Sigma detection rules, expert-reviewed

Suspicious Curl Download to Update Executable during FortiClient EMS Exploitation

This rule detects curl downloading a remote file to C:\update.exe, a staging step observed after FortiClient EMS exploitation to fetch a ScreenConnect remote-access installer. Writing a downloaded binary to a generic update path in the drive root disguises tooling as a software update. This ingress pattern indicates remote payload delivery.

Malicious PowerShell UrlDecode Payload Spawned by SQL Server after FortiClient EMS Exploitation

This rule detects a command shell launching PowerShell that loads System.Web and calls UrlDecode as a child of the SQL Server process. Attackers exploiting the patched FortiClient EMS vulnerability use this chain to decode and run staged payloads through the exposed database service. A SQL Server process invoking encoded PowerShell indicates post-exploitation code execution.

Suspicious Service Installation Masquerading as SQLExplorer by Lazarus

This rule detects creation of a Windows service named SQLExplorer, the persistence name used by the Lazarus CookieTime malware. The group registers its backdoor as a plausible SQL-related service to blend with database tooling. A service named SQLExplorer being installed indicates Lazarus persistence.

Suspicious DLL Side-Loading Host Binary Executed Outside System32 by Lazarus

This rule detects execution of signed host binaries such as CameraSettingsUIHost.exe or Dxpserver.exe from directories outside the Windows System32 path. The Lazarus group side-loads malicious DLLs (DUI70.dll, dwmapi.dll) by placing these legitimate executables in attacker-controlled folders. A trusted binary running from an unexpected location indicates a DLL search-order hijack.

Suspicious Service Creation for Masqueraded svxhost NgcMngrSvc by Cyber Anarchy Squad

This rule detects registration of a Windows service that references the masqueraded svxhost.exe binary or the NgcMngrSvc service name used by the Cyber Anarchy Squad. The attackers install this service for persistent RAT execution while imitating legitimate host and NGC manager service names. The deceptive service name combined with an unexpected binary indicates persistence.

Suspicious Scheduled Task Masquerading as Tpm-HASCertRetr by Careto

This rule detects creation of a scheduled task named Tpm-HASCertRetr which masquerades as a legitimate TPM certificate retrieval task. The Careto APT uses this task name to launch a temporary command script for persistence and execution. The deceptive system-like task name paired with schtasks creation indicates covert persistence.

Malicious RustyStealer Masquerading as AudioDriver in Windows Temp

This rule detects execution of AudioDriver2.0.exe from the Windows Temp directory. The Ymir intrusion staged the RustyStealer payload under this driver-like name in Windows Temp to collect credentials before ransomware deployment, and this path and name combination is not legitimate.

Suspicious PowerShell Version Pinning with Encoded Command

This rule detects PowerShell started with an explicit -Version switch together with an encoded command and no-profile flags. The Ymir ransomware launched PowerShell this way to run obfuscated payloads in a controlled runtime while evading profile-based logging.

Malicious Port Forwarding via QSC pf Tool listen conn Syntax

This rule detects the QSC port forwarding utility invoked with its characteristic tcp listen and conn parameters. The CloudComputating group used pf.exe to relay traffic between an exposed listening port and an internal endpoint, enabling proxying and internal pivoting.

Malicious NTDS.dit Access via Shadow Copy GLOBALROOT Path

This rule detects access to ntds.dit through a GLOBALROOT volume shadow copy device path. The CloudComputating group copied the Active Directory database directly from a shadow copy to steal domain credentials while bypassing file locks on the live NTDS.dit.

Suspicious SteelFox Service Binary Launched by services.exe

This rule detects service binaries used by SteelFox being started by the Service Control Manager. SteelFox installs a persistent service that runs binaries such as lpsad.exe or names imitating Foxit and Adobe update services to launch its modified XMRig miner with system privileges.

Suspicious Software Crack or Activator Dropper Execution

This rule detects execution of pirated software crack and activator binaries used to deliver the SteelFox trojan. Victims ran files such as foxitcrack.exe or jetbrains-activator.exe expecting a license bypass, which instead dropped a stealer and cryptominer.

Suspicious svchost Invocation with Non-Standard svcr Argument

This rule detects svchost.exe launched with a -svcr argument, which is not a legitimate Service Host switch. The Horns and Hooves campaign used a fake svchost invocation to run WUDFHost.exe and mask malicious execution as a normal service host process.

Suspicious BitLockerToGo Execution from Unusual Parent

This rule detects the BitLockerToGo utility running from a parent process other than the standard system ones. Lumma stealer abused BitLockerToGo as a living-off-the-land binary to read registry and files while masquerading as a benign Windows component.

Suspicious Encoded PowerShell Spawned from Explorer via ClickFix

This rule detects PowerShell launched directly by explorer.exe with an encoded command, the signature of the ClickFix fake-CAPTCHA lure that tricks users into pasting a command into the Run dialog. This chain delivered Lumma and Amadey and a Run-dialog spawned encoded PowerShell is highly abnormal.