Sigma detection rules, expert-reviewed

Suspicious Rclone Exfiltration Masquerading as wininit.exe

This rule detects a process named wininit.exe running with Rclone-style cloud transfer arguments such as copy with remote configuration flags. Talos IR observed the Rclone exfiltration binary renamed to wininit.exe to blend with a legitimate system process while bulk-copying victim data to attacker cloud storage, so this Image and command-line mismatch flags staged exfiltration.

Malicious Volume Shadow Copy Deletion via vssadmin

This rule detects vssadmin deleting volume shadow copies, an inhibit-recovery action performed in Talos IR ransomware engagements immediately before encryption. Removing shadow copies prevents victims from restoring files and is a near-universal precursor to ransomware detonation.

Malicious Renamed Python Interpreter Executing nvidia.py RAT

This rule detects a Python interpreter executing a script named nvidia.py, the Python GolangGhost RAT payload run by Famous Chollima after a VBScript unpacks and renames the interpreter. The nvidia.py filename masquerades as GPU tooling while providing RC4-encrypted HTTP command-and-control and credential theft.

Suspicious sha256sum.exe Execution from Windows Temp Directory

This rule detects a binary named sha256sum.exe executing from C:\Windows\Temp, the masqueraded filename PathWiper used for its wiper component. A legitimate-sounding hashing utility running from Windows Temp rather than a standard install location is the destructive payload disguised to evade casual inspection before it overwrites NTFS structures.

Malicious PathWiper Loader Script Execution from Windows Temp via WScript

This rule detects wscript.exe executing uacinstall.vbs from the C:\Windows\Temp directory, the loader stage of the PathWiper wiper used against Ukrainian critical infrastructure. A VBScript with this name running from Windows Temp is the delivery vehicle that drops and launches the destructive wiper payload.

Malicious IIS Worker Process Spawning Command Shell Reconnaissance

This rule detects the IIS worker process w3wp.exe spawning cmd.exe or powershell.exe to run host reconnaissance such as ipconfig, tasklist or dir. UAT-6382 exploited a Cityworks zero-day to drop web shells and then executed this recon under the web server context, a hallmark of post-exploitation web-shell activity that precedes tooling download and Cobalt Strike deployment.

Malicious Scheduled Task Masquerading as GoogleUpdate Launching SSH Reverse Shell

This rule detects creation of a scheduled task named GoogleUpdateTaskMachine whose action invokes OpenSSH to establish a reverse shell. The ToyMaker access broker registers this masqueraded task so an outbound SSH connection provides durable remote access, letting the operator hand off footholds to ransomware affiliates while appearing to be a benign updater.

Suspicious ToyMaker LAGTOY Service Creation Masquerading as WmiPrvSV via sc.exe

This rule detects creation of a Windows service named WmiPrvSV via sc.exe, a name that mimics the legitimate WMI Provider Host (WmiPrvSE) to blend in. The LAGTOY implant used by the ToyMaker initial access broker installs itself under this masqueraded service name for persistence, so this is a strong indicator of that access broker preparing hands-on-keyboard follow-up for double extortion gangs.

Malicious Impacket Wmiexec Remote Command Execution Pattern

This rule detects the command redirection pattern produced by Impacket wmiexec where cmd.exe is spawned by WmiPrvSE.exe to run a command and write output to a local admin share path. This semi interactive execution over WMI is a hallmark of lateral movement using stolen credentials as seen in the UAT-5918 activity.

Malicious Credential Dumping via Mimikatz Sekurlsa Command

This rule detects command line usage of the mimikatz sekurlsa module which the intrusion set used to extract plaintext credentials and hashes from LSASS memory during the attacks on Japanese targets. The sekurlsa keyword in a command line is a high confidence indicator of credential theft tooling even when the binary has been renamed.

Malicious PowerShell Spawned by PHP CGI Process

This rule detects the php-cgi.exe process spawning PowerShell which indicates exploitation of CVE-2024-4577 argument injection to achieve remote code execution on Windows PHP servers as seen in the persistent attacks against Japanese organizations. A web facing PHP CGI interpreter launching PowerShell is not expected during normal operation and signals server compromise.

Suspicious Executable Running from Public Pictures Directory

This rule detects execution of binaries located under the Users Public Pictures directory which the Lotus Blossom group uses as a staging location for its hacking tools and backdoor components. Executables running from a media folder that normally holds only images are a strong indicator of tool drop and execution.

Suspicious Python Execution via Renamed Synaptics Binary

This rule detects a process named synaptics.exe executing inline interpreter code through a dash c argument which the PXA Stealer campaign achieves by shipping a portable Python interpreter renamed to synaptics.exe to blend in with the legitimate touchpad driver. Running interpreter style command arguments from a synaptics named binary is a masquerading indicator of stealer execution.

Suspicious Remote Admin Share Execution via Conhost

This rule detects the console host process conhost.exe launched with arguments referencing a remote administrative admin share which Interlock ransomware operators abuse for lateral movement and remote command execution. Conhost invoked with a remote drive share path is anomalous because it is normally spawned locally by console applications without any network share argument.

Malicious Scheduled Task Creation TaskSystem via Interlock Ransomware

This rule detects creation of a scheduled task named TaskSystem that runs in the SYSTEM context which Interlock ransomware operators use to establish persistence and execute payloads with elevated privileges. The fixed task name combined with SYSTEM execution distinguishes this from routine administrative task creation.