Sigma detection rules, expert-reviewed

Suspicious Rootkit Configuration Registry Keys (via registry_set)

This rule detects registry values written under SOFTWARE keys prefixed with the distinctive nya marker. The OBSCURE#BAT campaign stored rootkit DLLs, driver paths, and AES keys under these keys to configure its stealthy user-mode rootkit.

Suspicious Registry Run Key Referencing Public Libraries Folder (via registry_set)

This rule detects a registry Run key value that points to a file located in the Public Libraries directory. The MULTI#STORM campaign created OneDrive Update Run keys referencing url files staged there for persistence.

Suspicious Script Host Spawning PowerShell Download Cradle (via process_creation)

This rule detects wscript or cscript spawning PowerShell that runs an Invoke-RestMethod download cradle. The Veil#Drop campaign used a JavaScript launcher under the script host to invoke a remote PowerShell loader.

Suspicious PowerShell Download Cradle to Blogspot (via process_creation)

This rule detects a PowerShell command using Invoke-RestMethod to fetch content from a Blogspot URL. The Veil#Drop campaign abused Blogspot as trusted infrastructure to stage and deliver a PowerShell loader for the PureLog stealer.

Suspicious Renamed PowerShell Binary Execution (via process_creation)

This rule detects a process whose original filename is PowerShell but which runs under a different image name. The Dead#Vax campaign executed a renamed PowerShell binary named mbs.exe to evade image based detections.

Suspicious Defender Behavior Monitoring Disable via PowerShell (via process_creation)

This rule detects PowerShell disabling Windows Defender behavior monitoring through Set-MpPreference. The DEEP#DOOR campaign disabled behavior and realtime monitoring to protect its Python backdoor from detection.

Suspicious MSBuild Spawned by PowerShell (via process_creation)

This rule detects the .NET build engine MSBuild.exe being spawned as a child of PowerShell, a living-off-the-land pattern used to execute code outside normal build workflows. The SHADOW#REACTOR campaign abused MSBuild to run an in-memory Remcos payload.

Suspicious Windows Defender Real-Time Monitoring Disable (via process_creation)

This rule detects PowerShell disabling Windows Defender real-time monitoring through Set-MpPreference. The PHALT#BLYX loader used this together with extension exclusions to blind the endpoint before payload injection.

Suspicious MSBuild Execution of Project File from ProgramData (via process_creation)

This rule detects MSBuild.exe executing a project file located in the ProgramData directory. The PHALT#BLYX campaign abused MSBuild as a trusted utility to run a malicious v.proj payload dropped there.

Suspicious Dism Spawned by Microsoft Management Console (via process_creation)

This rule detects the Microsoft Management Console mmc.exe spawning the Dism.exe binary. The FLUX#CONSOLE campaign abused a malicious MSC file to launch a copied Dism binary that sideloaded a malicious DismCore.dll.

Suspicious Service or Task Named windowsinspectionupdate (via process_creation)

This rule detects creation of a service or scheduled task using the distinctive name windowsinspectionupdate. The SLOW#TEMPEST campaign used this name to persist a shellcode loader executed from the Windows Temp directory.

Suspicious Guest Account Privilege Escalation (via process_creation)

This rule detects the built-in guest account being added to the local Administrators group. The SLOW#TEMPEST campaign re-enabled the guest account and elevated it to maintain covert privileged access.

Suspicious Domain Admin Account Creation via net (via process_creation)

This rule detects net.exe adding an account to the Domain Admins group over the domain. The FROZEN#SHADOW campaign created a rogue svc_mail account and elevated it into Domain Admins for persistence and takeover.

Suspicious rundll32 Executing DLL from ProgramData (via process_creation)

This rule detects rundll32.exe executing a DLL located in the ProgramData directory with an exported function name. The FROZEN#SHADOW campaign used this technique to launch its Cobalt Strike beacon staged as msedge.dll.

Suspicious Remote MSI Installation over WebDAV (via process_creation)

This rule detects msiexec.exe installing an MSI package from a remote WebDAV share addressed with an explicit port suffix. The FROZEN#SHADOW campaign delivered SSLoad via a remote slack.msi over a WebDAV UNC path.