Sigma detection rules, expert-reviewed

Malicious Account Added to Domain Admins Group via net Command

This rule detects the net command adding an account to the Domain Admins group, a privilege escalation step observed during Gootloader post-exploitation where a rogue account was joined to Domain Admins. Elevating an attacker-controlled account to domain administrator grants full directory control. Domain Admins membership changes from the command line are rare and high risk.

Uncommon Execution Delay via W32tm Stripchart (via process_creation)

This rule detects the time service utility w32tm being run in stripchart mode, an abuse the STRT cross-RAT analysis attributes to DarkCrystal RAT as a sleep primitive to delay execution and evade sandbox analysis. Adversaries leverage w32tm stripchart as an unusual timing mechanism in place of a normal sleep call, so this behavior warrants review alongside the surrounding process chain.

Suspicious rundll32 Loading DEEPDATA data.dll with mod.dat Key via BrazenBamboo

This rule detects rundll32 loading data.dll together with a mod.dat argument the loading pattern of the BrazenBamboo DEEPDATA malware framework. DEEPDATA decrypts its payload using the mod.dat key file. Proxy execution via rundll32 helps evade application controls and disguise malware as a signed process.

Malicious Silver Fox Scheduled Task Persistence via AppClient (via process_creation)

This rule detects schtasks.exe creating a minute interval task named AppClient, the persistence mechanism used by the Silver Fox ABCDoor backdoor to repeatedly relaunch itself. The high frequency task keeps the implant resident after a tax notification phishing compromise. Detecting the AppClient task creation surfaces backdoor persistence.

Suspicious Assembly Execution via Regasm or Regsvcs From a User Path (via process_creation)

This rule detects regasm.exe or regsvcs.exe executing an assembly from a user, temp or ProgramData directory, a signed-binary proxy technique that runs attacker .NET code through a trusted registration utility. Regasm and Regsvcs abuse is a defense-evasion technique in the Red Canary Threat Detection Report. Detecting execution from user-writable paths surfaces trusted-binary code proxying.

Suspicious UAT-8302 DLL Side-Loading via Signed Application Launcher

This rule detects the UAT-8302 side-load launchers Yandex.exe or VMtools.exe invoked with the campaign-specific -r and -p:ini arguments that trigger loading of a malicious DLL and its encrypted configuration. Abusing a benign signed application to load attacker code lets the CloudSorcerer implant execute under a trusted process. The paired argument pattern narrows this to malicious side-loading rather than normal use.

Malicious Volume Shadow Copy Deletion via vssadmin by Medusa Ransomware

This rule detects use of vssadmin to delete all volume shadow copies quietly, matching the inhibit-recovery step performed by Medusa ransomware before encryption per Unit 42. Ransomware wipes shadow copies to prevent victims from restoring files which is a strong pre-encryption indicator of an active ransomware attack.

Malicious Fileless PowerShell Registry Payload Execution via Process Creation

This rule detects hidden PowerShell that reads a payload from a registry value and pipes it to Invoke-Expression. StripedFly stores its encrypted loader under an HKCU Applets key and executes it fileless via hidden PowerShell with IEX, achieving stealthy in-memory execution.

PowerShell Command-Line Obfuscation Constructs (via process_creation)

This rule detects PowerShell command lines that use format-operator, character-array, backtick or string-reversal obfuscation to hide the real payload from simple string matching. Command obfuscation accompanies the heavy PowerShell abuse documented in the Red Canary Threat Detection Report, and these constructs are rarely produced by legitimate one-liners. Detecting the obfuscation syntax surfaces evasive script execution regardless of the ultimate payload.

Batch Script Execution From RECYCLERS.BIN Masquerade Directory

This rule detects process execution referencing a RECYCLERS.BIN directory, a masquerade of the Windows Recycle Bin used as a hidden staging location in the DLL side-loading campaign to run tmp.bat. Executing scripts from a directory imitating the Recycle Bin is a defense-evasion and staging indicator.

TinyLoader Persistence via txtfile Shell Open Command Hijack (via registry_set)

This rule detects modification of the txtfile shell open command handler so that opening any text file first launches an attacker binary, the file-association hijack TinyLoader uses for persistence. Adversaries leverage this handler so the loader runs whenever a user opens a .txt file, then still opens the file to avoid suspicion.

Operator Bring Your Own Tools

Detects use of custom scripts i.e. BAT files.

Masquerading Kerberos Ticket Abuse via Rubeus (via process_creation)

This rule detects Rubeus command-line actions such as kerberoast, asreproast and tgtdeleg, which request and extract Kerberos tickets for offline cracking or impersonation. Rubeus-driven Kerberos abuse is a credential-access technique tracked in the Red Canary Threat Detection Report. Detecting these actions surfaces ticket theft aimed at privilege escalation.

Suspicious AWS Large GPU Instance Launch via CloudTrail (via aws)

This rule detects the launch of large accelerated GPU EC2 instances recorded in CloudTrail. The intrusion abused stolen administrator access to run expensive p4d GPU instances for resource hijacking. Sudden launches of high cost GPU instance types outside of sanctioned workloads can indicate cloud resource abuse.

Malicious PyPI Package Installation from Gleaming Pisces Supply Chain (via process_creation)

This rule detects installation of the malicious PyPI packages real-ids, coloredtxt, beautifultext, or minisound published by Gleaming Pisces to deliver the PondRAT backdoor. Installing these poisoned packages compromises developer and build systems through the software supply chain.