Sigma detection rules, expert-reviewed

Suspicious App Domain Manager Injection via Environment Variables

This rule detects processes started with the APPDOMAIN_MANAGER_ASM or APPDOMAIN_MANAGER_TYPE environment variables set, the environment-driven form of App Domain Manager injection that forces a .NET runtime to load an attacker-specified assembly at startup. These variables are honored by the CLR to override the default app domain manager, hijacking execution inside a trusted signed binary. Their presence in a process environment is highly abnormal and indicates deliberate .NET execution hijacking.

Suspicious Scheduled Task Application Maintenance Executing Core Payload

This rule detects creation of a scheduled task named Application Maintenance that launches Core.exe, the persistence mechanism observed in the AstarionRAT intrusion to relaunch the implant. The generic maintenance task name conceals execution of the attacker payload. The pairing of this task name with the Core.exe binary is a distinctive persistence indicator worth alerting on.

Suspicious Local Account Creation of DefaultService via Net User

This rule detects creation of a local account named DefaultService using net user, a persistence step observed in the ClickFix to Matanbuchus to AstarionRAT intrusion where the actor added a service-like account to blend in. The innocuous DefaultService name is chosen to evade casual review of local accounts. New account creation with this masquerading name is a strong indicator of attacker persistence.

Malicious PowerShell Download of vhost.exe Payload

This rule detects PowerShell retrieving a payload named vhost.exe over the network, the ingress tool transfer observed in the SimpleHelp abuse ransomware operation preceding encryption. The actor used PowerShell download cradles to pull the next-stage binary onto compromised hosts. A scripting host fetching this named executable indicates active staging of ransomware tooling.

Suspicious OneDrive Masquerading Binary Executed from Non-Standard Path

This rule detects execution of OneDriver.exe or a service named OneDriveSvc that masquerades as Microsoft OneDrive but runs from a location outside the legitimate OneDrive installation directories, a defense-evasion technique observed in the SimpleHelp abuse ransomware operation. The subtly altered name and wrong path distinguish the imposter from the genuine OneDrive.exe. A trusted-looking name in the wrong context is a classic masquerading indicator.

Suspicious Winpty Agent Spawned by Net Monitor Employee Monitoring Process

This rule detects winpty-agent.exe being spawned by lsa.exe, the Net Monitor for Employees process, a lineage observed in ransomware operations that abused employee-monitoring software for interactive command execution. The winpty pseudo-terminal helper launched from a monitoring agent provides the actor a hands-on shell channel. This parent-child relationship is anomalous and indicates the monitoring tool is being weaponized for hands-on-keyboard activity.

Suspicious Velociraptor DFIR Agent Deployed as Service

This rule detects installation of the Velociraptor endpoint agent as a Windows service, an abuse of a legitimate DFIR tool observed by the actor after SolarWinds Web Help Desk exploitation to maintain remote access. Threat actors increasingly repurpose Velociraptor for persistence and remote control because it blends in with defensive tooling. Unexpected Velociraptor service creation on a server that is not sanctioned for it warrants investigation.

Suspicious SolarWinds Web Help Desk Java Process Spawning Command Shell

This rule detects the SolarWinds Web Help Desk java.exe process spawning cmd.exe or msiexec.exe, the exploitation lineage observed for CVE-2025-26399 where the wrapper and Java service are driven to execute operating system commands. A help desk web application launching a command shell or installer indicates the unauthenticated deserialization flaw is being abused for code execution. This chain marks initial access on the affected server.

Suspicious PowerShell Spawned by ScreenConnect Remote Access Client

This rule detects PowerShell being launched as a child of the ScreenConnect remote access client, a lineage observed where actors abused legitimate RMM tooling to run follow-on scripts. While ScreenConnect is widely used for support, a scripting host spawned from its agent is a frequent hands-on-keyboard delivery pattern and merits scrutiny in environments where it is not sanctioned. Correlate with the downstream script content to confirm intent.

Malicious LSASS Memory Dump via Rundll32 and Comsvcs MiniDump

This rule detects rundll32.exe invoking comsvcs.dll MiniDump to dump process memory, the classic LSASS credential-theft technique that remained in use across the 2025 intrusions Huntress reviewed. Dumping LSASS extracts cached credentials and Kerberos material for lateral movement. The combination of comsvcs.dll and the MiniDump export from rundll32 has virtually no legitimate use on endpoints.

Suspicious Data Staging into Archive via WinRAR

This rule detects the WinRAR command line utility archiving files with the exclude-base-path flag ep1 into a staging archive, a collection behavior observed in the ESXi intrusion prior to exfiltration. Attackers compress harvested data into a single archive to simplify transfer while stripping absolute paths. Command line rar with ep1 in server or unusual working directories can indicate archive-for-exfil staging.

Malicious Vulnerable Driver Mapping via KDU

This rule detects execution of the Kernel Driver Utility kdu.exe with its provider and driver-mapping flags, a bring-your-own-vulnerable-driver technique observed in the ESXi exploitation activity to load unsigned kernel code. KDU abuses a signed vulnerable driver to map an attacker driver such as MyDriver.sys into the kernel, defeating driver signature enforcement. Presence of kdu.exe with these arguments indicates kernel-level defense evasion.

Suspicious VMware PCI Device Disabled via Devcon

This rule detects devcon.exe being used to disable the VMware PCI device identified by hardware ID PCI\VEN_15AD&DEV_0740, a manipulation observed in in-the-wild ESXi VM escape activity. Disabling the VMCI or hypervisor-facing device weakens host isolation and supports the escape and defense-evasion chain. Legitimate use of devcon against VMware virtual hardware IDs is rare and warrants investigation.

Suspicious IIS Worker Process Spawning Whoami Reconnaissance

This rule detects the IIS worker process w3wp.exe spawning whoami.exe, a webshell-driven reconnaissance behavior observed following exploitation of an internet-facing server. A web application context should never legitimately execute identity enumeration commands, so this parent-child relationship strongly indicates a deployed webshell running attacker commands. It typically marks the earliest hands-on-keyboard stage after initial access.

Suspicious File Hiding via Attrib System and Hidden Attributes

This rule detects attrib.exe applying the system and hidden attributes to an executable, a masquerading technique observed where the actor hid a malicious dllhost.exe from casual inspection. Marking a payload as a hidden system file conceals it from users and default directory listings. This behavior on user or public paths against an executable is a reliable low-noise indicator of hidden artifact staging.