Sigma detection rules, expert-reviewed

Suspicious AnyDesk Silent Install With Unattended Password

This rule detects AnyDesk being configured with the --set-password flag to enable unattended access without user interaction. The Librarian Ghouls APT installs AnyDesk this way to maintain covert remote control of compromised machines for data theft and crypto mining. Silent password provisioning of a remote-access tool is a common hands-on-keyboard persistence step.

Malicious ShadowGuard eBPF Rootkit Control via Magic Kill Signal (via process_creation)

This rule detects the kill command issued with the out-of-range signals 900 and 901, the covert control channel used to command the ShadowGuard eBPF rootkit in the Shadow espionage campaigns. Real signals never exceed 64, so these magic values are interpreted only by the rootkit to toggle its process allow-list and hiding behavior.

Malicious TBK DVR Command Injection Exploitation via RondoDox (via webserver)

This rule detects RondoDox botnet exploitation of the TBK DVR command injection flaw CVE-2024-3721 by requesting the device.rsp endpoint with the distinctive S_O_S_T_R_E_A_MAX command marker. This request injects operating system commands to drop the loader. The pattern is unique to the exploit.

Suspicious Triada mms-core.jar Backdoor Dropped in App Data

This rule detects creation of an mms-core.jar file within an application data directory which the Triada trojan drops as a backdoor module loaded into hooked processes. This module implements the trojan command handling used to intercept SMS and manipulate clipboard cryptocurrency addresses. The specific filename in a per-app data path is a reliable Triada artifact.

Malicious curl Insecure Download to AppData or Temp

This rule detects curl.exe writing a downloaded file into the AppData or Temp directory using the insecure flag, the ClickFix installation pattern used in OpenClaw brand-lure campaigns to fetch infostealer payloads before immediate execution. Attackers instruct victims to paste a terminal command that curls the payload to a user writable path. Downloading executables into AppData or Temp with certificate checks disabled is a strong staging indicator.

Suspicious Defender Exclusion for Public Controller Path (via process_creation)

This rule detects PowerShell adding a Microsoft Defender exclusion for a Controller folder under C:\Users\Public as done by the Efimer Trojan to protect its payload. Whitelisting an attacker-controlled directory in a world-writable location lets the malware run and update without being scanned. This combination of Add-MpPreference and a public path is rarely legitimate.

Suspicious Run Key Persistence Pointing to Temp or Public Folder

This rule detects creation of autorun registry values whose payload path resides in a temporary or public user writable directory which Phobos ransomware uses to survive reboots. Legitimate software rarely persists from these transient locations so this pattern is a reliable indicator of malicious persistence.

Suspicious PowerShell Download of scrss or ekrn Masquerading Scripts

This rule detects PowerShell referencing scrss.ps1 or ekrn.ps1, downloader script names used in the Gamaredon and Turla collaboration to fetch and stage further payloads. The script names imitate the legitimate csrss and ESET ekrn processes, and their presence in PowerShell activity indicates masqueraded ingress tooling and command execution.

Obfuscated Firewall Deactivation - Modern Command (via process_creation)

This rule detects disabled the Windows Firewall to evade defense.

Malicious VoidLink Kernel Module Load via Insmod (via process_creation)

This rule detects loading of the VoidLink rootkit kernel modules via insmod or modprobe under masquerading and rootkit names. Observed in Elastic Security Labs analysis where vl_stealth.ko or a fake amd_mem_encrypt.ko module installs ftrace syscall hooks and eBPF-based hiding to conceal the framework.

Malicious DLL Sideloading of screen_retriever_plugin via TCLBANKER Loader

This rule detects the signed logiaipromptbuilder executable loading a screen_retriever_plugin DLL used to sideload the TCLBANKER banking trojan in Elastic research. Abusing a trusted host binary to load an attacker controlled DLL of this name lets the trojan execute under a legitimate process context.

Suspicious File Download via certutil urlcache split

This rule detects certutil downloading a file using the urlcache split -f flag combination, an ingress technique used in the ActiveMQ intrusion. Legitimate certutil usage does not combine these download flags, so this pattern reliably flags living-off-the-land payload retrieval.

Malicious WinRing0 Vulnerable Driver Load

This rule detects loading of the WinRing0 kernel driver which the BlueSky actor deployed as a bring your own vulnerable driver to tamper with protected processes and disable security controls and this matters because this signed but abusable driver grants ring zero access and its presence outside of the few legitimate hardware utilities that ship it is a strong indicator of defense evasion.

Suspicious PowerShell Remote Script Execution From GitHub via irm and iex (via process_creation)

This rule detects the multi stage Windows campaign loader running PowerShell that pipes an Invoke-RestMethod download of a raw GitHub hosted script into Invoke-Expression for fileless execution. Fetching and executing raw GitHub content in memory is a hallmark of the initial loader. Later stages disable Defender and deploy a RAT and ransomware.

Malicious Credential Harvesting Request via All-in-1 PHP Endpoint (via proxy)

This rule detects HTTP requests to an All-in-1.php endpoint carrying user and password query parameters characteristic of the GTFire phishing scheme credential harvesting kit. GTFire lures victims through translate.goog and web.app redirect hops before submitting stolen credentials via crafted GET parameters. Surfacing this traffic reveals active phishing credential theft against organization users.