Sigma detection rules, expert-reviewed

Malicious SparrowDoor Process Hollowing of colorcpl.exe

This rule detects execution of the legitimate colorcpl.exe utility with the numeric command line argument 11, a pattern used by the FamousSparrow group to launch a hollowed process hosting the SparrowDoor backdoor. colorcpl.exe is a color management applet that does not normally accept such arguments, so this invocation indicates process hollowing for defense evasion.

Suspicious PHP Webshell Access under WordPress Cache Directory

This rule detects HTTP requests to a PHP file located in the WordPress wp-content cache directory. Legitimate WordPress caching stores static HTML and never executable PHP, so a PHP file served from this path indicates a dropped webshell used for post exploitation command execution.

Malicious IIS Worker Process Spawning Command Shell via SharePoint ToolShell (via process_creation)

This rule detects the SharePoint IIS worker process w3wp.exe spawning command interpreters or scripting hosts, a hallmark of web shell execution. Exploitation of CVE-2025-53770 (ToolShell) drives w3wp to launch cmd or PowerShell for post-exploitation, indicating server-side remote code execution.

Suspicious Termination of Security Tooling via taskkill or sc delete

This rule detects taskkill or sc.exe being used to stop or delete Sysmon, SentinelOne, or other endpoint security services, matching the impairment activity in the Defence Impairment intrusion. Adversaries kill and remove EDR and monitoring agents to operate without detection before credential theft and lateral movement. Targeting named security services with process or service control utilities is a high-confidence evasion signal.

Suspicious Run Key Persistence Referencing Public or Default User Path

This rule detects creation of a CurrentVersion Run registry value whose data points to an executable staged under C:\Users\Public or the Default User profile. Ryuk ransomware drops its payload into these world-accessible directories and registers autorun persistence pointing there. Legitimate software rarely autoruns binaries from these locations, making this combination a high-confidence indicator.

RunningRAT Service Persistence via svchost NETSYSDDL Group (via process_creation)

This rule detects svchost.exe launched with the NETSYSDDL service group used by RunningRAT to load its malicious DLL under a masqueraded service. Adversaries leverage the svchost hosting model so the RAT executes as a service and survives reboots while blending into legitimate host processes.

EchoGather Backdoor Components Dropped to User Windows Profile Directory (via file_event)

This rule detects creation of the EchoGather backdoor and its PowerShell loaders inside the roaming Microsoft Windows profile directory used by the Paper Werewolf campaign. Writing these specific filenames into a user profile path reflects the backdoor being staged for persistence after the malicious XLL executes.

Malicious FortiClient Process Spawning PowerShell Downloader (via process_creation)

This rule detects the FortiClient fortitray.exe or ipsec.exe process spawning a command shell or PowerShell. Exploitation of CVE-2026-35616 in FortiClient EMS delivered the EKZ infostealer through this process chain disguised as a Fortinet endpoint patch.

Suspicious Remote Archive Retrieval via mshta in Malware Distribution Ecosystem

This rule detects mshta.exe invoked with an HTTP or HTTPS URL pointing to a .7z archive, the delivery step used by the click-hijacking and TDS ecosystem to fetch stager payloads such as navy.7z. mshta retrieving a remote archive is a living-off-the-land proxy-execution behavior seldom seen in benign use.

Malicious Bun Runtime Payload Dropped by Shai Hulud npm Supply Chain Attack

This rule detects creation of the setup_bun.js or bun_environment.js files associated with the Shai Hulud 2.0 npm supply-chain worm. A malicious preinstall script drops setup_bun.js which installs the Bun runtime and stages the large bun_environment.js payload for credential theft and self-propagation. These distinctive filenames written during package installation indicate the worm establishing execution.

SharePoint spinstall Webshell Deployment after ToolShell Exploitation (via webserver)

This rule detects requests to spinstall or related aspx webshells dropped after ToolShell exploitation of SharePoint CVE-2025-53770, which extract the ValidationKey and DecryptionKey machine key material from the server. Adversaries retrieve these keys to forge authentication and regain access even after patching.

Malicious Scheduled Task MicrosoftsUpdate Loading DLL Web Shell (via process_creation)

This rule detects creation of a scheduled task named MicrosoftsUpdate via schtasks. In the HrServ APT web shell intrusion the actor registers a task with this masquerading name to load hrserv.dll for persistence, so this misspelled Microsoft-lookalike task name indicates the malicious loader being installed.

Suspicious File Based C2 Relay via Python Web Panel via process_creation

This rule detects the file based command and control component of the AI assisted intrusions where python3 runs a relay.py or webpanel.py operator panel that dispatches commands through /tmp/cmd_ FIFO files. This lightweight Python relay brokers attacker instructions to the implant on the host. Running these operator scripts from a compromised server is a strong indicator of hands on keyboard control.

Malicious Kimsuky Run Key Autostart to desktop.ini.bak in Public Folder (via registry_set)

This rule detects a Run key persistence value pointing to a masqueraded desktop.ini.bak file under C:\Users\Public, a technique used by Kimsuky to autostart its VBS/PowerShell keylogger against Japanese targets. The abuse of a system-looking filename in a world-writable public path is intended to blend persistence into normal-looking artifacts.

Malicious RCE Confirmation Markers from Offensive Agentic Tooling

This rule detects the VAPT confirmation markers and command placeholder that attackers wrap around executed commands when validating remote code execution with offensive agentic tooling built on stolen AI compute. The markers bracket command output so the automation can parse successful execution. Their appearance on hosts is a high-confidence sign of automated exploitation.