Sigma detection rules, expert-reviewed

Suspicious PowerShell Base64 Encoded Staged Downloader via process_creation

This rule detects PowerShell executed with an encoded command combined with a hidden window and execution policy bypass which is typical of a staged malware downloader. TookPS used base64-encoded PowerShell stages to pull additional payloads before deploying the TeviRat and Lapmon backdoors. Encoded and hidden PowerShell invocations are a frequent early stage of intrusions and merit detection.

Suspicious OpenSSH Reverse Tunnel Establishment via process_creation

This rule detects ssh.exe launched with the remote port forwarding and no-command flags which sets up a reverse tunnel back to an attacker server. The TookPS downloader dropped an RSA key and configuration and used ssh.exe with these flags to expose internal services externally. Reverse SSH tunnels are a common way to bypass firewalls and maintain covert remote access so this pattern deserves review.

Suspicious Potato Privilege Escalation Tool Execution via process_creation

This rule detects execution of known Potato family privilege escalation utilities which abuse Windows token impersonation to move from a service account to SYSTEM. The intruder in the SOC web shell investigation deployed GodPotato, BadPotato and SweetPotato after gaining web shell access. Because these tools are named after their public tooling they provide a reliable behavioral signal for local privilege escalation.

Suspicious GitVenom Visual Studio Pre-Build Event Shell Execution via process_creation

This rule detects the Visual Studio build engine spawning a command interpreter or PowerShell which is characteristic of a malicious pre-build event script. The GitVenom campaign abused the Visual Studio PreBuildEvent to launch a hidden batch file that deployed cryptocurrency-stealing malware when a victim compiled a trojanized project. Detecting build-time command execution catches supply chain compromise before payloads are staged.

Malicious GitVenom Python Fernet Decrypt-and-Execute Loader via process_creation

This rule detects a python.exe process whose command line combines the exec builtin with the cryptography Fernet primitive to decrypt and run an embedded payload in memory. This behavior was used by the GitVenom campaign which hid malicious loaders inside fake GitHub projects. Attackers use runtime decryption to hide stealer and RAT code from static inspection which makes early loader detection valuable.

Suspicious NSIS Self-Extractor Renaming Payload to CMD for Execution by Angry Likho

This rule detects a command shell renaming an extensionless dropped file named Helping to Helping.cmd for execution, an unpacking trick used by the Angry Likho NSIS self-extractor. Renaming a benign-looking file to a batch script defeats delivery-time inspection before running staged commands. This rename-and-run sequence indicates malicious unpacking.

Suspicious XMRig Cryptominer Execution with Pool URL by StaryDobry

This rule detects command-line execution characteristic of the XMRig cryptominer delivered by the StaryDobry campaign, invoking a mining pool URL together with CPU tuning parameters. XMRig consumes host resources to mine cryptocurrency for the attacker. This mining command pattern indicates resource-hijacking activity.

Suspicious Scheduled Task Running Regsvr32 with Extreme Duration by StaryDobry

This rule detects creation of a scheduled task that runs regsvr32 with an abnormally long duration and one-minute repetition interval, a persistence and proxy-execution pattern used by the StaryDobry miner campaign. Chaining regsvr32 silent DLL registration to a near-infinite recurring task keeps the XMRig loader running. This task configuration indicates malicious scheduled proxy execution.

Suspicious Timestomp and Hidden Attribute Set on NTUSER Data File by EAGERBEE

This rule detects use of attrib to apply system, hidden, and archive attributes to a decoy ntusers0.dat file used by the EAGERBEE backdoor. The malware hides its staging file and manipulates attributes to blend with genuine user profile data. Setting these attributes on this specific file indicates indicator hiding.

Suspicious Multi-Volume RAR Archiving for Collection by EAGERBEE

This rule detects rar.exe creating a split multi-volume archive with a 100MB volume size, a staging step the EAGERBEE backdoor uses to package collected data before exfiltration. Volume-split archiving keeps large data sets in transfer-friendly chunks. This archiving pattern indicates data collection prior to exfiltration.

Suspicious WScript Execution of VBS from NTFS Alternate Data Stream by Cloud Atlas

This rule detects wscript.exe executing a VBScript hidden inside an NTFS alternate data stream of an AppCache log file. The Cloud Atlas VBCloud backdoor stores its script payload in an ADS to evade file-based scanning. Running a script from a stream referenced by a colon in the path indicates alternate-data-stream execution.

Suspicious Registry Hive Export of SAM and SECURITY for Credential Theft after FortiClient EMS Exploitation

This rule detects use of reg.exe to save the SAM or SECURITY registry hives, a credential-theft step used by actors exploiting the FortiClient EMS vulnerability. Exporting these hives allows offline extraction of local account password hashes. Saving these sensitive hives to disk indicates credential dumping.

Suspicious Curl Download to Update Executable during FortiClient EMS Exploitation

This rule detects curl downloading a remote file to C:\update.exe, a staging step observed after FortiClient EMS exploitation to fetch a ScreenConnect remote-access installer. Writing a downloaded binary to a generic update path in the drive root disguises tooling as a software update. This ingress pattern indicates remote payload delivery.

Malicious PowerShell UrlDecode Payload Spawned by SQL Server after FortiClient EMS Exploitation

This rule detects a command shell launching PowerShell that loads System.Web and calls UrlDecode as a child of the SQL Server process. Attackers exploiting the patched FortiClient EMS vulnerability use this chain to decode and run staged payloads through the exposed database service. A SQL Server process invoking encoded PowerShell indicates post-exploitation code execution.

Suspicious Service Installation Masquerading as SQLExplorer by Lazarus

This rule detects creation of a Windows service named SQLExplorer, the persistence name used by the Lazarus CookieTime malware. The group registers its backdoor as a plausible SQL-related service to blend with database tooling. A service named SQLExplorer being installed indicates Lazarus persistence.