Sigma detection rules, expert-reviewed

Suspicious Password-Protected Archive Extraction of Everything64.dll by Elpaco Ransomware

This rule detects 7-Zip command-line extraction of a password-protected archive that deploys the Everything64.dll component. Elpaco ransomware, a Mimic variant, abuses the legitimate Everything search library for fast file enumeration prior to encryption. Password-protected extraction of this specific payload indicates staging of ransomware tooling on the host.

Suspicious Browser Login Data Copied to Temp File via type Command

This rule detects use of the cmd type command to copy a browser Login Data credential store into a temporary file. In SocGholish activity the stolen store was redirected into a rad prefixed tmp file for later DPAPI decryption. Copying the credential database is a precursor to bulk password theft from the endpoint.

Malicious COM Object Hijack Pointing to a User-Writable DLL (via registry_set)

This rule detects a CLSID InprocServer32 default value being pointed at a DLL in a user, temp or public directory, the hallmark of COM hijacking used for stealthy persistence and defense evasion. COM hijacking is a persistence technique profiled in the Red Canary Threat Detection Report. Detecting a COM object redirected to a user-writable payload surfaces a persistence mechanism before it is invoked.

Malicious UNC3944 Microsoft Defender Real-Time Protection Disable via Set-MpPreference (via ps_script)

This rule detects PowerShell invoking Set-MpPreference to disable Microsoft Defender real-time and behavior monitoring protections. UNC3944 disabled endpoint defenses this way to enable follow-on ransomware and tooling deployment after gaining access through SIM-swap and SMS phishing. Turning off real-time protection is a strong pre-encryption defense-evasion signal.

Malicious Windows Native Backup Size Re-configuration (via process_creation)

This rule detects delete existing Windows native backup by reducing the allocated backup storage.

TamperedChef Persistence via PDFEditorUpdater Run Key (via registry_set)

This rule detects the TamperedChef infostealer establishing autostart persistence through a PDFEditorUpdater Run key whose value invokes the PDF Editor binary with its hidden update flag. Adversaries use this key to relaunch the weaponized editor at logon, making detection of the registry write useful for catching persistence before credential theft resumes.

Suspicious SharePoint Webshell File Creation in LAYOUTS Directory via ToolShell (via file_event)

This rule detects creation of known ToolShell webshell and key harvester aspx files inside the SharePoint LAYOUTS directory. These filenames are associated with post exploitation of CVE-2025-53770 and related SharePoint flaws.

Malicious Replication Privileges Granted to Perform DCSync Attack (via security)

This rule detects grants replication privilege to an account to exflitrate Active Directory credentials.

Suspicious TimbreStealer Execution via rundll32 iernonce.dll (via process_creation)

This rule detects rundll32.exe loading iernonce.dll, the module executed via a run-once mechanism by the TimbreStealer information stealer targeting Mexican users. The stealer proxies its execution through rundll32 to evade defenses while collecting browser credentials.

Suspicious Anonymous Access to Kubernetes API Server via Audit Log

This rule detects Kubernetes API server requests authenticated as system:anonymous or belonging to the system:unauthenticated group. Adversaries query an unauthenticated API server to enumerate pods, secrets, and other cluster resources for reconnaissance and initial access. Anonymous access to the control plane indicates a misconfigured cluster exposed to untrusted callers.

Suspicious Windows Terminal Launching Hidden PowerShell with Execution Bypass (via process_creation)

This rule detects Windows Terminal (wt.exe) launching a hidden PowerShell instance with an execution policy bypass and a script file argument, a chain observed in the North Korea-nexus compromise of the Axios NPM package where a postinstall script dropped and ran a PowerShell payload. Adversaries use this to execute code stealthily while bypassing script controls, which makes it valuable for catching supply-chain-driven execution.

Malicious NetSupport RAT Masquerading as systeminfo.exe

This rule detects a process named systeminfo.exe loading a client32.ini configuration file, which is the EVALUSION NetSupport RAT masquerading as the benign Windows utility. The RAT was delivered inside a JPG-wrapped ZIP and run as systeminfo.exe alongside its client32.ini config. The legitimate systeminfo tool never reads a NetSupport config, so this name-and-context mismatch reveals the RAT.

Suspicious Kimsuky Wscript Launch From Hidden Windirr Directory (via process_creation)

This rule detects wscript.exe executing a VBS script from the hidden C windirr directory created by the Kimsuky LNK based Python backdoor chain. The staging folder name and background VBS execution are unique markers of this campaign.

Malicious Accessibility Feature Debugger Hijack via IFEO (via registry_set)

This rule detects an Image File Execution Options Debugger value being registered for the sticky keys binary sethc.exe, a persistence and privilege-escalation backdoor used by Phobos affiliates. The technique launches an attacker command interpreter from the logon screen without authentication.

Suspicious DLL Sideloading via csmonitor.exe Loading Microsoft.ServiceHosting.Tools.dll (via image_load)

This rule detects the QuickFox supply chain implant loading a trojanized Microsoft.ServiceHosting.Tools.dll through the legitimate Azure Compute Emulator binary csmonitor.exe. The FDMTP loader relies on DLL search order hijacking to run inside a trusted signed process. Loading this Azure tooling DLL outside its normal SDK context is highly anomalous.