Sigma detection rules, expert-reviewed

Suspicious McAfee DLL Sideload via mcods Process Creation

This rule detects the legitimate McAfee mcods.exe binary running from outside its standard installation directory. Attackers targeting industrial organizations plant mcods.exe alongside a malicious McVsoCfg.dll to sideload their loader via the McVsoCfgGetObject export, abusing a trusted signed process for execution and persistence.

Suspicious Equation Editor Child Process via Process Creation

This rule detects Microsoft Equation Editor (EQNEDT32.EXE) spawning a child process. LokiBot delivery chains weaponize CVE-2017-11882 and CVE-2017-0199 in RTF documents so that the outdated equation editor executes attacker code, an event with no legitimate cause on modern systems.

Malicious Windows Defender Exclusion Added via Command Line

This rule detects the creation of Windows Defender scan exclusions through PowerShell MpPreference cmdlets. DarkGate and related crimeware loaders add exclusion paths for their staging directories so subsequently dropped payloads are not scanned, weakening endpoint defenses before further execution.

Suspicious AutoIt3 Execution With Compiled Script Argument via Process Creation

This rule detects AutoIt3.exe invoked with a compiled .au3 script passed on the command line. DarkGate loader campaigns abuse the signed AutoIt3 interpreter to execute an obfuscated script.au3 payload, blending malicious execution into legitimate scripting activity to evade detection.

Suspicious W32TIME Named Pipe Activity Linked to RPC Privilege Escalation (via pipe_created)

This rule detects creation of the W32TIME named pipe, an observable associated with the PhantomRPC Windows RPC privilege escalation technique that coerces service actions to run at high privilege. The pipe activity accompanies impersonation of a privileged token through the Terminal Services RPC interface. Detecting this pipe alongside unexpected service triggers can surface RPC based escalation attempts.

Suspicious UUID Named Pipe Created Consistent with Mythic SMB Agent

This rule detects the creation of named pipes whose name is a bare UUID which matches the SMB peer to peer profile used by Mythic agents as described by Kaspersky. Mythic uses UUID formatted named pipes to relay tasking between implants over SMB. This pattern can indicate command and control tunneling although some legitimate software also uses GUID named pipes.

Suspicious PipeMagic Named Pipe Creation (via pipe_created)

This rule detects creation of the named pipes used by the PipeMagic backdoor including the magic3301 pipe and the structured pipe\1. prefix followed by a hex identifier. PipeMagic uses these pipes for internal module communication and command routing. The distinctive pipe naming scheme is a reliable host indicator of the modular backdoor.

Malicious Named Pipe Creation by CloudSorcerer (via pipe_created)

This rule detects creation of the distinctive named pipe [1428] which the CloudSorcerer APT uses for inter-process communication between its injected modules while targeting Russian government entities.

Suspicious Named Pipe TyphoonPWN Local Privilege Escalation Marker (via pipe_created)

This rule detects creation of the named pipe \\.\Pipe\TyphoonPWN. The analyzed Windows local privilege-escalation technique uses this specific named pipe during its exploitation flow, so its appearance indicates the presence of the exploit tooling on the host.

Suspicious RuntimeBroker Network Connection via Loki Mythic Agent

This rule detects RuntimeBroker.exe initiating outbound network connections to non-local addresses, an anomaly produced when the Loki Mythic agent injects its gTunnel or ngrok tunneling code into runtimebroker and svchost host processes. RuntimeBroker is a local COM broker that should not talk to remote hosts, so external traffic from it points to injected C2 tunneling.

Suspicious Network Connection from mspaint or msiexec (via network_connection)

This rule detects mspaint.exe or msiexec.exe initiating outbound network connections which is anomalous for these utilities and matches CloudSorcerer APT tradecraft of injecting shellcode into them to proxy cloud command-and-control traffic.

Suspicious Project CAV3RN AzureCommunication.dll Load (via image_load)

This rule detects the loading of AzureCommunication.dll from outside the Windows directory, a masquerading module name used by the Project CAV3RN espionage framework that abuses Outlook calendar events and Graph API for command-and-control. A cloud-themed module name loaded from an unexpected path is indicative of an attacker blending malicious code into legitimate-looking Azure components.

Suspicious HelloNet wtsapi32.dll Sideload via itcsrvup64.exe (via image_load)

This rule detects the loading of wtsapi32.dll by itcsrvup64.exe from outside System32, a DLL search-order hijack used by the HelloNet campaign to run malicious code through the ViPNet update system. The attacker abuses a trusted updater binary to sideload a payload and inject into svchost, enabling stealthy code execution and persistence.

Suspicious DLL Sideloading of libpython by evteng

This rule detects the evteng.exe process loading libpython2.4.dll which indicates DLL search order sideloading. Evasive Panda used evteng.exe to sideload a malicious libpython2.4.dll that loads the MgBot backdoor as reported by Kaspersky. This host binary loading an attacker supplied library is a strong sideloading and execution indicator.

Malicious Phantom DLL Hijacking of oci.dll Loaded by msdtc

This rule detects msdtc.exe loading oci.dll, a well-known phantom DLL hijacking technique used by the PassiveNeuron campaign to run an implant under a trusted system service. The oci.dll is not present by default so msdtc will load an attacker-supplied version placed in its search path. This grants stealthy code execution under a signed Windows service process for persistence and evasion.