Sigma detection rules, expert-reviewed

Suspicious HealthApp Batch File Persistence in Start Menu Startup Folder

This rule detects creation of a batch file named after the HealthApp masquerade inside the Start Menu Programs startup folder. The Maverick banking Trojan established persistence by dropping a HealthApp-[GUID].bat file into the user startup location so it re-executes at logon. A batch script placed in the startup folder is a classic autostart persistence mechanism abused to survive reboots.

Suspicious Shai-Hulud GitHub Workflow File Drop (via file_event)

This rule detects creation of a shai-hulud-workflow.yml GitHub Actions workflow file planted by the Shai-Hulud npm worm. The malicious workflow is written into infected repositories to persist and to exfiltrate secrets to attacker infrastructure. The distinctive workflow filename is a reliable artifact of this supply-chain compromise.

Suspicious adhapl Service DLL Dropped in System32 by BellaCPP

This rule detects creation of adhapl.dll in the Windows System32 directory, the service DLL used by the BellaCPP backdoor exporting ServiceMain. BellaCPP, a C++ variant of BellaCiao, installs this DLL to run as a persistent service. Presence of this specific DLL in System32 indicates BellaCPP deployment.

Suspicious MDaemon WorldClient CgiBase6 Extension Registration by Careto

This rule detects modification of the MDaemon WorldClient.ini configuration to add CgiBase6 or CgiFile6 CGI extension entries. The Careto APT abuses this legitimate mail server extension mechanism to load a server-side implant that executes attacker CGI code. Injection of these CGI keys into the WorldClient configuration indicates a persistent web-facing backdoor.

Suspicious Linux Boot Persistence via rc.local or init.d Modification (via file_event)

This rule detects modification of /etc/rc.d/rc.local or files under /etc/init.d which the DinodasRAT Linux implant abuses to survive reboots by registering itself as a boot-time service which is a common Linux persistence technique warranting review.

Malicious DinodasRAT Hidden Config File Creation on Linux (via file_event)

This rule detects creation of the hidden configuration file /etc/.netc.conf which is dropped by the DinodasRAT Linux implant to store its C2 settings enabling persistent espionage and its presence indicates an active backdoor on the host.

Suspicious macOS Backdoor LaunchAgent launched Plist Persistence (via file_event)

This rule detects creation of a LaunchAgent property list whose name begins with launched. in a LaunchAgents directory on macOS. The cracked-software crypto-stealing backdoor persists via /Library/LaunchAgents/launched.<uuid>.plist, so this naming prefix indicates the implant registering itself to run at login.

Suspicious NKAbuse Implant Staging under StoreService Config Directory (via file_event)

This rule detects creation of a file whose name begins with app_linux_ inside a .config/StoreService directory on Linux. After exploiting a public-facing service the NKAbuse setup script drops its architecture-specific binary app_linux_{ARCH} into /root/.config/StoreService/, so this path and name pattern indicates the multiplatform implant being installed.

Suspicious Dell DBUtilDrv2 Vulnerable Driver Load via driver_load

This rule detects loading of the Dell DBUtilDrv2.sys driver which is a known vulnerable driver abused in bring your own vulnerable driver attacks. ToddyCat installed DBUtilDrv2.sys through a crafted INF to disable kernel notification routines and blind security products. The presence of this signed but vulnerable driver on non Dell maintenance systems is a strong indicator of kernel level tampering.

Suspicious DGA Subdomain Resolution of systemupdate.info by BellaCPP

This rule detects DNS queries for subdomains under the systemupdate.info domain used as command-and-control by the BellaCPP backdoor. The malware builds DGA-style hostnames of a short letter string plus an identifier and country code under this parent domain. Resolution of this C2 domain indicates active BellaCPP beaconing.

Possible Victim Geolocation Lookup via ip-api.com

This rule detects DNS queries to ip-api.com which returns geolocation for the host public IP. The Grandoreiro banking trojan queried this service to geolocate victims and select targets, though the service is also used by some legitimate software so context is required.

Malicious DNS Query To fdmpkg C2 Domain via DNS Query

This rule detects DNS resolution of subdomains under the fdmpkg C2 domain used by the backdoored Free Download Manager Linux package. The malware encodes a 20-byte hex value as a subdomain of u.fdmpkg[.]org for DNS-based command-and-control, so any query matching this structure indicates an infected host.

Possible xrdp RCE Exploitation via ts_info_utf16_in Buffer Overflow (via application)

This rule detects xrdp log messages indicating an output buffer overflow in ts_info_utf16_in or a stack smashing abort, artifacts produced when CVE-2025-68670 is exploited through an oversized Client Info PDU domain field. The overflow can lead to remote code execution against the xrdp service. Detecting these log lines surfaces active exploitation of the vulnerable service.

Malicious FortiGateUpdate Service DLL Registration by Cyber Partisans (via registry_set)

This rule detects registration of a ServiceDll under the FortiGateUpdate service Parameters key, a masqueraded service used to load a DNSCat2 tunneling DLL. This behavior was observed in Cyber Partisans activity aimed at espionage and disruption against industrial targets. The security-product masquerade combined with a ServiceDll load is a strong persistence and C2 indicator.

Suspicious FatalRAT Run Key Persistence to ProgramData Loader (via registry_set)

This rule detects FatalRAT persistence via the SVP7 Run key value or a Run value pointing at the C\ProgramData\KnGoe loader path. This behavior was observed in Operation SalmonSlalom where the backdoor established autostart persistence for its 0user.exe loader. Detecting the registry autostart entry exposes the persistence foothold of the campaign.