Sigma detection rules, expert-reviewed

Suspicious Encoded PowerShell Spawned from Explorer via ClickFix

This rule detects PowerShell launched directly by explorer.exe with an encoded command, the signature of the ClickFix fake-CAPTCHA lure that tricks users into pasting a command into the Run dialog. This chain delivered Lumma and Amadey and a Run-dialog spawned encoded PowerShell is highly abnormal.

Suspicious Data Transfer via bitsadmin over HTTP

This rule detects bitsadmin creating a transfer job to an HTTP endpoint. The Kral stealer used BITS jobs to exfiltrate collected data to attacker infrastructure while blending into background transfer activity, which can evade network monitoring.

Malicious LSASS Credential Extraction via Mimikatz sekurlsa

This rule detects Mimikatz sekurlsa module commands used to extract credentials from LSASS memory or a minidump. The Crypt Ghouls group ran sekurlsa minidump against an lsass.dmp to recover plaintext passwords and hashes for privilege escalation.

Suspicious LocalToNet Tunneling Tool Execution

This rule detects execution of the LocalToNet tunneling client. The Crypt Ghouls group deployed localtonet, often registered as a service with nssm, to build a covert reverse tunnel into the compromised network for remote access.

Malicious Service Execution via PAExec

This rule detects PAExec being installed as a service to run commands. The Crypt Ghouls group used paexec with the -service switch for remote command execution across hosts, a PsExec-style technique frequently abused for lateral movement.

Malicious Registry Hive Dump via reg save

This rule detects reg.exe saving the SAM, SECURITY, or SYSTEM registry hives to disk. The Crypt Ghouls group exported these hives to extract secrets and account hashes offline, a common precursor to offline credential cracking and lateral movement.

Suspicious Proxy Execution via pcalua

This rule detects the Program Compatibility Assistant pcalua being used with the -a switch to launch another executable. SideWinder abused pcalua to proxy the execution of a payload from a temporary directory, breaking the parent-child chain and evading detection.

Suspicious Scheduled Task Masquerading as Microsoft Edge Update Machine MS

This rule detects creation of a scheduled task named MicrosoftEdgeUpdateTaskMachineMS, a masquerade that imitates the legitimate Edge updater tasks which use the Core and UA suffixes. Awaken Likho used this fake task name to persist an implant while blending in with normal Edge update activity.

Suspicious MeshAgent Masquerading as NetworkDrivers Spawned by PowerShell

This rule detects a process named NetworkDrivers.exe launched by PowerShell. The Awaken Likho APT deployed the MeshAgent remote management agent under this masqueraded name and started it from PowerShell to gain covert remote control of compromised hosts.

Suspicious Java Archive Execution from User Download Path via SambaSpy

This rule detects Java executing a JAR file from a user temp, downloads, or roaming directory, the delivery pattern used by the SambaSpy campaign to run its Java RAT dropper after a phishing lure. Java processes launching archives from these user-writable paths distinguish malicious loaders from installed Java applications.

Suspicious RC4 DLL Sideloading via rundll32 by Tropic Trooper

This rule detects rundll32 loading datast.dll or datastate.dll, the RC4-encrypted loader components Tropic Trooper sideloads to run its Crowdoor backdoor against Middle East government entities. These specific DLL names invoked through rundll32 reflect the group's staged loader execution.

Suspicious File Download via certutil urlcache

This rule detects certutil used with urlcache split and force flags to download a remote file, a living-off-the-land ingress technique observed across the incident-response cases from Kaspersky's review. certutil is not a legitimate download utility, so this argument combination reliably flags attacker payload retrieval.

Suspicious Execution from Reserved Device Name Directory by Miner Campaign

This rule detects process execution from directories using reserved DOS device names such as NUL and AUX under ProgramData, a hiding technique the miner campaign uses to place payloads in paths that standard tools cannot easily access or delete. Execution from these reserved-name folders is a strong indicator of deliberate concealment.

Malicious Netcat Reverse Shell via Masqueraded StartMenuExperienceHost

This rule detects a process named StartMenuExperienceHost.exe launching with netcat command-execution flags that pipe cmd.exe to a remote host, the reverse-shell mechanism deployed by the miner campaign abusing the Wazuh SIEM agent. The legitimate StartMenuExperienceHost never uses netcat -e style arguments, so this pattern reveals a masqueraded backdoor.

Malicious Firewall Disable via netsh by Key Group Ransomware

This rule detects netsh disabling the Windows firewall for all profiles, a defense-evasion action performed by Key Group ransomware to weaken host protections before impact. Turning off the firewall across all profiles is rarely legitimate on production endpoints and precedes further malicious activity.