Sigma detection rules, expert-reviewed

Malicious SSH Reverse Tunnel with Hidden Key Path (via process_creation)

This rule detects ssh.exe establishing a reverse port-forward tunnel while referencing key files staged under C:\Windows\AppReadiness which ToddyCat uses to build covert traffic-tunneling channels into victim infrastructure for data extraction.

Suspicious Remote Service Execution via PsExec (via process_creation)

This rule detects PsExec being used to execute commands on remote hosts which LockBit builder-based ransomware leverages through its psexec_netspread option to propagate the payload across the domain before mass encryption.

Malicious Geacon Payload Download to Temp via Trojanized Editor (via process_creation)

This rule detects a command line downloading a payload to /tmp/updater from the transferusee C2 infrastructure used by trojanized text editor apps targeting Chinese users to deliver the Geacon backdoor which grants remote control and must be triaged as active compromise.

Suspicious Execution or Load from Fake System32 Directory Imprint (via process_creation)

This rule detects a process image path that contains a fake system directory of the form \Imprint\Windows\system32. The examined privilege-escalation technique builds a counterfeit system drive directory such as C:\Imprint\Windows\system32 to trick trusted loaders into resolving files from an attacker-controlled path, so an image running from this structure indicates path-based deception during exploitation.

Suspicious obs-browser-page.exe Executing Outside OBS Installation Path (via process_creation)

This rule detects the signed obs-browser-page.exe running from a location other than a legitimate OBS Studio installation directory. The Coyote banking trojan copies this signed OBS binary to a user folder to side-load a malicious libcef.dll, so execution of obs-browser-page.exe from an unexpected path indicates DLL side-loading through a trusted host process.

Suspicious Python Executing Script from var root Library Caches on macOS (via process_creation)

This rule detects a Python interpreter running a script located under /var/root/Library/Caches/ on macOS. The crypto-stealing backdoor stages its Python payload as /var/root/Library/Caches/<uuid>.py and executes it with elevated privileges, so this execution path indicates the hidden backdoor script running as root.

Suspicious AMOS Stealer Fake Password Prompt via osascript (via process_creation)

This rule detects osascript invoking a display dialog that requests a password with hidden input on macOS. The AMOS stealer shows a fake system password prompt through osascript to harvest the user credential before dumping keychain and wallet data, so this dialog pattern indicates credential phishing by the stealer.

Malicious Akira Shadow Copy Deletion via PowerShell WMI (via process_creation)

This rule detects PowerShell enumerating and deleting Volume Shadow Copies through WMI. Akira ransomware runs a PowerShell one-liner that queries Win32_Shadowcopy and calls Delete to remove backups before encryption, so this command indicates inhibition of system recovery during a ransomware attack.

Suspicious osascript Spawning Shell curl to External Host on macOS (via process_creation)

This rule detects osascript spawning a shell that runs curl on macOS. The BlueNoroff backdoor decrypts an embedded AppleScript that launches a shell and uses curl to reach its command-and-control server and pull further stages, so this parent-child chain indicates scripted download activity from a document-borne implant.

Suspicious Executable Execution From Users Public Directory via Process Creation

This rule detects execution of View.exe or IntelSvc.exe from the C:\Users\Public directory. In the B2B miner and backdoor campaign these binaries are dropped to the world-writable Public folder to stage a keylogger and a beaconing backdoor, an atypical execution location.

Malicious Defender Real-Time Monitoring Disabled via Process Creation

This rule detects command lines that disable Microsoft Defender real-time or behavior monitoring. The miner, keylogger and backdoor campaign against B2B organizations uses start.cmd and runxm1.cmd scripts to turn off Defender protections before deploying its payloads.

Suspicious Hidden Local Account Creation SqlDbAdmin via Process Creation

This rule detects creation of a local account named SqlDbAdmin via net.exe. Cuba ransomware adds this hidden administrative user for persistence and lateral movement, disguising it as a database service account.

Malicious BYOVD Driver Service Creation aswSP_ArPot2 via Process Creation

This rule detects creation of a service loading the vulnerable Avast aswarpot.sys driver under the name aswSP_ArPot2. Cuba ransomware operators bring the signed driver into C:\windows\temp and register it as a service to abuse it via DeviceIoControl for terminating security products, a bring-your-own-vulnerable-driver technique.

Suspicious Executable Execution From AppData Roaming msgui via Process Creation

This rule detects execution of msgui.exe from the roaming AppData directory. In attacks on industrial organizations this binary is dropped to %APPDATA% and used as an injector into msiexec.exe or svchost.exe, staging further malicious activity from a user-writable location.

Suspicious Service Persistence WinSystemHost via Process Creation

This rule detects creation of a Windows service named WinSystemHost via sc.exe. Threat actors attacking industrial organizations register this service to persist a malicious loader across reboots, masquerading as a benign system host process.