Sigma detection rules, expert-reviewed

Malicious Rundll32 Execution Of HTML Payload With DllRegisterServer

This rule detects rundll32 loading a file with an .html extension and calling the DllRegisterServer export, the disguised DLL execution used in the Zloader attack against Intel 471. Masquerading the DLL as an HTML file evades extension-based inspection while rundll32 still runs it as a library. This mismatch of extension and export is a strong loader indicator.

Suspicious LaunchAgent or LaunchDaemon Load via launchctl

This rule detects launchctl loading a property list from a LaunchAgents or LaunchDaemons directory, the persistence mechanism most macOS malware uses to survive reboots. Registering a malicious plist ensures the payload is relaunched automatically by launchd under user or system context.

Suspicious Screen Capture via PowerShell Graphics API (via process_creation)

This rule detects PowerShell invoking the CopyFromScreen graphics method to grab the desktop, a screen-capture collection technique used to spy on a victim's session. Screen capture is tracked in the Red Canary Threat Detection Report. Detecting the graphics-API call surfaces surveillance of the user's screen.

Suspicious netsh Outbound Network Connection from IDAT Loader Injection

This rule detects the netsh utility initiating outbound internet connections which is abnormal for the tool. A fake IT support site leading to Vidar used the Hijack IDAT Loader to inject shellcode into netsh so C2 traffic runs from a signed process. netsh has no legitimate reason to reach external hosts so this points to process injection.

Malicious VoidLink Fileless Execution via memfd via Memory (via process_creation)

This rule detects processes executing from an anonymous in-memory file descriptor on Linux hosts. The VoidLink rootkit loader uses memfd_create and execveat to run its payload entirely from memory without touching disk. Execution backed by a memfd path is a strong indicator of fileless malware staging.

Malicious MSI Installation from Remote WebDAV Share via process_creation

This rule detects msiexec.exe installing an MSI package from a remote WebDAV or HTTP location when launched by the WMI provider host, matching the LATRODECTUS loader delivery chain. The oversized JavaScript dropper uses WMI to spawn msiexec and retrieve a remote installer. This staging technique delivers second-stage payloads while evading direct download detection.

Suspicious Windows Event Log Clearing via Dire Wolf Ransomware (via process_creation)

This rule detects use of wevtutil to clear Windows event logs, an indicator removal step performed by Dire Wolf ransomware across the Application, System, Security and Setup logs.

DSRM Password Changed - Reg via PowerShell (via powershell)

This rule detects reset or synchronize with another domain account the DSRM (Directory Services Restore Mode) password in order to escalate privileges.

Obfuscated Edge/Chrome Headless Feature Abuse for Payload Download (via process_creation)

This rule detects executes Chrome in headless mode in order to download a payload. Document Object Model (DOM) may also be abused to download obfuscated data from attacker repositary.

Malicious Data Exfiltration via MEGAcmd

This rule detects execution of MEGAcmd components such as MEGAcmdUpdater.exe used to sync victim data to MEGA cloud storage during double-extortion. This was observed during Cephalus ransomware intrusions. Cloud exfiltration to MEGA prior to encryption signals data theft ahead of extortion.

Suspicious PowerShell Indirect Execution via Get-Command

This rule detects PowerShell using Get-Command together with the call operator to resolve and invoke a cmdlet indirectly which the Gamaredon LNK delivery chain uses to obscure calls to Invoke-Expression and evade command line based detection. Piping or passing Get-Command output into an invocation operator is an obfuscation pattern rarely seen in legitimate scripts.

Malicious User Added to a Group via Commandline (via process_creation)

This rule detects escalate privilege by adding a user to a group via commandline.

Suspicious Payload Retrieval from Cloudflare Tunnel via LOLBin (via process_creation)

This rule detects Windows script and download utilities referencing a trycloudflare.com tunnel hostname on their command line, an infrastructure pattern used by PythonRatLoader to stage batch, WebDAV and Python payloads. Cloudflare quick tunnels are occasionally used by developers so context should be reviewed.

Malicious SnipBot DLL Execution via rundll32 from KeyStore Directory (via process_creation)

This rule detects rundll32 loading SnippingTool.dll from a KeyStore folder and invoking its Main export, the execution technique used by the SnipBot variant of RomCom malware. Proxying execution of the malicious DLL through the trusted rundll32 binary helps the loader evade application controls.

Malicious Phantom Taurus OutlookEN Web Shell File Creation (via file_event)

This rule detects creation of the OutlookEN.aspx web shell dropped by Phantom Taurus on compromised Exchange and IIS servers. The web shell loads the NET-STAR IIServerCore backdoor into the worker process to provide persistent server access. Detecting the file drop catches the initial foothold before the backdoor is loaded into memory.