Sigma detection rules, expert-reviewed

Malicious Tycoon 2FA AiTM Phishing WebSocket Channel

This rule detects the Tycoon 2FA phishing kit opening its adversary-in-the-middle relay over the fixed /web6socket/socket.io WebSocket endpoint. This path is unique to the kit and identifies a victim connecting to the AiTM proxy used to steal session cookies.

Suspicious Text-File Payload Staging in Temp (via file_event)

This rule detects creation of specifically named text staging files used to hold base64-encoded .NET loaders and encrypted configuration. The SHADOW#REACTOR campaign used a text-only staging pipeline before in-memory Remcos RAT deployment.

Malicious XRed Backdoor Persistence via Synaptics Run Key (via registry_set)

This rule detects the XRed backdoor establishing persistence through a Run key value named Synaptics Pointing Device Driver that points into the ProgramData\Synaptics directory. The value name masquerades as a legitimate touchpad driver while the executable path is a non-standard ProgramData location dropped by trojanized InstantView installers. Attackers use this autorun entry to survive reboots and maintain backdoor access for keylogging and data theft.

Suspicious Mirage Kitten SspiCli.dll Search-Order Hijack via AppVShNotify.exe (via image_load)

This rule detects AppVShNotify.exe loading SspiCli.dll from outside System32, a DLL search-order hijack used by Mirage Kitten to execute malware under a trusted App-V binary against Middle East and Africa targets. Sideloading a system DLL name from an unexpected path lets the attacker run code stealthily while masquerading as a legitimate Windows component.

Malicious DLL Side-Loading of msimg32 via Silverlight.Configuration.exe

This rule detects Silverlight.Configuration.exe loading msimg32.dll from outside the Windows system directories. The Horns and Hooves campaign abused this signed binary to side-load a planted msimg32.dll and execute the NetSupport loader under a trusted process.

Malicious MicrosoftUpdate Run Key Persistence via Axios Compromise

This rule detects creation of a CurrentVersion Run value named MicrosoftUpdate that launches the renamed wt.exe interpreter as used by the Windows variant of the Axios supply chain RAT. The benign looking value name paired with a ProgramData interpreter path indicates masquerading persistence for the backdoor.

Suspicious CMSTP Execution With INF Payload via process_creation

This rule detects the Connection Manager Profile Installer cmstp.exe running with an INF file or silent flag, the LOLBin abused in the GST-phishing Remcos RAT chain to bypass UAC and execute attacker code. Adversaries leverage the trusted, auto-elevating cmstp binary to run malicious INF-defined commands while evading application controls, so its rare invocation is a strong signal of the multi-stage .NET infection.

Linux Process Execution from /dev/shm Shared Memory Directory

Alerts on Linux processes executing binaries from /dev/shm, a common in-memory staging location.

Malicious NTDS Database Dump via NTDSUtil in BlackSuit Ransomware

This rule detects ntdsutil being used to create an installation from media (IFM) copy of the Active Directory database, a credential-access technique observed in BlackSuit ransomware intrusions. Dumping NTDS.dit gives operators every domain hash for offline cracking and full domain compromise, making this a critical detection.

Malicious Regsvr32 Loading a DLL From a Data Directory (via process_creation)

This rule detects regsvr32.exe registering a DLL located in ProgramData or a user AppData directory, the loader behavior Emotet and similar malware use to execute a dropped payload under a trusted binary. Regsvr32 execution of user-dropped DLLs is a defense-evasion technique tracked in the Red Canary Threat Detection Report. Detecting these invocations surfaces malware loading from a staging directory.

Suspicious Shell Spawned by Langflow Python Process (via process_creation)

This rule detects a Langflow Python process spawning a command shell or network utility. Such a child process is consistent with the reverse shell payloads used against CVE-2025-3248. A Langflow worker does not normally launch interactive shells.

Malicious Cryptominer Staging Files Dropped in tmp Directory

This rule detects references to hidden cryptominer staging files written under /tmp such as .solr, kdevtmpfsi, zzz and .ICEd-unix. These paths were used across the Summer 2023 cryptojacking campaigns tracked by Wiz Research to drop XMRig and CCminer payloads, and their presence indicates resource-hijacking activity on a compromised host.

Suspicious bitsadmin Download to AppData Temp via ClickFix Revenge Chain

This rule detects bitsadmin.exe performing a transfer that downloads a remote http resource into the user AppData or Temp directory, the payload retrieval step of the ClickFix campaign following a Windows Run dialog paste. bitsadmin used interactively to fetch executables into user writable folders is a well known living off the land download technique. This catches the staging of the second stage binary.

Suspicious Boot Configuration Change to Safeboot Minimal via bcdedit

This rule detects use of bcdedit to set the boot configuration to safeboot minimal, forcing the host to reboot into Safe Mode where most endpoint security agents do not load. The ToyMaker intrusion used this to disable protections before hands-on-keyboard activity, so it is a high-confidence defense-evasion signal preceding credential theft or ransomware deployment.

Malicious UAT-8302 Hidden PowerShell Execution of whatpc.ps1

This rule detects PowerShell running the whatpc.ps1 script with an execution policy bypass and a hidden window, matching the UAT-8302 reconnaissance stager. The named script drives host profiling and follow-on tasking while the hidden bypass flags suppress user visibility and controls. Execution of this specific script under these flags indicates active UAT-8302 operations.