Sigma detection rules, expert-reviewed

Malicious Scheduled Task EPolicyManager by Squidoor (via process_creation)

This rule detects creation of the scheduled task Microsoft\Windows\AppID\EPolicyManager used by the Squidoor backdoor to persist by mimicking a legitimate Windows AppID task. Registering persistence under a trusted-looking task path helps the actor survive reboots while avoiding operator suspicion.

Malicious NTDS Credential Theft via Volume Shadow Copy via process_creation

This rule detects volume shadow copy creation with vssadmin or direct references to the ntds.dit Active Directory database used to steal domain credentials. Stately Taurus used vssadmin and NTDS.dit access on a compromised domain controller to harvest the credential store, a high-confidence sign of domain-wide credential access.

Suspicious Run Key Persistence Launching Headless Deno Runtime via TAG-150

This rule detects a Run key persistence value that launches the Deno runtime through a headless conhost wrapper. TAG-150 uses this technique across its DinDoor, DenoRAT, and NightshadeC2 tooling to silently reload JavaScript backdoors at logon. The headless conhost prefix suppresses the console window while maintaining autostart command and control.

Masquerading Blank Grabber Payload Decoding via Certutil Decode Flag (via process_creation)

This rule detects certutil being run with its decode flag to convert a base64-encoded file back into an executable payload, the deobfuscation step Blank Grabber uses to reconstruct its loader while masquerading the data as a certificate. Adversaries leverage certutil as a trusted LOLBin to decode staged payloads and evade content controls, making early detection critical for catching the loader before execution.

Malicious Named Pipe REDSUN Created by Nightmare-Eclipse Tooling

This rule detects creation of a named pipe called REDSUN, a hardcoded inter-process channel used by Nightmare-Eclipse tooling observed in a real-world Huntress intrusion. The agent relies on this fixed pipe name for command relay between its components. Because the pipe name is a distinctive tool-specific constant, its presence is a high-confidence indicator of the framework.

Malicious Windows Defender Real-Time Monitoring Disabled via PowerShell

This rule detects use of Set-MpPreference to disable Windows Defender real-time monitoring. In the WithSecure Catching Lazarus research the actor turns off real-time protection before dropping and running further tooling. Attackers disable defensive agents to run payloads without antivirus detection.

Suspicious Hidden PowerShell Retrieving VBScript from mcdir.me by Millenium RAT (via process_creation)

This rule detects hidden PowerShell fetching a VBScript stager from the mcdir.me delivery host used in the Millenium RAT malware-as-a-service infection chain launched from a malicious LNK. The script downloads and runs the next-stage executable while showing the victim a decoy PDF. Detecting the download cradle interrupts the RAT installation early.

Renamed Computer Account Renamed Without a Trailing $ - CVE-2021-42278/42287 (via security)

This rule detects spoof the SAM account name of a a domain controller in order to impersonate it. Vulnerability comes from that computer accounts should have a trailing $ in their name (i.e. sAMAccountName attribute) but no validation process existed until the patch was released. During the offensive phase, attacker will create and rename the sAMAccountName of a computer account to look like the one of a domain controller. Once the attack is done, attacker will rollback the sAMAccountName to its original name.

Possible FortiWeb Authentication Bypass via Path Traversal to fwbcgi (via webserver)

This rule detects HTTP requests to the FortiWeb management CMDB admin API that traverse into the internal fwbcgi CGI handler. This request pattern corresponds to CVE-2025-64446 which lets unauthenticated attackers create administrator accounts. Legitimate API clients do not reach cgi-bin through path traversal.

Malicious Lazarus DLL Side-Loading of ualapi.dll via spoolsv.exe (via image_load)

This rule detects the Windows Print Spooler process spoolsv.exe loading a ualapi.dll from a directory other than System32. In the Lazarus SIGNBT campaign the actor plants a rogue ualapi.dll that is side-loaded by spoolsv.exe to gain execution and persistence, so a ualapi.dll load from an unusual path indicates print-processor abuse and hijacked system code.

Suspicious DLL Written to Explorer IconCache Path

This rule detects a DLL written to the Explorer icon cache directory using an iconcache prefixed name with a numeric suffix. In Operation ForumTroll a LNK triggered PowerShell chain dropped a payload DLL named iconcache_<4digits>.dll to this location as reported by Kaspersky. Legitimate icon cache files use the .db extension so a .dll in this path is a strong masquerading and payload staging indicator.

Suspicious MSBuild Execution from Writable Directory (via process_creation)

This rule detects MSBuild being launched with a project file located in a user-writable directory such as ProgramData, AppData, Temp or Downloads. Following CVE-2025-31324 exploitation adversaries abuse MSBuild as a trusted developer utility to compile and execute inline payloads, so MSBuild running from a staging directory indicates defense evasion.

Suspicious Anomalous OpenSSH 0.3 Banner Indicating ZIPLINE Backdoor (via network)

This rule detects SSH connections advertising an SSH-2.0-OpenSSH_0.3 style banner that does not correspond to any real OpenSSH release. The ZIPLINE passive backdoor on compromised Ivanti appliances hijacks the accept() call and keys off this anomalous banner as a trigger. An impossible OpenSSH version string is a reliable fingerprint of this passive implant.

Malicious Modification of a Fake Domain Controller SPN - DCshadow (via security)

This rule detects updates the Service Principal Name (SPN) of a fake domain controller account in order to perform DCshadow attack.

Suspicious CherryLoader Execution via Encrypted Stage Arguments (via process_creation)

This rule detects execution of the CherryLoader binary invoked with its encrypted stage-two and privilege-escalation payload file arguments. CherryLoader passed NuxtSharp.Data and Spof.Data as arguments to decrypt and run embedded PrintSpoofer and JuicyPotatoNG modules.