Phoenix
Sigma IntelligenceBeta

Search rules

Search the full rule library from any page.

    Open navigation menuClose navigation menu
    Rule Library

    Sigma Rules

    Browse detections by severity and log source, with YAML and sample events one click away.

    3,782Total
    3,164Detection
    474Emerging
    141Hunting
    4 rulesInspect a rule without leaving your results.
    mediumtestEmerging Threat

    DarkGate - Autoit3.EXE File Creation By Uncommon Process

    Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

    windowsfile_event
    2023-10-15
    hightestEmerging Threat

    DarkGate - Autoit3.EXE Execution Parameters

    Detects execution of the legitimate Autoit3 utility from a suspicious parent process. AutoIt3.exe is used within the DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate command-and-control server.

    windowsprocess_creation
    2023-10-15
    hightestEmerging Threat

    DarkGate - User Created Via Net.EXE

    Detects creation of local users via the net.exe command with the name of "DarkGate"

    windowsprocess_creation
    2023-10-15