-Expression. StripedFly stores its encrypted loader under an HKCU Applets key and executes it fileless via hidden PowerShell with IEX, achieving stealthy in-memory execution.

Batch Script Execution From RECYCLERS.BIN Masquerade Directory

This rule detects process execution referencing a RECYCLERS.BIN directory, a masquerade of the Windows Recycle Bin used as a hidden staging location in the DLL side-loading campaign to run tmp.bat. Executing scripts from a directory imitating the Recycle Bin is a defense-evasion and staging indicator.

TinyLoader Persistence via txtfile Shell Open Command Hijack (via registry_set)

This rule detects modification of the txtfile shell open command handler so that opening any text file first launches an attacker binary, the file-association hijack TinyLoader uses for persistence. Adversaries leverage this handler so the loader runs whenever a user opens a .txt file, then still opens the file to avoid suspicion.

Operator Bring Your Own Tools

Detects use of custom scripts i.e. BAT files.

Masquerading Kerberos Ticket Abuse via Rubeus (via process_creation)

This rule detects Rubeus command-line actions such as kerberoast, asreproast and tgtdeleg, which request and extract Kerberos tickets for offline cracking or impersonation. Rubeus-driven Kerberos abuse is a credential-access technique tracked in the Red Canary Threat Detection Report. Detecting these actions surfaces ticket theft aimed at privilege escalation.

Malicious PyPI Package Installation from Gleaming Pisces Supply Chain (via process_creation)

This rule detects installation of the malicious PyPI packages real-ids, coloredtxt, beautifultext, or minisound published by Gleaming Pisces to deliver the PondRAT backdoor. Installing these poisoned packages compromises developer and build systems through the software supply chain.