Sigma detection rules, expert-reviewed

Malicious Scheduled Task Creation TaskSystem via Interlock Ransomware

This rule detects creation of a scheduled task named TaskSystem that runs in the SYSTEM context which Interlock ransomware operators use to establish persistence and execute payloads with elevated privileges. The fixed task name combined with SYSTEM execution distinguishes this from routine administrative task creation.

Suspicious File Download Via Bitsadmin Transfer

This rule detects bitsadmin.exe invoked with a transfer job pointing to a remote URL. TA866 abused bitsadmin alongside certutil to pull additional payloads onto compromised hosts. Using the BITS admin tool to download files is a living-off-the-land ingress and BITS-jobs technique that evades naive download monitoring.

Suspicious Codepage Change Followed By Nltest Domain Trust Discovery

This rule detects a command line that changes the console code page with chcp and then runs nltest for domain trust enumeration. TA866 Asylum Ambuscade used cmd.exe with chcp 65001 chained to nltest DOMAIN_TRUSTS during host reconnaissance. A UTF-8 code-page switch immediately preceding domain trust enumeration is a scripted discovery pattern tied to this actor.

Malicious Shadow Copy Deletion Via WMI

This rule detects PowerShell querying Win32_Shadowcopy and piping the result to Remove-WmiObject to delete volume shadow copies. Akira ransomware used Get-WmiObject Win32_Shadowcopy piped to Remove-WmiObject to destroy shadow copies before encryption. Deleting shadow copies is an inhibit-recovery action that prevents victims from restoring files without paying the ransom.

Malicious Mimikatz Sekurlsa Logonpasswords Credential Dump

This rule detects command lines containing the Mimikatz sekurlsa logonpasswords credential-dumping directive. DragonRank ran rundll32 with the sekurlsa logonpasswords module to harvest credentials from LSASS memory. The sekurlsa logonpasswords string is a distinctive Mimikatz artifact indicating active OS credential theft.

Suspicious Office Application Spawning Mshta With Remote HTA

This rule detects a Microsoft Office application spawning mshta.exe with a remote HTTP or HTTPS URL. Threat actors using MacroPack-built documents launched mshta from Office to fetch remote HTA payloads that loaded Havoc Brute Ratel and PhantomCore. Office spawning mshta to pull a remote HTA is a phishing execution chain that bridges a malicious macro to a fileless second stage.

Suspicious Script Host Spawning PowerShell With Bypass And Hidden Execution

This rule detects wscript.exe or cscript.exe spawning PowerShell with execution-policy bypass and no-profile command execution flags. This chain was observed delivering NetSupport RAT where a JavaScript ActiveXObject WScript.Shell launched PowerShell to fetch the payload. Script hosts invoking hidden bypass PowerShell is a common loader pattern that downloads and runs second-stage malware.

Malicious Scheduled Task Masquerading as Edge Update Running From Temp (via process_creation)

This rule detects a scheduled task creation that masquerades as a Microsoft Edge update task while pointing its action at an executable under the temp directory which the SpiceRAT loader uses for persistence. A legitimate-looking update task name paired with a temp path payload is a strong masquerading plus persistence signal.

Suspicious Windows Defender Exclusion Added for ProgramData (via process_creation)

This rule detects command lines that add a Microsoft Defender exclusion path covering C:\ProgramData which the CoralRaider batch script uses to hide staged payloads from antivirus scanning. Adding scan exclusions is a common impairment of defenses that lets malware execute and persist from a trusted allowlisted directory.

Malicious Spoolsv Process Masquerading From Non-System Path (via process_creation)

This rule detects the Windows print spooler binary name spoolsv.exe executing from a directory outside System32 which the CoralRaider RotBot component uses to masquerade as a trusted system service. Running a well-known system image name from a wrong location is a strong masquerading signal used to evade defender and analyst attention.

Malicious svchost Service Creation for TinyTurla Persistence (via process_creation)

This rule detects creation of a service whose binary path runs svchost.exe under a custom sysman service group, the persistence mechanism in the full TinyTurla kill chain. Registering a new svchost group allows the backdoor ServiceDll to load inside a trusted host process at boot.

Malicious Edge Credential Parser Execution via PowerShell (via process_creation)

This rule detects execution of the edgeparser.ps1 script used by Turla in TinyTurla-NG operations to parse and steal Microsoft Edge Login Data. The script harvests saved browser credentials for onward access and lateral movement.

Malicious Scheduled Task Masquerade for Zardoor Persistence (via process_creation)

This rule detects scheduled task creation using the Zardoor masquerade names KasperskySecurity or msbuildss.exe. The actor names persistence tasks after security software and build tooling to blend malicious execution into expected system activity.

Malicious Zardoor Backdoor Execution via rundll32 (via process_creation)

This rule detects rundll32.exe invoking the MainEntry export of zar32.dll or zor32.dll, the core execution modules of the Zardoor backdoor. These components provide command-and-control and reverse-proxy capability during long-term espionage operations.

Malicious Service Creation Masquerading as nslookup (via process_creation)

This rule detects creation of a Windows service whose binary is named nsIookup.exe, a homoglyph masquerade of nslookup used by Lazarus for persistence in Operation Blacksmith. Naming the service payload after a trusted networking tool helps it evade casual review.