Sigma detection rules, expert-reviewed

Malicious CR4T C2 Beacon via TroubleShooter User-Agent (via proxy)

This rule detects outbound HTTP requests carrying the distinctive TroubleShooter User-Agent string which the CR4T implant of the DuneQuixote campaign uses when communicating with its command-and-control server.

Suspicious Masqueraded System Directory Creation with Trailing Space via cmd

This rule detects creation of a masqueraded Windows system directory containing a trailing space such as Windows -System32 using cmd. The Tangerine Turkey cryptomining campaign creates a directory that visually resembles a trusted system path to blend in XMRig components. Detecting it surfaces masquerading and defense evasion used to hide the miner from analysts.

Malicious Linux systemd Persistence miasma-monitor.service

This rule detects creation of a systemd unit named miasma-monitor.service, the Linux persistence installed by the AsyncAPI npm supply chain compromise. The service relaunches the import-time payload across reboots to keep the compromised developer host under attacker control.

Suspicious Service Persistence Masquerading as DevQueryBrokerService

This rule detects creation of a scheduled task or Windows service named DevQueryBrokerService, a masquerading persistence artifact used by the SADBRIDGE loader that delivers the GOSAR backdoor. The malware installs a service and scheduled task under this benign-looking name to survive reboots and maintain access. The masquerading service name executed through schtasks or sc indicates attacker-controlled persistence rather than a genuine Windows component.

Possible PowerShell Hidden Download Cradle via Process Creation

This rule detects PowerShell launched with hidden window and no-profile flags executing an in-memory download cradle that uses Net.WebClient DownloadString. Observed in NCC Group research on TA505 exploiting the SolarWinds Serv-U vulnerability CVE-2021-35211 for initial access. This technique stages remote payloads directly in memory to evade disk-based detection which makes it a high-value indicator.

Suspicious PowerShell Spawned by Windows Script Host via Process Creation (via process_creation)

This rule detects powershell.exe spawned as a child of wscript.exe or cscript.exe, the wscript to cscript to PowerShell chain characteristic of Gootloader documented by Red Canary. Script hosts rarely need to invoke PowerShell in benign workflows, so this parent-child relationship is a high-confidence signal of staged script-based malware executing its next-stage payload.

Malicious Excel Macro Spawning Scripting Interpreter Downloader (via process_creation)

This rule detects Microsoft Excel spawning a scripting interpreter such as PowerShell, WScript, or cmd, the macro execution chain described in Deep Instinct's Regex Gone Rogue analysis. A weaponized xlsm macro uses WScript.Shell to launch PowerShell that downloads and runs a batch file. This indicates user-executed macro abuse leading to remote payload download and code execution.

Malicious wp2shell WordPress Web Shell via PHP Drop to Plugin Directory

This rule detects a PHP file written into a wp2shell plugin directory which is the web shell installed by the pre-auth WordPress RCE before command execution. Attackers drop the malicious plugin to gain a persistent server-side foothold. A PHP file appearing under this specific plugin path is a high-confidence web shell indicator.

Suspicious Rundll32 Execution Of DllGetClassObject Export via Process Creation

This rule detects rundll32.exe invoking the DllGetClassObjectGuid export. Cuba ransomware executes its loader DLL through rundll32 using this specific non-standard export name to proxy execution, an artifact with no known legitimate use.

Suspicious PG_MEM Payload Drop in PostgreSQL Data Directory (via file_event)

This rule detects the PG_MEM malware writing its pg_core loader and pg_mem payload into the PostgreSQL data directory after gaining code execution through the database. Executables written under the postgres data directory are highly abnormal and indicate compromise.

Malicious regsvr32.exe Spawned by calc.exe via DLL Side-Loading

This rule detects regsvr32.exe launched with the Windows Calculator calc.exe as its parent process. During Qbot infections the side-loaded calc.exe uses regsvr32 to register and execute the trojan payload DLL. Calculator legitimately never spawns regsvr32, so this parent-child chain is a strong indicator of DLL side-loading and proxied code execution.

Malicious LSASS Credential Dump via comsvcs.dll MiniDump by APT28 (via process_creation)

This rule detects use of rundll32 to invoke the MiniDump export of comsvcs.dll against the LSASS process, the credential-access technique documented in CERT-FR analysis of the APT28 intrusion set targeting French entities. Adversaries leverage this signed LOLBin to capture a memory dump containing plaintext and hashed credentials, making early detection critical for stopping privilege escalation and lateral movement.

Malicious XE Group thump.aspx Webshell Interaction via File Directory Parameters (via webserver)

This rule detects requests to the XE Group .thump.aspx webshell that carry the file-listing and file-read parameters the operator uses to browse and exfiltrate server files. The hidden-prefixed ASPX name combined with these directory parameters distinguishes webshell tasking from normal application traffic.

Malicious Recovery Inhibition via Shadow Copy and WinRE Tampering

This rule detects command lines that delete Volume Shadow Copies with vssadmin or disable the Windows Recovery Environment with reagentc, actions used by NOVABLIGHT to prevent system and file recovery. Inhibiting recovery is a common precursor to destructive or extortion activity.

Malicious macOS Payload Download and Execution via curl Piped to zsh

This rule detects a remote payload being downloaded with curl and immediately piped into the zsh or sh shell for execution on macOS. This loader behavior was used by the MacSync stealer and RAT documented by Huntress to fetch and run its second stage without touching disk. Piping downloaded content straight into an interpreter is a hallmark of fileless staging and warrants investigation.