Sigma detection rules, expert-reviewed

Suspicious Imjp14k DLL Side-Loading From Non-System Path

This rule detects a process loading imjp14k.dll from a path outside the standard Windows System32 directory. APT41 abused DLL side-loading of imjp14k.dll to launch ShadowPad on a compromised Taiwanese network. Side-loading a system-named DLL from a writable non-system directory is a hallmark of hijack execution used to run malicious code under a trusted host process.

Malicious Lazarus ScoringMathTea WordPress C2 URL Path

This rule detects HTTP requests to the compromised WordPress command-and-control path used by the ScoringMathTea RAT in the Lazarus UAV-sector campaign. The RAT beacons to a theme functions file at inc/functions/function-hand.php, and this structured path is a durable network indicator of the malicious channel.

Malicious Chisel Tunneling Tool Masquerading as Microsoft Binary (via process_creation)

This rule detects the Chisel tunneling utility renamed to Microsoft-themed filenames such as MsChSoft.exe or MicrosoftExchange32.exe while running with client, server, or reverse forwarding arguments, a tunneling technique used by the Seashell Blizzard subgroup during the BadPilot access operation. Adversaries deploy renamed Chisel to establish persistent encrypted tunnels into compromised networks, and the mismatch between a Microsoft-styled name and tunneling arguments is a strong compromise indicator.

Malicious BRUSHWORM Persistence via Scheduled Task (via process_creation)

This rule detects scheduled task creation using the BRUSHWORM masquerading task names targeting financial services. Observed in Elastic Security Labs analysis where schtasks registers MSGraphics or MSRecorder tasks to persist the paint.exe backdoor and its keylogging component.

Suspicious Renamed MonitoringHost Binary Indicating DLL Side-Loading

This rule detects execution of the signed Microsoft MonitoringHost binary under a renamed file name, a technique used by the SADBRIDGE loader to deploy the GOSAR (Golang QUASAR) backdoor. SADBRIDGE renames MonitoringHost.exe to DevQueryBroker.exe and abuses DLL search order hijacking to side-load a malicious HealthServiceRuntime.dll. Detecting a mismatch between the original file name and the on-disk image name surfaces this masquerading and side-loading activity for triage.

Suspicious Web Service Spawning Bash Reverse Shell on Ivanti via Exploitation

This rule detects the Ivanti Connect Secure uwsgi web process spawning a Bash shell that reads a staged payload from a temporary path. This chain was uncovered through memory forensics of exploited Ivanti Connect Secure appliances. Web service processes launching interactive shells indicate successful remote code execution.

Suspicious Active Directory Computer Export via csvde (via process_creation)

This rule detects csvde.exe exporting Active Directory computer objects with an objectClass=Computer filter, the reconnaissance step FIN7 used to enumerate hosts after MSIX-based access. csvde is rarely run interactively and an LDAP export of computer accounts maps the environment for lateral movement. This preceded NetSupport RAT and DiceLoader deployment.

Possible F5 iControl REST Remote Code Execution via Util Bash Endpoint

This rule detects POST requests to the F5 iControl REST util bash endpoint which grants arbitrary command execution when reached after the SSRF authentication bypass of CVE-2021-22986 documented by NCC Group. Access to this endpoint by an unauthenticated actor indicates full appliance compromise.

Suspicious Privileged Docker Container Launch With Host chroot

This rule detects a docker run command started with the privileged flag combined with a chroot into the host filesystem. Attackers abusing exposed Docker API port 2375 deploy Alpine containers with docker run --privileged and chroot to break out onto the host and execute malware. Privileged container launches that immediately chroot to the host are a strong container-escape indicator.

Malicious dnscat2 DNS Tunneling C2 Traffic

This rule detects DNS queries containing the dnscat marker string used by the dnscat2 tunneling tool. It maps to command-and-control and data exfiltration over DNS where an operator encodes traffic in oversized MX and TXT lookups to evade network controls. Detecting the dnscat pattern surfaces DNS-based C2 beaconing.

MSSQL Server Process Spawning Command Shell via xp_cmdshell

This rule detects the SQL Server process sqlservr.exe spawning cmd.exe or PowerShell, the direct signature of xp_cmdshell abuse on an exposed database server. Huntress observed operators chaining bcp data staging and local account creation from this shell during MSSQL intrusions. A database engine launching command interpreters is not normal behavior and indicates code execution through the SQL layer.

Malicious LSASS Credential Dump via SilentProcessExit WerFault Abuse

This rule detects registry modifications under the Image File Execution Options SilentProcessExit or GlobalFlag keys for lsass.exe, the mechanism that forces WerFault.exe to write a full memory dump of the process. Adversaries abuse this Windows Error Reporting behavior to dump LSASS and extract credentials without a recognized dumping tool. These keys targeting lsass.exe have no legitimate use.

Suspicious Winlogon Shell Persistence via Registry by Key Group

This rule detects modification of the Winlogon Shell value to something other than the default explorer.exe, a persistence technique used by Key Group ransomware to auto-run its payload at logon. Any non-default shell value on this key indicates hijacked user-session startup and should be investigated.

Suspicious Spectre Ops Staging in CullinetProgram Directory via file_event

This rule detects the Spectre Ops stealer staging files inside a CullinetProgram directory under AppData Roaming, which it pairs with a Startup folder entry for persistence. The uniquely named working directory holds the malware components between reboots. This distinctive folder name is not associated with legitimate software and reliably marks the stealer footprint on disk.

Suspicious Command in RunMRU Registry Indicating ClickFix Execution (via registry_set)

This rule detects a RunMRU registry entry containing a script interpreter or download command, a host artifact left when a victim pastes a ClickFix payload into the Windows Run dialog. The RunMRU key records the exact command executed through Win plus R.