Sigma detection rules, expert-reviewed

Malicious Ransomware Encryptor Execution with Password Gate (via process_creation)

This rule detects a binary launched with password and no-admin arguments characteristic of the Qilin ransomware encryptor. Operators executed the encryptor with a long password and a no-admin flag to skip UAC prompts during mass encryption.

Malicious DNS Query To FvncBot Android Banking Trojan C2

This rule detects DNS resolution of naleymilva.it.com, the command-and-control domain of the FvncBot Android banking trojan targeting Poland. Infected devices resolve this domain to register and receive operator commands over HTTP and WebSocket. Alerting on the hardcoded C2 domain identifies devices beaconing to the trojan infrastructure.

Suspicious OAuth Application Registration with Localhost Reply URL via Azure AD

This rule detects registration or update of an Azure AD OAuth application whose reply or redirect URL points to an anomalous localhost loopback endpoint such as http://localhost:7823/access/. This behavior was observed in OAuth application attacks researched by Huntress where adversaries register illicit applications to harvest tokens. Attackers abuse consented OAuth apps to maintain persistent access to cloud mailboxes and data, so anomalous reply URLs are a strong early indicator of illicit app registration.

Malicious Mimikatz Credential Access Module Invocation

This rule detects command lines invoking Mimikatz credential-access modules such as privilege debug sekurlsa logonPasswords or lsadump sam. The BabyLockerKZ MedusaLocker operator used these Mimikatz modules to dump credentials during pre-encryption operations. Chained privilege debug and LSASS or SAM dumping commands are unambiguous credential-theft activity preceding lateral movement and ransomware.

Suspicious Edge Update Setup Spawning PowerShell via ClearFake

This rule detects a MicrosoftEdgeUpdateSetup lure executable spawning PowerShell. The ClearFake fake-update campaign delivers a spoofed Edge updater that launches PowerShell to fetch and run its next stage, an execution chain that legitimate browser updates do not produce.

Malicious PlugX DLL Side-Loading via LMIGuardianSvc from SamsungDriver Directory (via process_creation)

This rule detects the legitimate LMIGuardianSvc binary executing from a SamsungDriver directory created by Mustang Panda to side-load PlugX. The signed binary search-order loads a malicious LMIGuardianDll from this attacker-controlled path. Running this LogMeIn component from a non-standard user directory is anomalous.

Malicious UNC4841 FOXDOOR Shell Execution from Non-Standard Path (via process_creation)

This rule detects execution of the FOXDOOR shell component from the hardcoded /usr/share/foxdoor/ directory used by UNC4841 on compromised Barracuda ESG appliances. The path and binary name are attacker-controlled artifacts that provide interactive backdoor access. Detecting execution from this planted directory reveals active hands-on-keyboard operation on the appliance.

Suspicious PowerShell Execution of Script from Netlogon Share by Cyber Anarchy Squad

This rule detects PowerShell launched with an execution policy bypass to run a script hosted on the domain netlogon share. The Cyber Anarchy Squad uses this technique to distribute and execute tooling such as rm.ps1 across compromised environments. Bypassing execution policy to run a remote logon-share script indicates malicious lateral distribution.

Suspicious Run Key Persistence via Masqueraded svhostss Value by Elpaco Ransomware

This rule detects creation of a Run key value named svhostss which masquerades as the legitimate Windows svchost process. Elpaco ransomware, a Mimic variant, uses this autorun entry to persist across reboots. The deceptive naming combined with an autorun context indicates persistence for a ransomware payload.

Suspicious EastWind Implant Execution from ProgramData DRM Directory

This rule detects execution of a process from the C\ProgramData\Microsoft\DRM directory, a staging path used by the EastWind campaign for DLL sideloading and implant hosting. Legitimate DRM components do not run from this location, so process execution here signals attacker payload deployment and warrants investigation.

Suspicious CasPol Execution Spawned by PowerShell for Injection

This rule detects the .NET CasPol.exe utility being launched by PowerShell, a system binary proxy execution chain used by the XWorm LATAM campaign to hollow CasPol and host the RAT payload. CasPol is seldom executed interactively, and a PowerShell parent is highly suspicious.

Malicious Named Pipe kesknq for Token Impersonation (via pipe_created)

This rule detects creation of the named pipe kesknq used for privilege escalation and token impersonation in an Apache ActiveMQ exploitation leading to LockBit. The specific pipe name was reused across the getsystem routine and a service of the same name. Named pipe impersonation lets the operator elevate from a service context to SYSTEM.

Suspicious Edgecution Malicious Extension Load via Headless Edge (via process_creation)

This rule detects Microsoft Edge being launched with a load-extension argument together with headless mode and a Recovery user data directory as used by Edgecution to run its malicious browser extension backdoor. Legitimate Edge sessions do not side load unpacked extensions in headless mode.

Malicious BlackCat Boot Configuration Change to Safe Mode with Networking via bcdedit (via process_creation)

This rule detects bcdedit being used to force the system to boot into Safe Mode with networking, a pre-ransomware defense-evasion step observed in the Nitrogen campaign before BlackCat encryption. Adversaries reboot endpoints into Safe Mode so that most security agents do not load while the ransomware still reaches network shares, making this a high-value early indicator of imminent encryption.

Malicious Disabling of rsyslog or auditd Logging Services (via process_creation)

This rule detects commands that stop, disable, mask, or kill the rsyslog or auditd logging services on Linux. The Group-IB XMRig covert Linux PAM abuse campaign disables these services to blind host defenses before mining and persistence activity. Impairing logging is a strong pre-attack signal that an adversary is preparing to operate without leaving audit trails.