Sigma detection rules, expert-reviewed

Suspicious Remote MSI Package Installation via msiexec (via process_creation)

This rule detects msiexec installing a package directly from a remote HTTP or HTTPS URL, a living off the land staging technique used in campaigns that abuse alternative runtimes where the remote MSI drops VBScript and PowerShell loaders. Silent installation of a package from a remote web address is unusual outside of controlled software deployment.

Malicious rundll32 Execution of Lazarus JavaPackage DLL (via process_creation)

This rule detects rundll32.exe executing a DLL from the ProgramData Oracle Java path via the VpnUserInterface export, the loader used in a Lazarus social engineering initial access chain. The masqueraded Java path combined with the VpnUserInterface export is a specific implant artifact. This proxies malicious code through a signed binary to establish a foothold for follow-on tasking.

Malicious Run Key Persistence NvmProtocal Launching NodePackages Payload

This rule detects an autorun Run key named NvmProtocal or one referencing the NodePackages protocal.cjs payload, the Windows persistence dropped by the Mastra npm supply chain compromise. The misspelled Node branding launches PowerShell or Node from ProgramData at logon to maintain access after the malicious package installs.

Malicious Password Filter Registration via LSA Notification Packages

This rule detects registration of a rogue password filter DLL named passms in the LSA Notification Packages registry value, seen in a stealthy third-party supply chain intrusion. A malicious password filter receives every password change in cleartext, giving the attacker durable credential access across the domain.

Suspicious npm Package Spawning cURL Download via Process Creation

This rule detects an npm or node process spawning curl to fetch a remote payload, a supply chain execution technique in which Moonstone Sleet distributed malicious npm packages that pulled the SplitLoader malware during install. A package manager launching a download utility is unusual and can indicate a trojanized dependency.

Malicious MSIX Package Execution via App Installer ms-appinstaller Protocol (via process_creation)

This rule detects the Windows App Installer binary launching a remote MSIX package through the ms-appinstaller protocol handler and ServerName argument. Financially motivated actors abused this vector to deliver BATLOADER and Cobalt Strike while bypassing SmartScreen.

Suspicious Malicious MCP Package devtools-assistant Execution (via process_creation)

This rule detects installation or execution of the devtools-assistant package a trojanized MCP server used in a supply-chain attack against AI development tooling. Once run it enumerates and exfiltrates developer credentials from files such as .env .aws and .ssh. Catching the pip install or python module invocation flags the compromise at the point of execution.

Suspicious Node Package Install Spawning Script Interpreters via process_creation

This rule detects node.exe spawning cscript, wscript, or powershell child processes. The compromised axios npm package ran a setup.js install script that chained into Windows script hosts and PowerShell to fetch and execute the next stage, so a Node process launching these interpreters indicates a malicious package post-install execution chain.

Malicious DeadBolt Persistence via QNAP Update Package Overwrite

This rule detects modification of the SDDPd.bin file inside the QNAP update package directory which DeadBolt ransomware overwrites to persist and control the device boot sequence. Hijacking this autostart component keeps the ransom logic resident across reboots. It matters because it embeds attacker control deep in the appliance firmware path.

Malicious LSA Password Filter Registration via Notification Packages

This rule detects modification of the LSA Notification Packages registry value to register a rogue password filter DLL such as sasetup.dll. Operation FishMedley abused this mechanism to capture plaintext passwords during password change events via the PasswordChangeNotify export. Password filters run inside LSASS and let attackers persistently intercept credentials as users change them.

Suspicious APT Or YUM Package Manager Hook Configuration Created

This rule detects creation of configuration files in the APT or YUM package manager hook directories which adversaries abuse to execute arbitrary commands whenever the package manager runs. Planting a hook under apt.conf.d or the yum plugin configuration grants stealthy privileged persistence tied to routine system maintenance.

Malicious Msiexec Execution of Staged Update Package via Process Creation

This rule detects msiexec.exe executing the update_ms.msi package staged in ProgramData, the installer proxy-execution step that loads the msaRAT lib.dll RUN export as reported by Cisco Talos in the Chaos ransomware campaign. Running a fetched MSI from ProgramData under msiexec launches the covert browser C2 implant. Detecting this execution catches proxy execution of the malicious installer after ingress.

Possible Aspera Faspex Pre-Auth RCE via YAML Deserialization in package_relay (via webserver)

This rule detects POST requests to the Aspera Faspex package_relay relay_package endpoint, the injection point for a pre-auth RCE where the external_emails field carries a serialized YAML payload deserialized by YAML.load. Attackers abuse this Ruby on Rails unsafe deserialization to execute arbitrary commands. Detecting it surfaces exploitation attempts against internet-facing Faspex servers.

Malicious Msiexec Installation of a Remote MSI Package (via process_creation)

This rule detects msiexec.exe installing a package directly from a remote HTTP or UNC location, a System Binary Proxy Execution pattern used to fetch and run attacker-controlled installers under a signed Microsoft binary. This LOLBin abuse appears in the Red Canary Threat Detection Report as a way to bypass application allowlisting and deliver second-stage payloads. Detecting remote msiexec installs surfaces the proxy-download-and-execute behavior.

TerraStealerV2 Data Staging in Bay0NsQIzx Package Directory (via file_event)

This rule detects TerraStealerV2 staging collected browser and wallet data inside the hardcoded Bay0NsQIzx package directory under LocalAppData before archiving it for exfiltration. Adversaries leverage a fixed staging folder to consolidate stolen artifacts, making file writes into this named directory a high-confidence collection indicator.