Sigma detection rules, expert-reviewed

Malicious AMSI Bypass via PowerShell Reflection (via ps_script)

This rule detects PowerShell attempting to disable the Antimalware Scan Interface by patching AmsiUtils fields such as amsiInitFailed. The ClearFake variant runs an AMSI bypass before decrypting its AES payload so in-memory scanning is suppressed. Manipulating AMSI internals from a script is a strong signal of malicious execution.

Malicious TeamPCP durabletask Infection Markers and Rope State (via file_event)

This rule detects the .sys-update-check cache infection markers and the .rope_state SSM instance state file written by the trojanized durabletask PyPI payload to track infection and staged AWS SSM targets. These fixed hidden files indicate the TeamPCP implant is installed and enumerating cloud resources.

Suspicious BunnyLoader Keylog Capture File in AppData Temp (via file_event)

This rule detects creation of files matching the ADE_ prefix text file pattern in the local AppData Temp directory, the naming scheme BunnyLoader uses to stage captured keystrokes before exfiltration. Writing keylog output under this predictable path reflects the loader collection module in operation, marking active credential and data theft.

Suspicious Bad Apples File Transfer Server via tftpd

This rule detects tftpd launched with the write-enabled flag, matching the Bad Apples abuse of the native TFTP daemon on UDP 69 to stage and move payloads onto macOS hosts. Enabling writes on an ad hoc TFTP server turns a benign utility into an ingress channel for tooling. A user or service starting a writable tftpd is unusual and warrants review.

Malicious Chrome Extension Sideload via --load-extension from User-Writable Path (via process_creation)

This rule detects a Chromium-based browser launched with the --load-extension flag pointing to a user-writable AppData or Public directory. The Ducktail campaign drops a malicious extension into the Chrome User Data folder and injects it through a LNK shortcut using --load-extension to steal session cookies and hijack business accounts, so this command line indicates unauthorized extension loading.

ResolverRAT Loader DLL Sideloading via hpreader (via image_load)

This rule detects the legitimate signed hpreader.exe loading a DLL from a user-writable directory, the DLL sideloading behavior used by the ResolverRAT loader to reflectively execute its .NET payload in memory under a trusted process. Adversaries leverage sideloading against a signed binary to run malicious code with a benign parent, making early detection critical for surfacing the loader before registry persistence and encrypted C2 are established.

SharePoint ToolShell Exploitation via ToolPane.aspx DisplayMode Edit (via webserver)

This rule detects requests to the SharePoint ToolPane.aspx endpoint with the DisplayMode Edit parameter, the exploitation vector for the ToolShell chain CVE-2025-53770 and CVE-2025-53771 that abuses Referer header handling to reach authenticated functionality without authentication. Adversaries use this request to deploy a webshell and steal ASP.NET machine keys.

Malicious Network Login Performed to Multiple Targets (via security)

This rule detects would attempt to enumerate hosts resources and execute a payload with a compromised account. Vulnerability scanners, enumeration software or tool like SharepHound/CrackMapexec may generate such behavior.

Suspicious LaunchDaemon Load via launchctl

This rule detects loading and enabling of a launchd job via launchctl with the -w flag. This behavior matches macOS lateral movement and persistence tradecraft where attackers install malicious plist based services to maintain access. While used by legitimate administration, unexpected launchctl load activity on endpoints can indicate persistence installation and should be reviewed.

Data Exfiltration to WebDAV Share via curl Upload

This rule detects curl uploading a file to a remote WebDAV endpoint using the upload flag. RedCurl uses this method to stage stolen data and logs to attacker controlled Nextcloud style cloud storage.

Possible Hive0051 GammaLoad C2 Beacon via Crafted User-Agent (via proxy)

This rule detects the distinctive User-Agent string used by Hive0051 GammaLoad implants for victim profiling during command-and-control. The agent appends a host token followed by an eight-character uppercase hex identifier and a keyword delimited by repeated semicolons and slash-dot sequences. This structure does not occur in standard browser traffic.

Suspicious Network Download Spawned by Node.js During Package Install

This rule detects the Node.js process spawning a download utility or command interpreter during an npm package install which the Stressed Pungsan campaign abuses through a malicious preinstall hook to fetch a second stage payload onto developer machines.

Possible ERMAC or Hook Android Malware C2 via PHP Endpoint URI Pattern

This rule detects HTTP requests to the distinctive /php/<token>.php/ URI structure used by the ERMAC and Hook Android banking malware families for encrypted command-and-control. The trailing-slash PHP endpoint carrying an AES and Base64 encoded body is a reliable network fingerprint of these C2 channels.

Suspicious Remote UAC Restriction Disabled via LocalAccountTokenFilterPolicy (via process_creation)

This rule detects a reg add command setting LocalAccountTokenFilterPolicy to 1, which disables remote UAC token filtering and grants full administrative access over the network to local accounts. Akira ransomware operators set this value to enable lateral movement with local administrator credentials.

Malicious COM Hijack of PSFactoryBuffer InprocServer32

This rule detects modification of the InprocServer32 value under the CLSID {1299CF18-C4F5-4B6A-BB0F-2299F0398E27} PSFactoryBuffer key in the per-user registry hive, a COM hijack used by RomCom for persistence and execution after WinRAR exploitation. Redirecting this COM server class to an attacker DLL causes malicious code to load when the COM object is instantiated.