Sigma detection rules, expert-reviewed

Suspicious PowerShell Locating and Running MSBuild Project (via process_creation)

This rule detects a PowerShell one-liner that recursively searches for msbuild.exe and downloads a project file into ProgramData for execution. This ClickFix style command was observed in the PHALT#BLYX campaign.

Malicious COM Object Hijack Pointing to IconCache DLL

This rule detects a COM object InProcServer32 registration whose default value references an iconcache prefixed DLL in the Explorer directory. Operation ForumTroll established persistence via a COM hijack under HKCR CLSID InProcServer32 pointing at its payload DLL as documented by Kaspersky. This combination of a COM handler mapped to a masquerading DLL path indicates stealthy persistence and defense evasion.

Malicious Bad Apples Data Exfiltration via snmptrap OID

This rule detects snmptrap sending data to the attacker-specific enterprise OID 1.3.6.1.4.1.99999, matching the Bad Apples abuse of native macOS SNMP tooling to smuggle collected data out over an alternate protocol. Encoding stolen information inside SNMP trap fields evades controls focused on HTTP and DNS exfiltration. Use of this fabricated OID with snmptrap indicates covert exfiltration.

Suspicious WScript Executing VBScript from Masqueraded File Extension

This rule detects wscript.exe running a VBScript engine against files with non-script extensions such as drv, regtrans-ms or ntuser.dat, an execution and masquerading technique used by Shuckworm to hide its GammaSteel loader.

Suspicious systemd User Service Persistence miasma-monitor (via file_event)

This rule detects creation of a miasma-monitor systemd user service unit used by the M-Red-Team AsyncAPI compromise for persistence. Writing a user-level systemd service lets an attacker relaunch a monitoring implant on login without root. The specific unit name combined with the user systemd path is a strong persistence signal.

Web Server Worker Process Spawning Command Interpreter

This rule detects the IIS worker process w3wp.exe spawning command shells or administrative utilities, behavior consistent with the China Chopper web shell used in Operation Soft Cell against telecommunications providers. A web server worker launching cmd, wmic or PowerShell strongly indicates web shell command execution.

Malicious Akira Ransomware Encryption Execution (via process_creation)

This rule detects the Akira ransomware encryptor invoked with its characteristic path and share targeting switches. These combined command-line flags drive selective encryption across local and network locations. Detection here indicates active encryption and imminent impact on the environment.

Malicious PowerShell AMSI Bypass via AmsiInitFailed Command Line

This rule detects the amsiInitFailed AMSI-bypass string in a PowerShell command line, a defense-evasion technique used after Citrix Bleed exploitation to disable script scanning before running the LockBit toolkit. Setting amsiInitFailed forces AMSI to skip inspection. Detecting the string exposes an active attempt to blind endpoint script scanning.

Malicious DLL Side-Loading via AVGApplicationFrameHost

This rule detects the AVGApplicationFrameHost.exe binary loading a wsc.dll module, a DLL side-loading chain used by TheWizards APT group to execute the WizardNet backdoor alongside an encrypted log.dat shellcode payload. Abusing a signed AV-related host process to load an attacker DLL evades trust controls and blends malicious execution into legitimate software.

Suspicious File Download to tmp and Quarantine Removal via curl and xattr

This rule detects a shell command that downloads a file into the tmp directory with curl, strips the macOS quarantine attribute with xattr, marks it executable and runs it. This chain is the macOS infection path from fake Claude Code advertisements delivering an AMOS style stealer.

Malicious Logon Script Persistence via UserInitMprLogonScript

This rule detects the creation or modification of the UserInitMprLogonScript value under the user Environment key, a logon persistence technique observed in a martial-law-themed APT campaign that pointed this value at updater.exe to execute at each logon. It captures the abuse of a rarely used logon-script registry entry to survive reboots. Detecting this is important because UserInitMprLogonScript is almost never set by legitimate software and is a well-known persistence primitive.

Malicious Boot Recovery Disable via Bcdedit (via process_creation)

This rule detects bcdedit being used to disable Windows recovery or force boot into ignore-all-failures or safe mode. Ransomware alters the boot configuration so that automatic repair and recovery options cannot restore the system after encryption. Tampering with boot recovery settings from the command line is a strong impact indicator.

Malicious Fileless JavaScript Execution via Deno Data URI (via process_creation)

This rule detects the Deno runtime executing an inline base64 encoded JavaScript payload passed as a data application javascript URI, a fileless execution technique used by attackers abusing alternative runtime environments to evade disk based detection. The allow all flag combined with an inline data URI is a strong indicator of malicious in memory code execution.

TAG-144 Payload Staging via MyCustomAgent User-Agent (via proxy)

This rule detects HTTP requests using the hardcoded MyCustomAgent/1.0 user-agent that the TAG-144 loader sets when pulling staged payloads from paste services via ServerXMLHTTP. Adversaries leverage a fixed non-browser user-agent to fetch second-stage code, making this distinctive string a reliable delivery-stage indicator.

Suspicious Wininit Look-Alike Binary Execution from Windows Directory

This rule detects execution of a binary named to closely resemble the legitimate Windows initialization process which Lorenz ransomware uses for persistence from the Windows directory. Observed in NCC Group research unmasking Lorenz ransomware deploying a WinIniw.exe persistence binary. Typosquatting core system process names is a common masquerading tactic that warrants investigation.