Sigma detection rules, expert-reviewed

Suspicious Cobalt Strike DNS Beacon Default Subdomain Query Linked to Cozy Bear

This rule detects DNS queries whose labels match Cobalt Strike DNS Beacon default staging and callback prefixes such as post.1, aaa.stage, and baa.stage, a command-and-control pattern tied to Cozy Bear operations. These default beacon subdomains are distinctive constants left in unmodified Cobalt Strike profiles, so queries containing them are a strong indicator of DNS-based C2.

Suspicious Google API DNS Query From Temporary Directory Process Abused for C2

This rule detects DNS queries to Google Sheets or Drive API hosts originating from a process running out of a temporary or user AppData directory, a covert command-and-control channel described by Intel 471. Malware abuses trusted Google API endpoints to blend beacon traffic with normal web activity, so API lookups from temp-resident binaries are a heuristic C2 indicator that benefits from process-path context to reduce noise.

Suspicious Cisco IOS XE Privileged Account Creation via CVE-2023-20198

This rule detects creation of the privileged local accounts cisco_tac_admin and cisco_support that are dropped when the Cisco IOS XE Web UI is exploited through CVE-2023-20198. These account names are strong campaign specific indicators of unauthorized administrative access and should be treated as a compromise of the network device.

Suspicious Windows Defender Service Disabled via Registry (via registry_set)

This rule detects BlotchyQuasar setting the WinDefend service start value to disabled in the registry to turn off Microsoft Defender at boot. Direct modification of the WinDefend service start type to disabled is a strong tampering signal. This persistently removes antivirus protection.

Suspicious UAC Bypass via ms-settings Shell Command Hijack (via registry_set)

This rule detects BlotchyQuasar hijacking the ms-settings protocol handler in the registry to run its payload with high integrity through computerdefaults.exe. Writing to the ms-settings shell open command key together with a DelegateExecute value is a well-known auto-elevation bypass. Legitimate applications do not modify this handler.

Suspicious Firewall Allow Rule for TightVNC Server via netsh (via process_creation)

This rule detects BlotchyQuasar adding a Windows firewall allow rule for its TightVNC tvnserver.exe binary staged under AppData to permit inbound remote-control traffic. Creating a firewall exception for a VNC server running from a user profile is anomalous. This exposes the host to covert remote access.

Suspicious Root Certificate Installation via certutil (via process_creation)

This rule detects BlotchyQuasar installing an attacker root certificate into the enterprise trust store with certutil to enable interception of banking sessions. The addstore enterprise root combination applied to a dropped certificate file is a hallmark of trust subversion. Endpoints rarely add enterprise root certificates this way.

Suspicious rundll32 Execution of DLL from WebDAV Share (via process_creation)

This rule detects the Hive0145 Strela Stealer chain using rundll32.exe to run a crypted DLL directly from a WebDAV davwwwroot share and call its Entry export. Loading a DLL over WebDAV through rundll32 is a strong remote-execution indicator. Legitimate software does not launch DLLs from davwwwroot paths.

Suspicious cmd.exe Spawned by python.exe (via process_creation)

This rule detects the ITG05 MASEPIE backdoor executing operator commands by having its Python process spawn cmd.exe through the os.popen method. A python.exe parent launching a command shell is unusual outside developer workflows. This indicates remote command execution by the backdoor.

Malicious DynamicWrapperX Registration via regsvr32 (via process_creation)

This rule detects the Hive0117 DarkWatchman backdoor silently registering the DynamicWrapperX dynwrapx.dll component with regsvr32, enabling its JavaScript to call native Windows APIs. Silent registration of dynwrapx.dll is strongly associated with this malware family. Legitimate software does not deploy this component this way.

Suspicious Execution of Log File via cmd.exe (via process_creation)

This rule detects WailingCrab decoding its payload into a log file in the Temp directory and executing it through cmd.exe, which treats the file as a batch script. Command interpreters invoking a log file are highly unusual on normal systems. This pattern reveals the staged payload launch.

Suspicious printfilterpipelinesvc.exe Executed from Non-System Path (via process_creation)

This rule detects WailingCrab persistence that runs a renamed copy of printfilterpipelinesvc.exe from a user directory via a registry Run key. The legitimate binary lives under System32, so execution from another location signals masquerading. This provides the malware autostart under a trusted-looking name.

Suspicious GammaLoad VBScript Execution via wscript.exe (via process_creation)

This rule detects Hive0051 GammaLoad activity where wscript.exe launches a VBScript with the batch and engine switches the malware uses to run its loader silently. The combination of the batch flag with an explicit vbscript engine and the additional GammaLoad switches is uncommon in normal scripting. It reveals the scheduled loader execution.

Malicious easinvoker.exe DLL Hijack from Public Libraries (via process_creation)

This rule detects DBatLoader abusing the signed easinvoker.exe binary staged inside the Users Public Libraries folder to side-load a malicious netutils.dll and bypass User Account Control. The legitimate easinvoker.exe resides under System32, so execution from a Public Libraries path is anomalous. This chain launches a dropped batch file with elevated privileges.

Possible WailingCrab MQTT C2 to Public Broker (via network_connection)

This rule detects WailingCrab command-and-control that abuses the MQTT messaging protocol by connecting to the public emqx broker on TCP port 1883. Enterprise endpoints seldom initiate MQTT sessions to this public broker. The connection carries base64-encoded command traffic.