Sigma detection rules, expert-reviewed

Suspicious GammaLoad VBScript Execution via wscript.exe (via process_creation)

This rule detects Hive0051 GammaLoad activity where wscript.exe launches a VBScript with the batch and engine switches the malware uses to run its loader silently. The combination of the batch flag with an explicit vbscript engine and the additional GammaLoad switches is uncommon in normal scripting. It reveals the scheduled loader execution.

Malicious easinvoker.exe DLL Hijack from Public Libraries (via process_creation)

This rule detects DBatLoader abusing the signed easinvoker.exe binary staged inside the Users Public Libraries folder to side-load a malicious netutils.dll and bypass User Account Control. The legitimate easinvoker.exe resides under System32, so execution from a Public Libraries path is anomalous. This chain launches a dropped batch file with elevated privileges.

Possible WailingCrab MQTT C2 to Public Broker (via network_connection)

This rule detects WailingCrab command-and-control that abuses the MQTT messaging protocol by connecting to the public emqx broker on TCP port 1883. Enterprise endpoints seldom initiate MQTT sessions to this public broker. The connection carries base64-encoded command traffic.

Malicious NsBars.dll Side-Loaded by Textoescritor.exe (via image_load)

This rule detects the Hive0147 Picanha loader abusing the legitimate Textoescritor.exe application to side-load a malicious NsBars.dll from its bin subdirectory. This trusted-binary hijack decrypts and launches the Mekotio banking trojan. The DLL and host pairing is specific to this campaign.

Malicious WindowsCodecs.dll Side-Loaded by calc.exe (via image_load)

This rule detects ITG05 Headlace packaging a renamed calc.exe with a malicious WindowsCodecs.dll so the trusted binary side-loads attacker code. The genuine WindowsCodecs.dll loads only from system directories, so a load from another folder is anomalous. The hijacked DLL executes the hidden Headlace payload.

Malicious version.dll Side-Loaded by explorer.exe (via image_load)

This rule detects WailingCrab hijacking explorer.exe to side-load a malicious version.dll from a user-writable directory instead of the system folder. The genuine version.dll is loaded only from System32 or SysWOW64, so a load from AppData or ProgramData is anomalous. This grants the loader stealthy code execution inside a trusted process.

Suspicious Executable with Double Batch Extension (via file_event)

This rule detects Strela Stealer delivery artifacts written with a deceptive double extension where a batch suffix is followed by an exe suffix to disguise an executable as a script. Files ending this way are almost always an attempt to mislead the user or analyst. Their creation warrants investigation.

Suspicious OCEANMAP EdgeContext.url Startup Persistence (via file_event)

This rule detects the ITG05 OCEANMAP backdoor dropping an EdgeContext.url file into the Windows Startup directory to relaunch itself at logon. A url shortcut named EdgeContext placed in Startup is not created by legitimate software. This establishes persistence for the IMAP-based backdoor.

Suspicious PIF Persistence File in Public Libraries (via file_event)

This rule detects DBatLoader writing its packed payload as a PIF file into the Users Public Libraries directory, which it references from a url shortcut for persistence. Program information files placed in this location are not produced by legitimate software. The file enables the loader to relaunch after reboot.

Possible RD Web Access Brute Force via Repeated Login POST Requests

This rule detects HTTP POST requests to the Remote Desktop Web Access login endpoint, matching the RDWeb brute-force activity observed in a terminal server phishing intrusion. Adversaries automate large volumes of credential guesses against the RDWeb form where an HTTP 302 response indicates a successful authentication. High-volume POSTs to this endpoint signal password guessing against externally exposed remote access.

Suspicious SmarterMail Administrative API Access from Python Requests Client

This rule detects SmarterMail administrative API calls such as event-hook creation and domain-put arriving with the python-requests user agent, the automation fingerprint left by the actor as they added a recon hook on domain creation. Legitimate SmarterMail administration is performed through the web console rather than a raw Python client, so this combination of sensitive endpoint and scripted user agent points to hands-on abuse of the compromised account. Review the surrounding requests for follow-on command execution.

Suspicious SmarterMail Force Password Reset API Request Indicating Account Takeover

This rule detects HTTP POST requests to the SmarterMail force-reset-password API endpoint, the account takeover primitive Huntress observed being abused to seize administrator accounts before achieving remote code execution. Attackers call this authenticated endpoint to reset a target user password and hijack the session. Requests to this path, particularly from scripted clients, indicate exploitation of the account takeover weakness.

Possible CrushFTP CVE-2025-31161 Authentication Bypass via Webserver

This rule detects exploitation attempts against CrushFTP CVE-2025-31161 where a request to the getUserList API function carries a forged AWS4-HMAC-SHA256 authorization referencing the crushadmin account. Huntress observed this auth-bypass request used to impersonate the built-in administrator and enumerate accounts. Successful exploitation gives an unauthenticated attacker administrative control of the file transfer server enabling data theft and follow-on intrusion.

Suspicious PHP Webshell in Netscaler VPN Theme Directory

This rule detects requests to PHP files under the Netscaler /vpn/themes/ path, where the actor planted webshells following Netscaler exploitation. The theme image directories serve static assets and should not host PHP, so PHP execution there indicates a webshell used for post-exploitation access.

Suspicious dMSA Membership Modification via msDS-GroupMSAMembership Attribute

This rule detects Active Directory changes to the msDS-GroupMSAMembership attribute on a delegated managed service account, the self-referential membership manipulation at the core of the Huntress dMSA Ouroboros credential-extraction technique. Writing the dMSA object's own SID into this attribute lets it authenticate to itself and unlock credential extraction. Unexpected modification of this attribute is a high-confidence sign of the abuse chain.