Sigma detection rules, expert-reviewed

Suspicious Process Argv0 Masquerade As Kernel Worker via GSOCKET

This rule detects a process launched with an argv0 spoofed to resemble a kernel worker thread such as a bracketed raid5wq name which the GSOCKET tooling uses to hide its reverse connectivity on Linux hosts. Adversaries masquerade as kernel threads to blend into process listings and evade casual inspection.

APT28 httd Implant Persistence via systemd linux.service from Boot Directory (via process_creation)

This rule detects systemctl enabling a service named linux.service, the systemd persistence behavior used by the APT28 httd Linux implant staged from the boot directory in Operation Roundish. Adversaries leverage a generically named systemd unit to survive reboots on compromised mail servers.

AutoIt Payload Reassembly via copy /b File Concatenation

This rule detects the use of copy /b to concatenate multiple file fragments together with a bundled AutoIt3 interpreter. CastleLoader uses this evasion technique to rebuild its compiled a3x script on disk from scattered parts.

Malicious Web Shell Written to a Web Server Root by a Server Worker Process (via file_event)

This rule detects a web-server worker process such as the IIS w3wp.exe or a PHP/Java handler writing a server-side script file into a web root, the classic signature of a web shell being planted after exploitation of an internet-facing application. Web shells provide persistent remote access and are a recurring initial-access and persistence technique in the Red Canary Threat Detection Report. Detecting server processes dropping executable web content surfaces the compromise.

Malicious Registry Hive Dump of SAM and SYSTEM via Reg Save (via process_creation)

This rule detects use of reg save to export the SAM, SYSTEM, or SECURITY registry hives, a credential access technique used by CL-UNK-1068 to obtain local account hashes and LSA secrets. The exported hives allow offline extraction of credentials, so this command outside of sanctioned backup routines indicates active credential theft.

Suspicious Regsvr32 Execution From Non-Standard Datop Directory

This rule detects regsvr32.exe registering a payload located under the non-standard C\Datop directory used by the DatopLoader campaign that exploited ProxyShell to deliver QBot and Cobalt Strike. Attackers abuse regsvr32 to proxy execution of a malicious DLL and evade application controls, so execution from this staging path is a strong loader indicator.

EtherRAT Persistence via WindowsHost Run Key (via registry_set)

This rule detects EtherRAT establishing autostart persistence through a WindowsHost value under the CurrentVersion Run key that points to conhost or node executing the backdoor, a persistence behavior seen in The Gentlemen intrusions. Adversaries leverage Run key entries so the Node.js backdoor relaunches at every user logon.

Malicious ClickFix Stager Piping curl Output to osascript

This rule detects a curl download whose output is piped into osascript, the ClickFix execution pattern that tricks macOS users into running a remote AppleScript stager. Tech-support impersonation lures instruct victims to paste a one-liner that fetches and runs the loader delivering a macOS infostealer. Fetch-and-execute of remote script through osascript is not legitimate user behavior and indicates initial compromise.

StealC Persistence via LNK Dropped to Startup Folder by Non-Shell Process (via file_event)

This rule detects creation of a shortcut in the user Startup folder by a process other than the Windows shell or Office click-to-run, the persistence behavior used by the StealC V2 Blender campaign to auto-run its LNK payloads at logon. Adversaries leverage Startup-folder shortcuts for simple logon persistence, making early detection critical for surfacing the foothold before the stealer runs on every session.

Suspicious Browser History Wipe via RunDll32 ClearMyTracksByProcess

This rule detects rundll32 invoking InetCpl ClearMyTracksByProcess to clear browsing and cache artifacts. The Gh0stGambit dropper used this to erase indicators after deploying Gh0st RAT. Programmatic history wiping through this control panel handler is a cleanup step rarely performed by normal user activity.

Malicious Kernel Module Loaded From a User-Writable Path on Linux (via process_creation)

This rule detects insmod loading a kernel module (.ko) from a temporary or user-writable directory, an indicator of a loadable-kernel-module rootkit being installed rather than a package-managed driver. Kernel module abuse is a stealthy Linux persistence and defense-evasion technique referenced in the Red Canary Threat Detection Report. Because legitimate drivers load from system paths, module loads from user paths are a strong indicator of malicious activity.

Suspicious Larva-24009 C2 Command and Exfiltration URI Patterns (via proxy)

This rule detects outbound HTTP requests to the Larva-24009 C2 endpoints used for command retrieval, persistence script delivery, and screenshot exfiltration. These specific PHP endpoint paths under a Res directory are unique to this campaign infrastructure.

Malicious Windows Defender Antispyware Disable via Registry (via registry_set)

This rule detects modification of the DisableAntiSpyware registry value to enable it and turn off Microsoft Defender. Black Basta operators disable Defender via this policy value to evade detection before deploying ransomware, so a set of this value to one indicates active defense evasion.

Suspicious Scheduled Task ApphostRagistreationVerifier Creation by FishMonger

This rule detects creation of a scheduled task named ApphostRagistreationVerifier, a misspelled masquerade used by the FishMonger group to run SprySOCKS as SYSTEM. The activity is tied to the FishMonger arsenal upgrade that establishes persistence through a task impersonating a legitimate host registration verifier. Detecting this unique task name is important because it reveals privileged persistence for a stealthy backdoor.

Suspicious Wscript Execution of JavaScript From AppData Local Temp via Process Creation (via process_creation)

This rule detects Windows script host launching a JavaScript file from the user AppData Local Temp directory, the initial execution stage of Gootloader as emulated by Red Canary with Atomic Red Team. Gootloader delivers malicious .js payloads via SEO-poisoned downloads, and script host running such files from a temporary path is a reliable entry point for the infection chain.