Sigma detection rules, expert-reviewed

Suspicious ping Loopback Delay Chained With Payload Execution

This rule detects ping.exe issuing a high count of echo requests to localhost which malware uses as a sleep timer to evade sandbox analysis. Lumma Stealer distribution chains use a ping delay to loopback before launching subsequent stages. The large repeat count against localhost is uncommon in legitimate automation.

Suspicious mshta.exe Executing Remote Media-Extension URL

This rule detects mshta.exe invoked against a resource with a media file extension such as mp3 mp4 or png that actually hosts embedded HTA script. This proxy-execution trick is used by Lumma Stealer fake CAPTCHA campaigns to disguise the payload behind a benign-looking media URL. Detecting the mismatched extension exposes the living-off-the-land download and execution.

Suspicious msinfo32.exe Executed From ViPNet Update Directory

This rule detects msinfo32.exe running from a ViPNet update temporary directory instead of the System32 path indicating a malicious loader planted under a trusted filename. This masquerade is used by a backdoor delivered as fake ViPNet software updates to load the next stage while blending in with legitimate update activity. The wrong-path plus trusted-name combination is a strong sideloading signal.

Malicious ViPNet Backdoor Loader via lumpdiag.exe Path Substitution

This rule detects lumpdiag.exe being started with the --msconfig argument that triggers path substitution to load a malicious msinfo32.exe from the ViPNet update directory. This behavior is used by a backdoor masquerading as ViPNet secure networking software updates against Russian organizations to achieve execution through a trusted binary. Detecting it exposes the DLL/binary search-order hijack that bootstraps the loader chain.

Malicious CiscoCollabHost Execution From AppData Path via process_creation

This rule detects the Cisco collaboration host executable running from a user AppData directory which indicates it is being abused as a DLL sideloading host rather than the genuine installed application. IronHusky deployed CiscoCollabHost.exe from an AppData Cisco plugins path to sideload a malicious CiscoSparkLauncher.dll and load the MysterySnail RAT. Legitimate Cisco software runs from Program Files so an AppData copy is highly suspicious.

Malicious Mshta Spawned by WMI or WinRM Provider via process_creation

This rule detects mshta.exe launched by the WMI provider host or the WinRM host process which indicates remote or lateral proxy execution of an HTA payload. GOFFEE triggered mshta.exe from wmiprvse.exe and wsmprovhost.exe to run remote HTA content while blending with management traffic. This parent child relationship is abnormal and points to hands-on remote code execution.

Malicious Netcat SSL Reverse Shell Execution via process_creation

This rule detects a command line that combines the ssl option with the execute flag pointing to cmd.exe which is characteristic of an ncat or netcat encrypted reverse shell. The SourceForge campaign ran a renamed netcat as ShellExperienceHost.exe to connect out over SSL and hand a command shell to the attacker. An encrypted process backconnect to a remote host is a clear command and control indicator.

Suspicious Browser Remote Debugging Port Cookie Theft via process_creation

This rule detects a Chromium based browser launched with the remote-debugging-port switch which attackers use to attach to the browser and steal cookies and session tokens without triggering DPAPI prompts. The Arcane stealer opened browsers with a remote debugging port to harvest authentication cookies. This technique bypasses cookie encryption so unexpected debugging launches warrant investigation.

Suspicious Windows Event Log Clearing via process_creation

This rule detects clearing of Windows event logs through the PowerShell Clear-EventLog cmdlet or the wevtutil clear-log command which attackers use to destroy forensic evidence. Head Mare and Twelve piped Get-EventLog into Clear-EventLog to wipe activity during their intrusion. Log clearing is a defense evasion action that should almost never occur outside of controlled maintenance.

Suspicious PowerShell Enabling OpenSSH Server With Attacker Keys via process_creation

This rule detects PowerShell commands that reference the sshd service together with an authorized_keys file which indicates an attacker enabling the built-in Windows OpenSSH server for remote access. The DeepSeek trojan used a base64 PowerShell script to start the SSH service and plant attacker public keys for persistent tunneling. Turning a host into an SSH server with foreign keys is a strong backdoor indicator.

Malicious Svchost Impersonation From Non-System Path via process_creation

This rule detects a process named svchost.exe running from a directory outside the Windows system folders which is a classic masquerading technique. In the DeepSeek-themed campaign a renamed python.exe was executed as svchost.exe to blend with legitimate service host processes while running a KCP tunnel backdoor. The real svchost.exe only launches from System32 or SysWOW64 so other paths reliably indicate malware.

Malicious Desktop Window Manager Impersonation From Non-System Path via process_creation

This rule detects a process named dwm.exe running from a location other than the Windows system directories which indicates masquerading and likely process hollowing. SilentCryptoMiner hollowed a legitimate dwm.exe host to run its XMRig payload while evading defenders. The genuine Desktop Window Manager only ever runs from System32 so any other path is highly suspicious.

Suspicious PowerShell Base64 Encoded Staged Downloader via process_creation

This rule detects PowerShell executed with an encoded command combined with a hidden window and execution policy bypass which is typical of a staged malware downloader. TookPS used base64-encoded PowerShell stages to pull additional payloads before deploying the TeviRat and Lapmon backdoors. Encoded and hidden PowerShell invocations are a frequent early stage of intrusions and merit detection.

Suspicious OpenSSH Reverse Tunnel Establishment via process_creation

This rule detects ssh.exe launched with the remote port forwarding and no-command flags which sets up a reverse tunnel back to an attacker server. The TookPS downloader dropped an RSA key and configuration and used ssh.exe with these flags to expose internal services externally. Reverse SSH tunnels are a common way to bypass firewalls and maintain covert remote access so this pattern deserves review.

Suspicious Potato Privilege Escalation Tool Execution via process_creation

This rule detects execution of known Potato family privilege escalation utilities which abuse Windows token impersonation to move from a service account to SYSTEM. The intruder in the SOC web shell investigation deployed GodPotato, BadPotato and SweetPotato after gaining web shell access. Because these tools are named after their public tooling they provide a reliable behavioral signal for local privilege escalation.