Sigma detection rules, expert-reviewed

StealC Loader Execution via Blender Spawning Script Interpreter (via process_creation)

This rule detects blender.exe spawning a command shell or script interpreter such as PowerShell, cmd, or python, the execution behavior triggered when a malicious .blend file with embedded auto-run Python fetches a remote loader in the StealC V2 Blender campaign. Adversaries leverage the Blender Auto Run Python Scripts setting so opening a downloaded model executes their loader, making early detection critical for stopping the chain before the StealC stealer and Pyramid C2 module deploy.

Malicious Brutforce Enumeration with Unexisting Users - Kerberos (via security)

This rule detects enumerate potential existing users, resulting in failed Kerberos TGT requests with unexisting or invalid accounts.

Malicious Defender Exclusion for Fake DefenderUpdates Folder via Add-MpPreference (via process_creation)

This rule detects Add-MpPreference adding a scanning exclusion for the DefenderUpdates folder under the roaming profile, the staging directory into which Salat Stealer drops its docconv.exe payload. Adversaries leverage a Defender exclusion path that mimics a legitimate update folder so the dropped executable can run unscanned, making early detection critical for catching persistence before data theft.

Masquerading Bumblebee Loader MSI Download via PowerShell Invoke-WebRequest and Silent msiexec (via process_creation)

This rule detects a single PowerShell command that uses Invoke-WebRequest to download an MSI installer and then launches msiexec silently, the delivery behavior used by an LNK-triggered Bumblebee loader infection chain masquerading as Nvidia and Midjourney installers. Chaining a remote MSI fetch with a quiet install in one command line is a strong indicator of staged loader delivery before in-memory payload execution.

Suspicious Self-Copied CMD Script in ProgramData (via file_event)

This rule detects creation of a command script named rEgX.cmd within the ProgramData directory. The Dead#Vax campaign copied itself to this file as part of its persistence and self-healing routine.

Malicious Webserver IIS Module Installed - Command (via process_creation) - Variant 2

This rule detects deploy an IIS module via the gacutil tool.

Suspicious UPDTAE Backdoor Reverse Shell HTTP Beacon via Quad7 Operators

This rule detects HTTP requests carrying the hardcoded User-Agent value IOT together with POST requests to the /iot/post URI, the reverse shell beaconing pattern of the UPDTAE backdoor deployed by the Quad7 operators. The implant polls its C2 roughly every thirty seconds using this fixed header and path. The unusual static User-Agent and endpoint make this a reliable network indicator.

Malicious wp2shell User Agent in Web Requests (via webserver)

This rule detects inbound web requests carrying the wp2shell or rezwp2shell user-agent strings used by the exploitation tooling for CVE-2026-63030 and CVE-2026-60137. These agent values identify automated scanning and exploitation attempts against WordPress. The strings are tool-specific and rarely seen in benign traffic.

PowerShell Loader Execution of Skype.ps1 from Public Folder (via process_creation)

This rule detects PowerShell executing a Skype.ps1 loader staged in the C users Public folder, the AsyncRAT delivery behavior observed in campaigns abusing ScreenConnect and open directories. Adversaries leverage the world-writable Public path to stage and run a fileless .NET loader while masquerading as a common application.

Malicious ClickFix PowerShell Launching mshta with Remote URL (via process_creation)

This rule detects the ClickFix initial-access pattern where powershell.exe invokes mshta against a remote URL after a victim pastes a clipboard command through the Run dialog, as documented by Group-IB. Adversaries use this social-engineering chain to fetch and execute an HTA-based downloader, so the powershell-to-mshta URL pattern is a strong entry-point signal.

Malicious Webserver IIS Module Installed - PowerShell (via powershell)

This rule detects deploy an IIS module via PowerShell.

Malicious Replication Privileges Accessed to Perform DCSync Attack (via security)

This rule detects use DCSync or SecretDump tool to exfiltrate Active Directory credentials.

Suspicious IIS Worker Process Spawning Encoded PowerShell via Gladinet Exploitation

This rule detects the IIS worker process w3wp.exe spawning PowerShell with an encoded command argument, a behavior observed during active exploitation of the Gladinet CentreStack and Triofox insecure cryptography vulnerability where ViewState deserialization leads to code execution. Attackers abuse the hardcoded machineKey to forge ViewState payloads that execute PowerShell from the web application context. This chain indicates web-facing remote code execution and should be treated as a likely server compromise.

Suspicious cscript Execution of JavaScript Spawned by PowerShell

This rule detects powershell.exe spawning cscript.exe to run a JavaScript file, the ClickFix execution chain used by EddieStealer in which a pasted PowerShell command launches a downloaded .js loader. This parent-child relationship combined with script-host execution indicates fake-CAPTCHA social-engineering malware delivery.

Malicious PlugX DLL Side-Loading via iviewers OLE Object Viewer (via image_load)

This rule detects the legitimate iviewers.exe OLE COM Object Viewer loading a co-located iviewers.dll from a non standard directory such as ProgramData. Velvet Ant abused DLL search order hijacking against this signed Windows SDK utility to load a PlugX loader and payload. Legitimate use of this tool loads its DLL from the SDK installation directory only.