Sigma detection rules, expert-reviewed

Suspicious PythonLauncher Scheduled Task Creation via PowerShell Script

This rule detects PowerShell creating a scheduled task named with the PythonLauncher prefix, the logon persistence UAT-11795 registers for its Starland RAT as reported by Cisco Talos. The operators combine New-ScheduledTask with a PythonLauncher task name to relaunch the implant elevated at each logon. Matching this naming and API pattern reveals attacker persistence distinct from routine task creation.

Malicious Cloudflared Tunnel Established with Token

This rule detects cloudflared.exe running a tunnel with a token argument, a covert channel Huntress observed being launched through RMM tooling such as AgentPackageRunCommandInteractive to reach compromised MSP endpoints. Attackers use Cloudflare tunnels to proxy remote access past perimeter controls without inbound firewall changes. Token-based tunnel creation by cloudflared is a strong command-and-control indicator.

Suspicious curl Download to AppData Temp Directory (via process_creation)

This rule detects curl downloading remote content directly into the AppData Local Temp directory, the ingress technique DarkGate uses to stage its AutoIt loader and encrypted payload. Fetching executables into user Temp via curl is uncommon for legitimate software. Combined with an HTTP source this suggests malware staging.

Suspicious Node.js Spawning PowerShell Archive Download to Temp

This rule detects a Node.js process spawning PowerShell to download a compressed archive into the user temp directory, a chain seen when a malicious npm postinstall hook stages a payload. In the MUT-4831 campaign node.exe launched PowerShell to retrieve a zip that unpacked the Vidar infostealer. This process lineage is unusual for legitimate development workflows and points to supply chain compromise.

Suspicious PowerShell Payload Download via Invoke-WebRequest to status.php

This rule detects obfuscated PowerShell using Invoke-WebRequest to pull a payload from a status php endpoint. Fake IT support pages delivering Vidar staged the next stage through this download pattern. Scripted retrieval of remote executables from a status php gateway is a common loader beacon and delivery mechanism.

Suspicious javaw.exe Network Connection to Pastebin by D3F@CK Loader (via network_connection)

This rule detects the Java runtime javaw.exe establishing a network connection to Pastebin, the payload-retrieval behavior Red Canary observed from the signed D3F@CK loader that masqueraded as a Microsoft Teams installer. Java processes reaching out to paste sites are uncommon in enterprise environments, so this pairing indicates second-stage payload download from attacker-hosted text.

Malicious Silver Fox Run Key Persistence via AppClient (via registry_set)

This rule detects creation of a Run key value named AppClient, a registry autostart used by the Silver Fox ABCDoor backdoor to persist across reboots. The value launches the implant at user logon following a tax themed phishing intrusion. Detecting this autostart entry surfaces backdoor persistence in the registry.

Malicious APT29 Certutil Decode of Disguised Text File to Archive (via process_creation)

This rule detects certutil decoding a .txt file into a .zip archive, the staging step APT29 used to reconstruct a WINELOADER payload from a disguised invite. Delivering the archive as Base64 text and decoding it locally with certutil evades transfer-time inspection. Certutil decoding text into an archive is a deobfuscation behavior tied to this intrusion set.

Suspicious PXA Stealer Payload Decoding via certutil (via process_creation)

This rule detects the use of certutil to decode a disguised document into an archive during PXA Stealer infections. The actors named the decoded output with a pdf extension while it actually contained a password-protected archive for later extraction. Living-off-the-land decoding of pdf-named blobs is uncommon in benign use.

Suspicious Masqueraded Rundll32 with Mismatched Original Filename (via process_creation)

This rule detects a process whose embedded original filename is RUNDLL32.EXE but whose on-disk name is something else. Nokoyawa intrusions run IcedID by copying rundll32 to a decoy name such as Calc.exe to blend into normal activity. A binary lying about its identity through a renamed copy is a reliable masquerading indicator.

Suspicious Parallax RAT Keylogger Output File Creation via File System (via file_event)

This rule detects creation of keylogger output files under the Roaming Data directory using the Keylog_ filename prefix employed by the Parallax RAT. It is associated with the Parallax RAT campaign against cryptocurrency entities reported by Uptycs. These files hold captured keystrokes staged for exfiltration, and their creation signals active credential and input harvesting.

Suspicious User Home Directory Modification via dscl Process Creation

This rule detects use of dscl to change a user account home directory, the core step of the macOS HM Surf technique that relocates the home path to tamper with Safari privacy preference files and bypass TCC protections. Modifying NFSHomeDirectory lets an attacker point sensitive Safari config to a controlled location and grant itself camera, microphone or location access.

Malicious Recovery Environment Tampering via Bcdedit

This rule detects bcdedit being used to disable Windows automatic recovery, a boot-configuration change ransomware performs to block system restoration after encryption. It is associated with REvil ransomware-as-a-service affiliate operations that pair this step with shadow copy deletion. Detecting recovery tampering flags impending or in-progress impact activity.

Malicious SQL Server Database Auditing Deactivated (via application)

This rule detects deactivates SQL Server database auditing capacities. SQL auditing requires previous configuration on each SQL instance.

Suspicious AutoIt3 Script Execution from User Directory (via process_creation)

This rule detects AutoIt3.exe executing a script from a user-writable directory, the loader behavior used in the LATAM Google Cloud Run campaigns where a Startup LNK launches PowerShell and AutoIt. AutoIt is abused to run compiled loader logic that injects the final banking trojan payload.