Sigma detection rules, expert-reviewed

Suspicious Internet Settings ZoneMap Modification Enabling UNC as Intranet (via registry_set)

This rule detects modification of the Internet Settings ZoneMap UNCAsIntranet value, part of the ZoneMap changes made by the OpenClaw payload to relax security zone handling and suppress network warnings before contacting its C2. Adversaries adjust ZoneMap keys to make remote and UNC content trusted, making this registry change a useful defense-evasion signal when correlated with the loader.

Suspicious Desktop Window Manager Spawning Shutdown Utility via Process Creation

This rule detects the Desktop Window Manager process dwm launching the shutdown utility which is an anomalous chain observed in an in the wild Windows local privilege escalation exploit that injected shellcode into dwm and invoked shutdown to trigger a DLL hijack against LogonUI. The genuine dwm process does not spawn shutdown so this relationship indicates exploitation.

Possible Process Injection Target RegAsm Launched Without Arguments via Process Creation

This rule detects RegAsm.exe from the .NET Framework directory started with no command-line arguments, a state characteristic of a hollowed or injected host process rather than legitimate assembly registration. Lumma Stealer distributed through fake Hamster Kombat lures injects its payload into RegAsm.exe to run under a trusted signed binary. This indicates likely process injection and stealer execution.

Malicious NTDS Extraction via Ntdsutil IFM Media Creation

This rule detects use of ntdsutil to create an install from media snapshot which extracts the Active Directory database and this technique was used during the NetSupport intrusion to steal the domain credential store and this matters because IFM creation dumps every domain hash in one operation and is almost never run by legitimate operators outside of controlled domain controller provisioning.

Suspicious Local Account Creation via Net Command

This rule detects local user account creation through the net utility, a living-off-the-land technique used to establish persistence, including accounts masquerading as WDAGUtilityAccount or ASP.NET service identities. Attackers add accounts to retain access after initial compromise. Unexpected account creation on endpoints is a common persistence and privilege staging step.

Malicious Remote HTA Execution Disguised as Media File via mshta (via process_creation)

This rule detects mshta.exe executing a remote HTA payload whose URL is disguised with an audio or video file extension. The ClearFake ClickFix variant delivers its loader as an HTA masquerading as an mp3 mp4 or m4a file fetched over HTTP. Combining the mshta living-off-the-land binary with a remote media-named URL is a reliable indicator of drive-by compromise.

Suspicious COM Handler Hijack of MsCtfMonitor CLSID via CharmingCypress

This rule detects registration of a COM InprocServer32 handler under the MsCtfMonitor task CLSID which CharmingCypress hijacked for persistence and code execution. Hijacking this scheduled-task COM object causes attacker code to load when the task triggers. This technique blends malicious execution into legitimate Windows components.

Malicious Volume Shadow Copy Deletion via WMI PowerShell (via process_creation)

This rule detects PowerShell querying the Win32_Shadowcopy WMI class and invoking a delete or remove operation to destroy volume shadow copies. Akira used this to inhibit system recovery before encryption. Removing shadow copies prevents victims from restoring files without paying the ransom.

Malicious Wscript Executing Temp File as JavaScript (via process_creation)

This rule detects wscript or cscript invoking the JavaScript engine against a file with a tmp extension, the execution behavior of a Konni AsyncRAT chain that runs 83972.tmp as JavaScript from ProgramData. Adversaries leverage the engine override switch to run script content from a mismatched temp extension while evading extension based controls, making early detection critical for surfacing the scripting stage before further payload execution.

Suspicious Executable Launched By Explorer From Archive Path (via process_creation)

This rule detects explorer.exe launching an executable whose path resides inside a ZIP archive directory, matching TinyNote delivery where a user runs an EXE directly from an opened archive. Executing binaries from within archive temp paths is a common initial-access vector and bypasses mark-of-the-web prompts.

Malicious Webserver IIS Module Installed - Command (via process_creation)

This rule detects deploy an IIS module.

Suspicious Enabling of Remote Desktop via fDenyTSConnections (via registry_set)

This rule detects the fDenyTSConnections value being set to zero, which enables inbound Remote Desktop on a host, a change attackers make to establish interactive remote access for lateral movement. Enabling RDP through the registry is a lateral-movement enablement technique in the Red Canary Threat Detection Report. Detecting this modification surfaces remote-access being opened on the endpoint.

Malicious Account Added to Domain Admins Group via net Command

This rule detects the net command adding an account to the Domain Admins group, a privilege escalation step observed during Gootloader post-exploitation where a rogue account was joined to Domain Admins. Elevating an attacker-controlled account to domain administrator grants full directory control. Domain Admins membership changes from the command line are rare and high risk.

Uncommon Execution Delay via W32tm Stripchart (via process_creation)

This rule detects the time service utility w32tm being run in stripchart mode, an abuse the STRT cross-RAT analysis attributes to DarkCrystal RAT as a sleep primitive to delay execution and evade sandbox analysis. Adversaries leverage w32tm stripchart as an unusual timing mechanism in place of a normal sleep call, so this behavior warrants review alongside the surrounding process chain.

Suspicious rundll32 Loading DEEPDATA data.dll with mod.dat Key via BrazenBamboo

This rule detects rundll32 loading data.dll together with a mod.dat argument the loading pattern of the BrazenBamboo DEEPDATA malware framework. DEEPDATA decrypts its payload using the mod.dat key file. Proxy execution via rundll32 helps evade application controls and disguise malware as a signed process.