Sigma detection rules, expert-reviewed

HamsaUpdate Handala Loader Payload Assembly via Copy Binary Concatenation to PIF (via process_creation)

This rule detects the Handala Delphi loader assembling a renamed AutoIt interpreter by concatenating multiple fragment files into Naples.pif using the copy binary-mode command in Operation HamsaUpdate. Reconstructing an executable from split fragments into a .pif is an evasion technique that precedes obfuscated script execution.

Malicious ShadowPad DLL Sideloading via imecmnt.exe (via image_load)

This rule detects the Microsoft IME binary imecmnt.exe loading imjp14k.dll from a non-system directory, a DLL search-order sideloading chain used by Stately Taurus to launch the ShadowPad backdoor. The loaded DLL subsequently injects into wmplayer.exe or dllhost.exe to run in memory. Sideloading a malicious DLL through a signed IME component lets the actor evade allowlisting and defeat image-integrity checks.

Malicious Powerfun Reverse Shell Script via Script Block (via ps_script)

This rule detects execution of the powerfun PowerShell reverse shell, the interactive backdoor deployed over port 443 after FortiClientEMS exploitation as documented by Red Canary. Powerfun is a publicly available offensive script with no legitimate use, so any script block referencing it indicates hands-on-keyboard remote access.

Malicious LSASS Credential Dumping via Mimikatz sekurlsa and lsadump Commands (via process_creation)

This rule detects Mimikatz command modules such as sekurlsa logonPasswords and lsadump sam being passed on the command line, the credential-access step in the ELPACO-team Confluence intrusion where logon passwords and SAM secrets were harvested to a results log. Adversaries run these Mimikatz modules to extract plaintext and hashed credentials from memory and the registry, so these module strings are a high-confidence dumping indicator regardless of the binary name.

Possible Local File Inclusion Path Traversal Targeting CentreStack Web.config

This rule detects web requests to the CentreStack storage handler containing directory traversal sequences that reference Web.config, matching the local file inclusion exploitation of Gladinet CentreStack and Triofox. Attackers read Web.config to steal machine keys and secrets enabling deserialization attacks. Successful traversal to configuration files precedes full remote code execution and warrants investigation.

Suspicious VietCredCare Stealer Persistence via Startup Folder Drop

This rule detects the VietCredCare stealer binary crsysys.exe being written into the Windows Startup folder for persistence. The malware copies itself here so it relaunches at every user logon. This autostart behavior maintains attacker access for continued credential theft.

Suspicious Microsoft Edge Headless Download Execution (via process_creation)

This rule detects ITG05 Headlace activity that repeatedly launches Microsoft Edge in headless mode to silently retrieve payloads from attacker staging services. The combination of the headless and disable-gpu switches with recurring execution is uncharacteristic of user browsing. This provides covert ingress tool transfer.

Suspicious MS-SQL OLE Automation Abuse via WScript.Shell

This rule detects command execution referencing the WScript.Shell OLE automation object launched from the SQL Server process. Mallox enables sp_oacreate to instantiate WScript.Shell and run commands through OLE, bypassing the more heavily monitored xp_cmdshell path.

Masquerading Scheduled Task Masquerading as Windows Defender via Typosquatted Name (via process_creation)

This rule detects creation of a scheduled task named to impersonate Windows Defender using the misspelled Windos Defende form observed in the CylindricalCanine intrusion linked to the DigiCert incident. Adversaries name persistence tasks after trusted security tooling to blend in during casual review, making early detection critical for removing the backdoor's autostart before it re-runs.

Malicious RDP Discovery Performed on Multiple Hosts (via rdp)

This rule detects discover active RDP services via tools like Hydra. Note that this event doesn't provide any information about login outcome (success or failure) as well as user information. For further correlation, ID 4624/4625 (logon type 3, 7 or 10) as well as ID 1149 should be used.

Malicious PowerShell Spawned by IIS Worker Process via OWASSRF Exchange Exploitation (via process_creation)

This rule detects the IIS worker process w3wp.exe spawning PowerShell, a post-exploitation pattern seen in the OWASSRF exploitation of Exchange CVE-2022-41080 and CVE-2022-41082 through Outlook Web Access. Attackers use this server-side execution to run reconnaissance and drop tooling after bypassing ProxyNotShell mitigations, so PowerShell descended from an Exchange web process is a strong compromise signal.

OneNote Spawning Script Interpreter for AsyncRAT Delivery (via process_creation)

This rule detects Microsoft OneNote spawning a command shell, script host, or mshta process, the initial-execution behavior of the AsyncRAT chain that embeds a malicious HTA or script inside a OneNote document. Adversaries leverage OneNote attachments to bypass macro controls and launch a loader, making early detection critical for stopping the delivery chain before the RAT is decrypted.

Suspicious Obfuscated PowerShell Spawned by explorer via Run Dialog

This rule detects powershell launched directly by explorer with obfuscation indicators which matches the paste and run or ClickFix technique used by Mocha Manakin to trick users into pasting a malicious command into the Run dialog. This user driven execution delivers a NodeJS backdoor while bypassing many download based defenses. Detecting explorer spawned obfuscated PowerShell surfaces the initial foothold.

Suspicious Microsoft Defender Real-Time Protection Disabled

This rule detects Microsoft Defender antimalware transitioning its protection state from enabled to disabled, an effect of the defendnot fake-AV registration documented by Huntress. Attackers disable real-time protection so that subsequent tooling executes without inspection. An unexpected protection state change to off is a strong defense-evasion signal on managed endpoints.

Malicious Ransomware Extension Class Registration for ELPACO-team by Elpaco Ransomware

This rule detects registration of the .ELPACO-team file extension class under HKLM Classes. Elpaco ransomware, a Mimic variant, registers its own encrypted-file extension to associate the ransom note handler after encryption. Presence of this class key indicates ransomware has executed and modified file associations on the host.