Sigma detection rules, expert-reviewed

Suspicious PowerShell Spawning wscript with Silent Flag (via process_creation)

This rule detects PowerShell launching wscript.exe with the silent background flag to run a JScript wrapper. This chain was observed in the JS#SMUGGLER campaign to execute the NetSupport RAT loader while suppressing script errors.

Obfuscated Firewall Deactivation - Deprecated Command (via process_creation)

This rule detects disabled the Windows Firewall to evade defense.

QBot process creation from scheduled task REGSVR32 (regsvr32.exe), -s flag and SYSTEM in the command line

Detects the process creation from Scheduled Task with REGSVR32 (regsvr32.exe), -s flag and SYSTEM in the command line

LOTUSLITE Renamed Loader DataTechnology Executed with DATA Argument (via process_creation)

This rule detects the LOTUSLITE renamed loader DataTechnology running with its DATA switch from the ProgramData Technology360NB directory during the geopolitical espionage campaign. Adversaries copy the sideloading executable as DataTechnology and pass a DATA argument to trigger the malicious export. The renamed binary with that argument from ProgramData is a distinctive execution marker.

Suspicious Security Policy Export via SecEdit (via process_creation)

This rule detects secedit.exe exporting the local security policy configuration to a file. Lynx operators used this to enumerate account and password policy during host reconnaissance. Exported policy informs privilege escalation and account manipulation later in the intrusion.

Suspicious Enabling of Network Discovery Firewall Rules via PowerShell

This rule detects enabling of the Network Discovery firewall rule group via PowerShell, the step The Gentlemen ransomware took to widen host visibility for lateral movement. Programmatically enabling network discovery firewall rules during an intrusion facilitates spread across the environment.

Suspicious Antivirus Product Enumeration via WMI Query via process_creation

This rule detects command lines that query the Windows Security Center AntiVirusProduct class which attackers use to enumerate installed security software before deploying payloads. SideWinder profiled endpoint defenses through WMI antivirus enumeration to tailor its evasion. Discovery of security tooling frequently precedes defense evasion and payload delivery.

Suspicious pythonw.exe Executing winresume.pyc via Confucius AnonDoor Backdoor (via process_creation)

This rule detects the Confucius AnonDoor Python backdoor which is run by a scheduled task named NetPolicyUpdate invoking pythonw.exe against a hidden winresume.pyc file every five minutes. Execution of a compiled Python module named winresume.pyc by the windowless interpreter indicates the backdoor. The task provides persistence.

Suspicious Executable Written to Windows Fonts Directory via file_event

This rule detects executable or driver payloads being written into the Windows Fonts directory, an unusual location abused by GHOSTENGINE to stage its mining and defense-evasion components. Legitimate software does not deploy executables to this font resource folder. Files of this type in Fonts are a strong indicator of malicious staging.

Uncommon Security Info Registration Following AiTM Session Theft (via azure)

This rule detects a user registering new security info in Entra ID, the persistence step attackers take after adversary-in-the-middle session theft to enroll their own MFA method on a compromised account. Adversaries register a controlled authenticator to retain access after the stolen session expires, making this a useful signal when correlated with anomalous or geo-infeasible sign-ins from the same account.

Suspicious SD-WAN Compromise Nim Implant C2 Beacon

This rule detects HTTP requests to the Nim implant endpoints observed in the ongoing Cisco Catalyst SD-WAN exploitation, where the backdoor uses fixed URI paths for handshake and exfiltration. The dedicated /api/v1/handshake and /exfiltrate routes reveal the implant control channel used after webshell deployment. Matching traffic indicates an active Nim implant beaconing from a compromised appliance.

HTTPSnoop Masquerading as CyveraConsole Outside Palo Alto Path

This rule detects a process named CyveraConsole.exe running from a directory other than the legitimate Palo Alto Networks installation path. The ShroudedSnooper HTTPSnoop implant masqueraded as CyveraConsole.exe, a genuine Cortex XDR component, to blend into endpoints. A CyveraConsole binary outside the vendor path indicates an impersonating implant rather than the real agent.

Suspicious rundll32 Loading DLL from AppData via DllRegisterServer

This rule detects rundll32 executing a DLL located under AppData through the DllRegisterServer entry point. OysterLoader stages its COPYING3.dll payload in the roaming profile and runs it with this export. Running an AppData resident DLL through rundll32 with DllRegisterServer is a recognised loader execution pattern.

Suspicious Script Host Execution from AppData WindowsHelper Staging Folder via process_creation

This rule detects wscript.exe running a run.vbs from an AppData WindowsHelper directory, the staging location Armored Likho uses to chain into a Python module payload. Script execution from this attacker staging folder is part of the BusySnake stealer loader. It indicates active execution of the stealer.

In-Memory Regasm Process Hollowing Spawned by PowerShell (via process_creation)

This rule detects the .NET Regasm.exe utility launched as a child of powershell.exe, the process-hollowing target used by 0bj3ctivityStealer to inject its final stealer payload. Adversaries leverage Regasm as a signed injection host that seldom runs from PowerShell, making this parent-child pairing a reliable indicator of code injection.