Sigma detection rules, expert-reviewed

Malicious VoidLink Fileless Execution via memfd via Memory (via process_creation)

This rule detects processes executing from an anonymous in-memory file descriptor on Linux hosts. The VoidLink rootkit loader uses memfd_create and execveat to run its payload entirely from memory without touching disk. Execution backed by a memfd path is a strong indicator of fileless malware staging.

Malicious MSI Installation from Remote WebDAV Share via process_creation

This rule detects msiexec.exe installing an MSI package from a remote WebDAV or HTTP location when launched by the WMI provider host, matching the LATRODECTUS loader delivery chain. The oversized JavaScript dropper uses WMI to spawn msiexec and retrieve a remote installer. This staging technique delivers second-stage payloads while evading direct download detection.

DSRM Password Changed - Reg via PowerShell (via powershell)

This rule detects reset or synchronize with another domain account the DSRM (Directory Services Restore Mode) password in order to escalate privileges.

Obfuscated Edge/Chrome Headless Feature Abuse for Payload Download (via process_creation)

This rule detects executes Chrome in headless mode in order to download a payload. Document Object Model (DOM) may also be abused to download obfuscated data from attacker repositary.

Malicious User Added to a Group via Commandline (via process_creation)

This rule detects escalate privilege by adding a user to a group via commandline.

Malicious SnipBot DLL Execution via rundll32 from KeyStore Directory (via process_creation)

This rule detects rundll32 loading SnippingTool.dll from a KeyStore folder and invoking its Main export, the execution technique used by the SnipBot variant of RomCom malware. Proxying execution of the malicious DLL through the trusted rundll32 binary helps the loader evade application controls.

Malicious Phantom Taurus OutlookEN Web Shell File Creation (via file_event)

This rule detects creation of the OutlookEN.aspx web shell dropped by Phantom Taurus on compromised Exchange and IIS servers. The web shell loads the NET-STAR IIServerCore backdoor into the worker process to provide persistent server access. Detecting the file drop catches the initial foothold before the backdoor is loaded into memory.

Suspicious Scheduled Task Masquerading as Wininet CacheTask (via process_creation)

This rule detects schtasks creating a scheduled task under a Wininet CacheTask name that impersonates a legitimate Windows maintenance task. The malvertising backdoor operators registered a task with this masqueraded name for persistence and periodic payload execution. A user-created task mimicking a built-in system task path is a strong persistence and masquerading indicator.

Scheduled Task Creating Per-Minute Hidden PowerShell Execution

This rule detects schtasks creating a task that runs at a one-minute interval and launches a hidden PowerShell script. The GPU miner campaign registered a scheduled task firing every minute to run hidden powershell against cor.ps1 or core.ps1 for persistence and re-infection. A minute-cadence hidden PowerShell task is a strong indicator of automated malware persistence.

Suspicious osascript to zsh Executing Hidden Payload via Axios Compromise

This rule detects osascript launching zsh with an inline command that runs a hidden binary under Library Caches as documented in Elastic detections for the Axios supply chain compromise. The AppleScript to shell handoff to a caches resident payload marks macOS implant execution on infected developer systems.

Malicious LSASS Credential Dumping via Comsvcs MiniDump (via process_creation)

This rule detects the use of the built-in comsvcs.dll MiniDump export (typically invoked through rundll32) to write a memory dump of a target process such as LSASS to disk. Credential access via LSASS memory is a top technique in the Red Canary Threat Detection Report, giving adversaries plaintext credentials and hashes for lateral movement. Because this pattern relies on a signed system DLL, detecting the comsvcs MiniDump invocation surfaces stealthy credential theft.

Malicious Microsoft Defender Massive Host Infection (via windefend)

This rule detects scenarios where multiple suspicious threats are detected on a single host.

Possible Ivanti EPMM CVE-2025-4428 Exploitation via format Parameter (via webserver)

This rule detects requests to the Ivanti EPMM api v2 endpoint carrying a format parameter that invokes runtime code execution, the exploitation pattern for CVE-2025-4428. Attackers embedded Java Runtime.exec calls in this parameter to achieve remote command execution. Such requests against the mifs api are a strong exploitation indicator.

OceanLotus (APT-C-00) Payload Staging in Fake NVIDIA Setup Temp Directory (via file_event)

This rule detects files being written into a fake NVIDIA setup directory under the user Temp folder, a staging behavior observed by the 360 Threat Intelligence Center in the OceanLotus double-loader campaign where the loader created a NVidiaSetup working directory to host encrypted host data and the reflectively loaded Cobalt Strike beacon. Adversaries masquerade attacker directories as trusted vendor installers to blend payload staging into ordinary Temp activity.

Malicious InvisibleFerret Python Loader Execution from Hidden .pyp Directory

This rule detects a python.exe located in a hidden .pyp user directory executing the .npl payload, matching the InvisibleFerret stage of the North Korean job-hunter campaigns described by Unit 42. The actor stages a private Python runtime and payload under a dotted folder in the user profile which is an unusual pattern that reveals the second-stage backdoor.