Sigma detection rules, expert-reviewed

Malicious Cryptomining via AddInProcess Launching NEXA Miner (via process_creation)

This rule detects the .NET AddInProcess.exe binary executing with NEXA mining algorithm and pool arguments, the resource-hijacking payload dropped in this campaign to mine cryptocurrency on the victim host. Adversaries leverage AddInProcess as a signed proxy to run a bundled miner, making detection of the algorithm and pool flags a clear indicator of unauthorized mining.

Malicious Scheduled Task Creation Named ComboxResetTask

This rule detects the creation of a scheduled task named ComboxResetTask. HoneyMyte used this task name to persist its CoolClient tooling in recent campaigns as reported by Kaspersky. This specific task name combined with schtasks creation indicates malicious persistence.

Suspicious Atera Agent Installation via msiexec from PerfLogs Directory

This rule detects msiexec installing an MSI package staged in the C:\PerfLogs directory, observed in a Huntress-tracked intrusion where attackers deployed the Atera RMM agent from PerfLogs for persistence. PerfLogs is a non-standard software staging location and legitimate installers rarely run from it. Installation of remote management software from this path indicates attacker-driven persistence tooling.

Malicious Registry Run Key Persistence to ProgramData Batch File (via registry_set)

This rule detects a Registry Run key persistence entry whose value points to a batch file located under ProgramData, matching the MicrosoftUpdate run key that referenced a system.bat file in the compromised Axios NPM supply chain attack. Adversaries plant such entries under a benign-sounding name to survive reboot and relaunch their loader, so this pattern is a strong persistence indicator.

Suspicious Registry Run Key Persistence for PlugX GDatas Payload (via registry_set)

This rule detects a Run key value that points to an executable inside the Users Public GDatas directory, the persistence mechanism used to relaunch the PlugX loader at logon. Legitimate autostart entries do not execute binaries from this public path.

Malicious SQL Server Dedicated Admin Connection (DAC) Mode Activated - Native (via application)

This rule detects enabled the DAC mode in order to bypass access controls, logon triggers, perform brute force attacks or run unauthorized queries.

Suspicious BlueNoroff Hidden Payload Drop in Users Shared (via file_event)

This rule detects creation of the hidden files .pw or .pld under /Users/Shared/ on macOS. The BlueNoroff EdoneViewer dropper writes these hidden staging files to the world-readable Shared folder before executing its next stage, so their appearance indicates the backdoor unpacking its payload.

Suspicious GhostLocker Watchdog Process Execution (via process_creation)

This rule detects execution of wuachost.exe, a watchdog process spawned by GhostLocker ransomware whose name masquerades as the legitimate Windows Update client wuauclt. The watchdog restarts the ransomware if terminated, making it a strong indicator of an active GhostSec infection.

Suspicious Mint Sandstorm MediaPl DLL Loaded from Media Player AppData Path (via image_load)

This rule detects loading of MediaPl.dll from the user AppData Local Microsoft Media Player directory. Mint Sandstorm dropped this malicious DLL into a Media Player folder to masquerade as legitimate media components while executing implant code.

LegionLoader DLL Sideloading via VMware mksSandbox Loading Fake libcrypto (via image_load)

This rule detects the legitimate VMware-signed mksSandbox.exe loading a libcrypto-1_1-x64.dll from outside the trusted VMware installation path, the DLL side-loading behavior used to stage LegionLoader after a fake CAPTCHA and Cloudflare Turnstile lure. Adversaries abuse a signed binary to execute a malicious OpenSSL impersonating DLL under a trusted process, making early detection critical for surfacing loader activity before browser credential and wallet theft.

Malicious Windows Defender Exclusion Added for PowerShell and conhost

This rule detects Add-MpPreference being used to register Windows Defender process exclusions for powershell or conhost. The ClipBanker campaign distributed through a trojanized Proxifier excluded its own living-off-the-land binaries from Defender scanning to run undetected as reported by Kaspersky. Adding process exclusions for these interpreters is a strong defense-evasion signal that precedes payload execution.

Malicious Service Creation - Command (via process_creation)

This rule detects create a service for persistence.

Suspicious Outbound Network Connection from Windows Dialer Process

This rule detects the legitimate Windows dialer.exe process in System32 initiating outbound network connections which is anomalous because the tool is rarely executed and does not normally beacon. In the copyright infringement infostealer campaign the loader injected shellcode into system32 dialer.exe to proxy command and control traffic making dialer network activity a strong compromise signal.

Malicious XMRig Cryptominer Connecting to SupportXMR Pool (JINX-0132)

This rule detects a process command line referencing the supportxmr.com mining pool used by the JINX-0132 cryptojacking campaign. It matters because a mining pool address on a server is a direct indicator of resource hijacking following exposed DevOps API exploitation.

NjRAT Fileless Keylogger Storage via Registry Value (via registry_set)

This rule detects registry values containing NjRAT keystroke markers such as bracketed ENTER, TAP, or Back tokens, the fileless storage NjRAT uses to buffer captured keystrokes in the registry. Adversaries leverage registry-resident keylog data to avoid touching disk while collecting credentials, making these distinctive value contents a strong host artifact for detection.