Sigma detection rules, expert-reviewed

Malicious SYSTEM Persistence via Scheduled Task Running rundll32 at Startup (via process_creation)

This rule detects schtasks creating a SYSTEM-context ONSTART task whose action is rundll32 executing an exported function from a DLL in a public writable directory, the persistence mechanism used in the Cobalt Strike SOCKS LockBit intrusion. Adversaries chain a boot-triggered scheduled task with a rundll32 DLL export to reload their loader as SYSTEM after reboot, so this combination is a strong persistence and defense-evasion signal.

Malicious Veeam CVE-2023-27532 Exploitation Enabling xp_cmdshell via VeeamHax (via process_creation)

This rule detects the VeeamHax exploit tool targeting the Veeam Backup service credential flaw CVE-2023-27532 and driving the backup SQL instance to enable and run xp_cmdshell for privileged command execution. In the more_eggs TA4557 intrusion this abuse created rogue local accounts through sp_configure and master xp_cmdshell, so VeeamHax invoking these SQL statements against port 9401 is a direct exploitation and privilege-escalation signal.

Malicious AdFind Domain Trust Enumeration via Trustdmp

This rule detects AdFind querying domain trust attributes through the trustdmp shortcut which the OneNote intrusion used to map trust relationships for onward movement and this matters because the trustdmp query is specific to attacker reconnaissance of domain trusts and has no routine administrative use.

Malicious Rundll32 Executing Image File as DLL

This rule detects rundll32.exe being pointed at a file with an image extension such as jpg and invoking an export which the OneNote to ransomware actor used to run an IcedID payload disguised as a picture and this matters because a picture file being loaded as a DLL by rundll32 is a reliable masquerading indicator with no legitimate equivalent.

Malicious Script Host Spawning PowerShell in Gootloader Chain

This rule detects the Windows script hosts wscript or cscript launching PowerShell which mirrors the Gootloader execution chain that moved from a scheduled task through script hosts into a PowerShell payload and this matters because a script host spawning PowerShell is a classic fileless loader pattern used by Gootloader and similar JavaScript droppers.

Malicious Data Exfiltration to MEGA via Rclone

This rule detects the rclone utility copying data to a remote with a high multi thread stream count as performed during the Trigona intrusion to exfiltrate files to MEGA cloud storage before encryption and this matters because bulk rclone transfers to cloud remotes are a common precursor to double extortion ransomware and are uncommon in normal endpoint activity.

Malicious Service Created With Binary Path in ProgramData

This rule detects creation of a Windows service whose binary path points into ProgramData as used by the persistent actor to install a masqueraded svchost service for durable execution and this matters because legitimate services almost never run from ProgramData and a service pointing there reflects an attacker establishing SYSTEM level persistence.

Malicious Volume Shadow Copy Deletion for Ransomware Recovery Inhibition

This rule detects deletion of volume shadow copies and disabling of Windows recovery through vssadmin wmic and bcdedit as performed prior to Hive ransomware encryption and this matters because destroying shadow copies and recovery options immediately before mass file encryption is a defining behavior of ransomware impact and rarely legitimate on production systems.

Malicious WMIexec Style Command Output Redirection to Local Admin Share

This rule detects the wmiexec remote execution pattern where a command shell redirects its output to the local ADMIN dollar share over the loopback address as observed in the Hive intrusion during lateral movement and this matters because legitimate administration does not stage command output to a loopback SMB admin share and this behavior is characteristic of impacket style remote execution.

Malicious Renamed Rundll32 Copied to Temp via Xcopy

This rule detects xcopy copying the legitimate rundll32.exe binary into a user temp directory under a renamed filename as seen in the HTML smuggling IcedID intrusion that led to domain wide ransomware where the actor proxied execution of a malicious DLL through a renamed system binary and this matters because a renamed signed loader staged in temp is a strong indicator of defense evasion and hands on keyboard staging.

Malicious Cobalt Strike Default Named Pipe Activity

This rule detects creation of named pipes matching Cobalt Strike default post exploitation and agent conventions which the BlackSuit intrusion relied on for SMB beacon communication and this matters because these pipe name patterns are strongly associated with Cobalt Strike beacons performing lateral tasking and are a high value signal of active post exploitation.

Malicious DLL Sideloading via consent.exe Loading msimg32.dll (via image_load)

This rule detects the trusted consent.exe binary loading msimg32.dll from a non-System32 location which indicates DLL search-order sideloading. Bumblebee abused this to run malicious code under a signed Windows process. Sideloading into a trusted binary evades signature and reputation controls.

Malicious Bumblebee DLL Sideload of msimg32 by consent from Non-System Path (via image_load)

This rule detects the trusted Windows consent binary loading an msimg32 DLL from outside the System32 directory, the DLL-sideloading technique that launched Bumblebee from a trojanized ManageEngine installer in the Akira intrusion. Adversaries place a malicious msimg32 next to a signed binary so their loader runs under a trusted process, so a consent process loading msimg32 from a user or program path is a strong sideloading indicator.

Malicious GPO Logon Script Planted in SYSVOL Group Policy Path

This rule detects creation of a batch or script file inside the Group Policy user logon scripts path which the IcedID to Dagon Locker actor used to abuse a domain GPO for organization wide code execution at logon and this matters because writing a logon script into the Group Policy scripts folder can execute across every affected user and is a powerful domain wide deployment mechanism.

Malicious Langflow Build Public Temp RCE Access via Webserver

This rule detects POST requests to the Langflow build_public_tmp flow endpoint exploited by CVE-2026-55255 to achieve unauthenticated remote code execution. Attackers chain an IDOR on the responses endpoint with this build path to run arbitrary flows. Requests to this endpoint from untrusted sources indicate active exploitation of the exposed Langflow instance.