Sigma detection rules, expert-reviewed

Malicious Notepad++ Updater Chain via gup.exe Spawning update.exe (via process_creation)

This rule detects the Notepad++ GUP updater gup.exe spawning update.exe, the NSIS-based infection chain seen in the nation-state Notepad++ supply-chain compromise. The trusted updater is subverted to launch a malicious installer that side-loads the Chrysalis payload.

Malicious DtlCrashCatch DLL Side-Loading via OneDrive Sync Service by SPECTRALVIPER

This rule detects the OneDrive.Sync.Service.exe process loading DtlCrashCatch.dll, a side-loaded and injected module used by the SPECTRALVIPER backdoor. This activity is associated with the OceanLotus (APT32) espionage campaign that abuses a trusted signed OneDrive binary for DLL search-order hijacking. Catching this specific side-load is important because it reveals code injection and stealthy execution under a legitimate process context.

Malicious Direct etcd Write to Kubernetes Registry via ETCDCTL_API (via process_creation)

This rule detects direct writes to the Kubernetes object store held in etcd by invoking etcdctl v3 against the /registry key space. Attackers who compromise etcd use this to inject privileged pods or hidden namespace resources that never pass through the kube-apiserver. Bypassing the API server evades admission controllers and audit logging while granting node and cluster takeover.

Suspicious Download to Windows appcompat Directory via PowerShell

This rule detects PowerShell using Invoke-WebRequest to write an executable into the Windows appcompat directory as observed after Triofox CVE-2025-12480 exploitation. Attackers stage payloads such as SAgentInstaller.exe in unusual system paths to evade attention.

Malicious Remote Desktop Enablement via Netsh

This rule detects netsh enabling the Remote Desktop service in the firewall to open inbound RDP for lateral movement. This was observed during Obscura ransomware deployment. Opening RDP on hosts that normally block it extends the attacker foothold across the network.

Malicious Cloud Metadata Credential SSRF via HTTP (via proxy)

This rule detects HTTP requests to the cloud instance metadata IAM security credentials path on Linux hosts. Attackers exploiting the LMDeploy server side request forgery vulnerability coerced the inference engine into fetching temporary IAM credentials from the metadata service. Requests reaching the metadata credentials endpoint from an application server indicate credential theft through SSRF.

Suspicious NirSoft Credential Recovery Tools Execution

This rule detects execution of the NirSoft credential recovery tools netpass.exe and WebBrowserPassView.exe. The Christmas Miracle actor dropped these utilities to extract stored network and browser passwords. Their presence on a server indicates active credential harvesting by an intruder.

Malicious Discord RAT Module Download from GitHub via Proxy

This rule detects retrieval of Discord RAT plugin modules hosted on the public Discord-RAT-2.0 GitHub repository. The malware dynamically downloads and reflectively loads capability modules such as credential theft, webcam capture, and token stealers from this raw content path.

Masquerading Cobalt Strike GetSystem Named-Pipe Impersonation Pattern (via process_creation)

This rule detects the command shell pattern used by Cobalt Strike's getsystem, in which cmd.exe echoes data into a named pipe to trigger SYSTEM token impersonation via a briefly created service. Cobalt Strike is among the most prevalent adversary tools in the Red Canary Threat Detection Report, and this privilege-escalation primitive is a high-fidelity signal of an active beacon. Detecting the echo-to-pipe command surfaces hands-on escalation.

Suspicious PAN-OS GlobalProtect Portal Font Staging File Creation

This rule detects creation of the Latte-Regular.woff file under the GlobalProtect portal fonts directory which Wiz identified as a staging artifact used during exploitation of the PAN-OS vulnerabilities CVE-2024-0012 and CVE-2024-9474. This is important because attackers wrote this specific web font path to stage payloads on the appliance so its appearance signals that the firewall has been compromised and is being prepared for follow-on tooling.

Suspicious ETW Bypass via PSEtwLogProvider Patching (via ps_script)

This rule detects PowerShell script content that reaches into the PSEtwLogProvider internal enabled flag to disable Event Tracing for Windows, an in-memory logging evasion used by the SEO poisoning infostealer. Patching this field blinds PowerShell script block telemetry. Legitimate scripts do not manipulate this private ETW provider field.

Renamed Execution of a Renamed Windows System Utility (via process_creation)

This rule detects a built-in Windows system utility running under a filename that does not match its embedded original binary name, exposing a mismatch between the PE OriginalFileName and the on-disk image. Renaming trusted utilities such as cmd, powershell, certutil or rundll32 is a defense-evasion technique highlighted in the Red Canary Threat Detection Report that lets adversaries slip past name-based detections and application controls. Alerting on the OriginalFileName-to-image mismatch surfaces the evasion regardless of the alias chosen.

Suspicious IIS Worker Process Spawning Encoded PowerShell via CentreStack Exploitation

This rule detects an IIS worker process spawning cmd or PowerShell that runs base64 encoded payloads, behavior observed during active exploitation of Gladinet CentreStack and Triofox local file inclusion flaws. Attackers leverage the web application context to achieve remote code execution and stage further tooling. Web servers rarely spawn encoded interpreters, so this indicates likely post-exploitation activity.

Suspicious SharePoint w3wp Spawning Encoded PowerShell (ToolShell Exploitation)

This rule detects the SharePoint IIS worker w3wp spawning PowerShell with an encoded command, the post exploitation activity following ToolShell webshell deployment. It matters because encoded PowerShell launched by the web server process indicates server side code execution and obfuscated attacker commands.

Malicious Software Protection Service Masquerade Outside System32 via Process Creation

This rule detects the legitimate software protection service binary name sppsvc being executed from any location other than System32 which reflects the masquerading observed in this intrusion where the process ran from a hidden ProgramData directory. The genuine service only runs from System32 so execution elsewhere indicates a masqueraded malicious process.