Sigma detection rules, expert-reviewed

Suspicious .NET LOLBin Execution via CasPol or RegAsm

This rule detects execution of the .NET Framework utilities CasPol.exe or RegAsm.exe spawned by a script interpreter. Batch and PowerShell loaders abuse these signed developer tools to load and run reflectively decrypted assemblies while bypassing application control.

Suspicious PowerShell Execution via Forfiles LOLBIN

This rule detects the forfiles utility used to spawn PowerShell, an indirect execution technique that breaks parent-child telemetry. Malicious LNK campaigns use forfiles to proxy execution of PowerShell payloads. Interactive use of forfiles to launch PowerShell is uncommon and suspicious.

Suspicious ClickFix RunMRU Entry Recording LOLBIN Command from Run Dialog

This rule detects RunMRU registry values that capture LOLBIN commands such as powershell, mshta, rundll32, or msbuild pasted into the Windows Run dialog. Microsoft describes this as the core artifact of the ClickFix social engineering technique that tricks users into executing attacker commands. A scripting or proxy binary launched from the Run dialog is rare for legitimate users, so these entries flag the user-driven execution step.

Suspicious RunMRU Entry Launching LOLBIN via ClickFix Run Dialog

This rule detects RunMRU registry values that record LOLBIN commands such as powershell or mshta typed into the Windows Run dialog. Microsoft observed Lumma Stealer ClickFix campaigns instructing victims to paste these commands, leaving artifacts in the RunMRU key. A scripting LOLBIN executed from the Run dialog is unusual for normal users and reveals the social engineering execution step.

Suspicious MSBuild Execution as LOLBin from User-Writable Path (via process_creation)

This rule detects MSBuild.exe compiling or executing a project located in a user-writable directory rather than a development workspace. Macaw ransomware abuses MSBuild as a signed living-off-the-land binary to run inline C2 tasks and evade application controls. MSBuild driven from Temp or AppData outside of a build pipeline is a defense-evasion indicator.

Suspicious mshta Execution Proxied Through pcalua LOLBIN

This rule detects the Program Compatibility Assistant (pcalua.exe) launching mshta.exe, matching the ClickFix execution chain of the Potemkin loader and RMMProject campaign. Adversaries abuse pcalua as a signed proxy to spawn mshta and run remote HTA or script payloads while evading parent-child heuristics. This chain initiates loader delivery and follow-on remote access tooling.

Suspicious Payload Retrieval via finger LOLBin

This rule detects execution of finger.exe, a living-off-the-land binary abused to retrieve remote payloads in a Huntress-observed ClickFix campaign delivering CastleLoader. The lure tricks users into pasting a clipboard command that uses finger.exe to pull attacker content. Because finger.exe is essentially unused on modern Windows, its execution is a strong indicator of malicious download activity.

Malicious Registry Hive Theft from Shadow Copy via Print LOLBIN

This rule detects print.exe copying files from a volume shadow copy device path referencing GLOBALROOT, HarddiskVolumeShadowCopy, or a @GMT snapshot UNC path, a LOLBIN abuse technique documented by Huntress for stealing SAM and SYSTEM hives. Attackers use the print utility to read locked credential stores from a shadow copy without triggering hive-export tooling. This file-copy pattern via print.exe is highly anomalous and indicates credential-store theft.

Suspicious Download or Exfiltration via Finger LOLBin

This rule detects execution of the legacy finger client, an uncommon living-off-the-land binary that attackers repurpose to download payloads and exfiltrate data over the finger protocol. Its use in modern Windows environments is almost always malicious. Finger-based transfers move data across the network while blending with rarely inspected protocol traffic.

Suspicious CAB Extraction via extrac32 LOLBin

This rule detects extrac32 being used to extract cabinet archive contents, a living-off-the-land technique observed in a Lumma infostealer campaign that used extrac32 to unpack a CAB file masquerading as a document during payload staging. It captures abuse of a signed Windows utility to unpack malicious archives. Detecting this is important because extrac32 is rarely used interactively and its appearance in an attack chain often indicates covert payload deployment.

Suspicious CloudZ RAT Loader Execution via regasm.exe LOLBin

This rule detects the regasm.exe LOLBin executing against content staged under ProgramData, matching the CloudZ RAT which abuses regasm to load a dropped .NET assembly outside developer workflows. Legitimate use of regasm operates on assemblies in build or install directories, not ProgramData staging folders. Execution from this location signals proxied malicious code loading.

Suspicious PowerShell Execution via SyncAppvPublishingServer LOLBIN

This rule detects abuse of the signed SyncAppvPublishingServer.vbs script to proxy execution of PowerShell, a technique used in the GuLoader to Remcos infection chain. The LNK lure invokes this LOLBIN to run obfuscated PowerShell that stages shellcode. Detecting the script use surfaces the proxied execution step of the chain.

Uncommon File Download via Uncommon LOLBIN (via process_creation)

This rule detects file-download abuse of lesser-known living-off-the-land binaries such as certreq -Post, desktopimgdownldr lockscreenurl and finger, which retrieve remote content while blending into signed Windows tooling. Ingress tool transfer via LOLBINs is a technique tracked in the Red Canary Threat Detection Report. Detecting these invocations surfaces payload retrieval that evades naive download monitoring.

Suspicious Code Compilation via Aspnet_compiler LOLBIN (via process_creation)

This rule detects aspnet_compiler.exe being executed to compile and run arbitrary code, a signed-binary proxy technique used by AsyncRAT and similar tooling to build a payload in place while evading application allowlisting. Aspnet_compiler abuse is a defense-evasion technique in the Red Canary Threat Detection Report. Detecting this rarely-interactive binary surfaces trusted-utility code execution.

Suspicious DLL Execution via Odbcconf LOLBIN (via process_creation)

This rule detects odbcconf.exe registering or executing a DLL through its regsvr action or a response file, a signed-binary proxy technique used to run attacker code past application allowlisting. Odbcconf abuse has appeared in Raspberry Robin activity profiled in the Red Canary Threat Detection Report. Detecting these invocations surfaces trusted-binary DLL execution.