Sigma detection rules, expert-reviewed

Suspicious LNK Persistence Dropped in Startup Folder

This rule detects creation of shortcut files inside the user Start Menu Startup directory which Spectre RAT uses to persist across reboots. Unexpected LNK files written to the Startup folder are a reliable indicator of autostart based persistence.

Suspicious Execution Delay via Ping to Loopback Address

This rule detects ping.exe being directed at the loopback address which Spectre RAT uses as a time based execution delay to evade sandbox analysis and space out its actions. Pinging localhost in combination with follow on execution is a common defense evasion trick seen in loaders and RATs.

Suspicious MsMpEng Execution from Non-Standard Directory

This rule detects the Microsoft Defender engine binary MsMpEng.exe running from a directory outside its trusted install paths which indicates an infostealer masquerading as a security process to blend in. The legitimate MsMpEng only executes from the Defender platform directory so any other location is highly suspicious.

Malicious Windows Event Log Clearing via wevtutil

This rule detects wevtutil being used to clear or reconfigure Windows event logs which Evil Corp operators perform to destroy forensic evidence of their intrusion. Clearing event logs is a deliberate anti forensic action that legitimate administrators rarely automate on endpoints.

Suspicious Script Host Spawned by cmd for DarkGate Execution

This rule detects cscript or wscript being launched as a child of cmd.exe which matches the DarkGate execution chain where a command shell invokes a script host to run malicious VBScript or JScript. This parent child relationship is unusual in normal operations and points to scripted malware execution.

Malicious rundll32 WebDAV UNC Execution over HTTP

This rule detects rundll32 loading a DLL from a remote WebDAV UNC path that references an attacker IP over HTTP which DarkGate uses to pull and execute its payload from the internet. Executing code from a remote WebDAV share via rundll32 is a strong indicator of DarkGate style remote payload delivery.

Suspicious Script Interpreter Executing JavaScript from Temp Folder

This rule detects wscript or cscript executing a JavaScript file from a temporary directory which reflects the GootLoader delivery pattern where a JavaScript payload is extracted from a ZIP archive and run from a temp folder. Script based execution from these locations is a common initial foothold for GootLoader infections.

Suspicious Scheduled Task Executing Payload from AppData

This rule detects scheduled task hosts launching rundll32 powershell or cmd with a payload located under AppData Roaming or AppData Local Temp which is how GootLoader maintains persistence and execution. Interpreters spawned by the task scheduler from user writable directories are a strong indicator of GootLoader activity.

Malicious Boot Configuration Tampering via bcdedit

This rule detects bcdedit being used to disable the Windows recovery environment or ignore boot failures which Black Basta ransomware performs to inhibit system recovery before encryption. This tampering removes the ability to boot into recovery and is a strong pre encryption indicator.

Suspicious RDP Enablement via netsh Firewall Rule

This rule detects use of netsh to open the firewall for Remote Desktop which Black Basta operators run to enable lateral movement into a compromised environment. Enabling RDP through the command line on a host that did not previously allow it is a common precursor to hands on keyboard activity.

Malicious Bumblebee WebDAV Share Mount via LNK

This rule detects command lines that mount or access the attacker abused WebDAV share webdav.4shared.com which the Bumblebee loader uses to stage its LNK driven infection chain. Adversaries rely on remote WebDAV shares to deliver payloads while bypassing download controls which makes this an early indicator of the Bumblebee delivery chain.

Malicious SUNBURST Named Pipe Creation

This rule detects creation of the named pipe used by the SUNBURST backdoor as a single-instance mutex during SolarWinds supply-chain intrusions. The pipe name is a unique campaign constant with no legitimate use. Its presence confirms SUNBURST execution on the host.

Suspicious Outlook Outbound Connection to SMB or HTTP Port

This rule detects the Outlook process initiating outbound network connections over ports 80 or 445 which indicates a MonikerLink CVE-2024-21413 style forced authentication that leaks NTLM credentials to an attacker controlled host. Outlook should not directly open SMB sessions to external hosts which makes this a strong indicator of credential leakage.

Malicious vmanage-admin Public Key Authentication in SSH Auth Log

This rule detects SSH authentication events accepting a public key for the vmanage-admin account, an indicator of post-exploitation persistence on Cisco SD-WAN appliances following CVE-2026-20127. Adversaries add their own SSH key and authenticate as vmanage-admin to maintain root-equivalent access and pivot between appliances. Unexpected vmanage-admin key logins from unknown sources signal compromise.

Malicious PowerShell Runtime Loaded Outside PowerShell Host

This rule detects the System.Management.Automation.dll PowerShell runtime being loaded by a process other than a legitimate PowerShell host, the unmanaged PowerShell technique used by Cobalt Strike to execute PowerShell in memory without spawning powershell.exe. Running PowerShell inside an arbitrary process evades monitoring that watches the PowerShell binary. A non-host process loading the automation assembly is a strong injection indicator.