Sigma detection rules, expert-reviewed

Suspicious Interlock Backdoor C2 Beacon to init1234 Endpoint (via proxy)

This rule detects HTTP POST requests to the init1234 endpoint used by the Interlock PowerShell backdoor for command and control. The Interlock ransomware operators register their compromised hosts by beaconing to this fixed URI. The specific init1234 path combined with the POST method reveals active backdoor communication.

Malicious DDoSia Client C2 Check-In via Fixed User-Agent

This rule detects the NoName057(16) DDoSia client registering with its C2 by POSTing to a /client/login endpoint using a hardcoded legacy Gecko User-Agent. The combination of that outdated User-Agent string and the login path identifies the DDoS bot fetching its target list.

Suspicious Bash Decode Chain Using curl xxd and base64 Piped to eval via Linux Shell

This rule detects a Linux shell one-liner that pipes curl output through xxd and base64 into eval to decode and execute an in-memory payload. This behavior is used by TransparentTribe to deploy the DeskRAT implant against Indian military targets. Chaining hex and base64 decoding into eval lets the attacker run downloaded code without touching disk which frustrates static detection.

Malicious DLL Registration via regsvr32 Loading prnfldr (via process_creation)

This rule detects regsvr32.exe registering the prnfldr.dll payload using the silent install flags. In Operation Phantom Net Voxel APT28 executes its loader DLL through regsvr32 with the /n /i options to run code while bypassing application controls. Regsvr32 loading this named DLL is characteristic of the campaign proxy execution.

Suspicious Command Interpreter Spawned by mshta (via process_creation)

This rule detects cmd or PowerShell being launched as a child of mshta.exe. The multi-stage infection chains analyzed by Sekoia deliver an LNK that opens an HTA which then spawns a command interpreter to continue the chain. A command interpreter descending from mshta indicates HTA-based staged execution rather than normal application behavior.

Suspicious Service Creation Named RDP-Controller via sc.exe (via process_creation)

This rule detects creation of a Windows service named RDP-Controller with a custom binary path via sc.exe. The RATatouille intrusion installs this service to gain persistence and enable remote desktop control through its main.exe payload. A service using this masquerading name with an arbitrary binPath indicates malicious persistence.

Suspicious Scheduled Task Creation Launching mshta via schtasks (via process_creation)

This rule detects creation of a scheduled task named ServiceDispatch that repeatedly launches mshta.exe. The Double-Tap campaign attributed to APT28 uses this persistence mechanism to run the HATVIBE HTA loader every few minutes. Combining a masquerading task name with the mshta living-off-the-land binary indicates malicious persistence rather than benign scheduling.

Malicious Volume Shadow Copy Deletion via wmic and vssadmin (via process_creation)

This rule detects deletion of volume shadow copies through wmic shadowcopy delete and vssadmin Delete Shadows commands. This behavior is used by the Helldown ransomware to inhibit system recovery prior to encrypting files. Removing shadow copies prevents victims from restoring their data which maximizes the impact of the intrusion.

Suspicious GobRAT Bulbature Infection Shell Scripts Execution

This rule detects execution of the distinctive bash infection and management scripts used by the Bulbature operation behind GobRAT, including zonesetup.sh, zoneController.sh, zoneupdate.sh, hold_by_bot.sh, sshdeny1.sh, zonedelete.sh and zoneRestart.sh. These uniquely named scripts orchestrate persistence, SSH access control and bot management on hijacked routers. Their filenames are specific enough to serve as reliable indicators.

Suspicious Process Masquerading as apached via GobRAT Bulbature Implant

This rule detects a running process named apached, the disguised name GobRAT uses to blend in with the legitimate Apache httpd daemon on compromised edge devices in the Bulbature operation. The extra character in the name is designed to survive casual process listing review. Because no standard Apache binary is named apached, this is a strong host indicator of GobRAT.

Suspicious lwp-download Retrieval of Remote File Masquerading as Image via 8220 Gang

This rule detects the Perl based lwp-download utility fetching a remote resource and saving it with a .gif image extension, a technique the 8220 gang uses in the Hadooken and K4Spreader campaigns to disguise downloaded shell scripts and payloads. Legitimate administrators rarely invoke lwp-download to write image files from the web. This pattern signals staging of second stage tooling on compromised Linux hosts.

Malicious MuddyRot Implant Execution From ProgramData SoftwareMemory Path

This rule detects execution of a binary from the ProgramData softwarememory documentsmanagerreporter.exe location, the fixed install path and filename used by the MuddyWater MuddyRot implant. The actor drops the payload here and registers persistence to maintain access. The hardcoded path and masqueraded name make this a high confidence indicator of MuddyRot infection.

Malicious System Recovery Inhibition via bcdedit and vssadmin in Mallox

This rule detects Mallox disabling recovery by editing boot configuration with bcdedit and deleting volume shadow copies with vssadmin. Turning off recovery and wiping shadows prevents restoration of encrypted files, a hallmark pre-encryption step of the Mallox ransomware.

Malicious MS-SQL Server Spawning Command Shell via Mallox

This rule detects the MS-SQL service process sqlservr.exe spawning cmd.exe or PowerShell. Mallox affiliates abuse xp_cmdshell and OLE automation after compromising weak SQL Server instances, so a shell child of the database engine strongly indicates SQL exploitation.

Malicious PlugX DLL Sideloading via CEFHelper from RECYCLER.BIN

This rule detects the PlugX loader CEFHelper.exe running from a hidden RECYCLER.BIN directory on a USB or local volume. The worm sideloads its payload DLL through this renamed helper stored in a fake recycle bin folder to evade inspection.