Sigma detection rules, expert-reviewed

Obfuscated Firewall Deactivation - Deprecated Command (via process_creation)

This rule detects disabled the Windows Firewall to evade defense.

QBot process creation from scheduled task REGSVR32 (regsvr32.exe), -s flag and SYSTEM in the command line

Detects the process creation from Scheduled Task with REGSVR32 (regsvr32.exe), -s flag and SYSTEM in the command line

Suspicious pythonw.exe Executing winresume.pyc via Confucius AnonDoor Backdoor (via process_creation)

This rule detects the Confucius AnonDoor Python backdoor which is run by a scheduled task named NetPolicyUpdate invoking pythonw.exe against a hidden winresume.pyc file every five minutes. Execution of a compiled Python module named winresume.pyc by the windowless interpreter indicates the backdoor. The task provides persistence.

Suspicious Script Host Execution from AppData WindowsHelper Staging Folder via process_creation

This rule detects wscript.exe running a run.vbs from an AppData WindowsHelper directory, the staging location Armored Likho uses to chain into a Python module payload. Script execution from this attacker staging folder is part of the BusySnake stealer loader. It indicates active execution of the stealer.

In-Memory Regasm Process Hollowing Spawned by PowerShell (via process_creation)

This rule detects the .NET Regasm.exe utility launched as a child of powershell.exe, the process-hollowing target used by 0bj3ctivityStealer to inject its final stealer payload. Adversaries leverage Regasm as a signed injection host that seldom runs from PowerShell, making this parent-child pairing a reliable indicator of code injection.

Malicious Keychain Credential Extraction via security Utility

This rule detects the macOS security utility being used to dump keychain contents or extract stored passwords, a credential theft step performed by MacStealer after harvesting the login password. Reading generic and internet passwords from the keychain lets the malware collect browser and application secrets for exfiltration.

Malicious C2 Configuration Stored in TitanPlus Registry Key (via registry_set)

This rule detects writes to a TitanPlus registry key, the location where the intrusion described by Truesec stored encoded command-and-control server addresses using character substitution. Adversaries hide C2 configuration in an obscure registry value to survive reboots and evade file-based detection, making writes to this named key a targeted persistence and C2 indicator.

Malicious PlugX Scheduled Task Named InternetUpdateTask (via process_creation)

This rule detects creation of a scheduled task named InternetUpdateTask, the persistence artifact left by the PlugX malware family to relaunch its DLL sideloaded loader at logon. The benign sounding task name masks recurring execution of the implant, so its creation is a strong indicator of PlugX persistence being established.

Suspicious Kubernetes API Request From Anonymous User

This rule detects Kubernetes API server requests authenticated as the anonymous or unauthenticated system identity which indicates an unauthenticated actor probing the cluster control plane as described in NCC Group Kubernetes detection engineering research. Adversaries leverage anonymous access to enumerate resources and stage container escapes so any such request warrants investigation.

Suspicious Python Execution from WebDAV Share via PowerShell (via process_creation)

This rule detects python.exe spawned by PowerShell while referencing a remote WebDAV share path in its command line. The Voldemort espionage campaign ran Python directly from mounted TryCloudflare WebDAV shares to load its backdoor without local staging.

Malicious Reverse SSH Tunnel via Renamed PuTTY svchosts.exe (via process_creation)

This rule detects the Hive0129 BlotchyQuasar RAT establishing a reverse SSH tunnel using a renamed PuTTY binary called svchosts.exe to forward internal SMB and RDP ports over the HTTPS port. The misspelled svchosts.exe name combined with remote-forward switches and batch mode reveals covert tunneling. Legitimate services do not run this binary.

Malicious Linux Cryptominer Masquerading as systemd-logind via var tmp Execution

This rule detects a process executing from /var/tmp/systemd-logind, a Linux cryptominer masquerading as the legitimate systemd-logind daemon which normally runs from /usr/lib/systemd. It was observed in a Huntress-investigated intrusion where a Monero miner beaconed to a mining pool over port 443. Execution of a trusted daemon name from a world-writable temporary directory indicates resource-hijacking malware attempting to evade casual process review.

Suspicious Shell Spawned by PostgreSQL Server via COPY FROM PROGRAM on Linux

This rule detects a PostgreSQL server process spawning a command shell which indicates abuse of the COPY FROM PROGRAM feature for arbitrary command execution as used by the DreamBus botnet after brute-forcing weak database credentials. A database engine launching a shell is not normal behavior and points to post-authentication remote code execution.

Malicious Rundll32 Execution Of HTML Payload With DllRegisterServer

This rule detects rundll32 loading a file with an .html extension and calling the DllRegisterServer export, the disguised DLL execution used in the Zloader attack against Intel 471. Masquerading the DLL as an HTML file evades extension-based inspection while rundll32 still runs it as a library. This mismatch of extension and export is a strong loader indicator.

Suspicious netsh Outbound Network Connection from IDAT Loader Injection

This rule detects the netsh utility initiating outbound internet connections which is abnormal for the tool. A fake IT support site leading to Vidar used the Hijack IDAT Loader to inject shellcode into netsh so C2 traffic runs from a signed process. netsh has no legitimate reason to reach external hosts so this points to process injection.