Sigma detection rules, expert-reviewed

In-Memory Reverse Shell and In-Memory Payload Staging During Ivanti CSA Exploitation (via process_creation)

This rule detects reverse shell establishment through netcat with the command-execution flag spawning a shell, or payload staging into the memory-backed /dev/shm directory, both observed during Houken exploitation of Ivanti Cloud Service Appliance devices. Adversaries leverage these techniques to obtain interactive access and stage tooling without touching disk, making early detection critical for catching hands-on-keyboard activity on the appliance.

Malicious GHOSTPULSE DLL Side-Loading of libcurl via VBoxSVC

This rule detects the VirtualBox VBoxSVC executable loading a libcurl DLL from outside its normal installation directory which is the side-loading path GHOSTPULSE abuses to execute its stager. The rule excludes loads from genuine VirtualBox directories to focus on the malicious wrong context placement.

Suspicious ctfmon.exe Execution With Command-Line Arguments via PikaBot Injection

This rule detects ctfmon.exe launched with command-line parameters, which is anomalous because the legitimate Text Services process normally runs without arguments. PikaBot spawns a suspended ctfmon.exe with a numeric switch such as -p 1234 to host injected shellcode through thread hijacking. Catching this deviation exposes early stage process injection used to evade endpoint controls.

Malicious Hidden Logon Scheduled Task RuntimeOptimizeService via TCLBANKER

This rule detects creation of a scheduled task named RuntimeOptimizeService with a logon trigger and hidden attribute as used by the TCLBANKER banking trojan for persistence in Elastic research. The service like task name combined with a hidden logon trigger indicates a masqueraded persistence mechanism for the implant.

Malicious Cloud Atlas PowerShell Download Cradle via IEX WebClient (via process_creation)

This rule detects PowerShell combining Invoke-Expression with a Net.WebClient object to fetch and execute remote content, the download cradle used by Cloud Atlas to run its next stage in memory. The technique avoids writing the payload to disk before execution. Detecting the IEX and WebClient combination surfaces staged payload execution.

Malicious Lateral Movement via Impacket WMIExec Command Pattern

This rule detects the Impacket wmiexec command pattern where cmd.exe runs with /Q /c and redirects output to a loopback ADMIN$ share, observed by Huntress during a targeted intrusion at a marketing research firm. Attackers use this pattern for semi-interactive remote command execution over WMI while capturing output through SMB. The loopback ADMIN$ output redirection is a distinctive signature of Impacket-style lateral movement.

Suspicious Entra ID Auth Broker Sign-In With Node.js User Agent via Tycoon 2FA

This rule detects Entra ID sign ins against the Microsoft Authentication Broker application from Node.js based clients such as axios undici and node-fetch as characteristic of Tycoon 2FA adversary in the middle attacks in Elastic research. Automated Node runtimes replaying stolen tokens through the Auth Broker indicate token theft and primary refresh token abuse rather than genuine user interaction.

PlugX DLL Sideloading via mcoemcpy.exe Loading McUtil.dll (via image_load)

This rule detects the legitimate McAfee binary mcoemcpy.exe loading a malicious McUtil.dll, the DLL side-loading behavior used to launch the PlugX backdoor in the NailaoLocker intrusions across Europe. Adversaries abuse a trusted signed executable to run the PlugX loader under a benign process while evading endpoint controls.

Renamed DLL Sideloading via Renamed Greenshot Loading GreenshotPlugin from AppData (via image_load)

This rule detects a masqueraded FortiClientCompliance.exe, which is a renamed signed Greenshot binary, sideloading GreenshotPlugin.dll from a user-writable FortiClient compliance directory. Adversaries abuse this signed executable to load an attacker-controlled plugin DLL that in turn decrypts and runs shellcode, making early detection critical for surfacing the loader before command-and-control is established.

Malicious PowerShell Masquerading as wt.exe in ProgramData via Axios npm Compromise (via process_creation)

This rule detects a PowerShell binary renamed to wt.exe and executed from ProgramData, a masquerading technique used by the malicious postinstall payload delivered through the compromised Axios npm package. Adversaries rename PowerShell to evade name-based detection while running follow-on scripts, so a PowerShell OriginalFileName under a wt.exe in ProgramData is a strong indicator of the supply chain implant.

Malicious DLL Sideload from Public Music Directory

This rule detects loading of package.dll from the C Users Public Music directory used for DLL sideloading. This behavior matches Ivanti CVE-2025-0282 post-exploitation where operators staged package.dll in a public path to be sideloaded by a signed host process. DLLs loaded from world-writable public folders are a hallmark of sideloading based defense evasion.

Malicious Windows Defender Disable via Set-MpPreference

This rule detects Set-MpPreference being invoked to disable Microsoft Defender protection features which the Dark Pink APT uses to blind endpoint defenses before deploying its tooling. Turning off real time monitoring and scanning lets subsequent payloads run unimpeded. It is important because tampering with Defender is an early and deliberate defense evasion step.

Malicious Cryptominer Masquerading as Kubernetes pause Container

This rule detects execution of a binary named pause from the /var/tmp directory. Wiz Research observed the DERO cryptojacking campaign disguising its miner as the legitimate Kubernetes pause container while writing it to /var/tmp, so this wrong path plus trusted name combination indicates masquerading and resource hijacking.

Suspicious IIS Worker Process Spawning Command Shell via Web Shell (via process_creation)

This rule detects the IIS worker process spawning a command interpreter or WMI utility, a behavior consistent with the Phantom Taurus web shell loading IIServerCore inside w3wp.exe. Server-side web shells use the worker process to execute reconnaissance and lateral movement commands. Detecting this chain surfaces active exploitation of a public-facing web application by a Chinese-nexus APT.

Malicious Computer Account Modifying Active Directory Permissions - PrivExchange (via security)

This rule detects compromise a server with high privileges to perform permissions changes. PrivExchange attack can be detected using this rule.