Sigma detection rules, expert-reviewed

Suspicious IP Release and Renew via Minimized cmd During Driver Install

This rule detects a minimized cmd shell chaining ipconfig /release and /renew, a network-flap trick ValleyRAT performs to mask connectivity loss while it installs its stealth kernel driver. The minimized-window start combined with a release-then-renew sequence in one command is anomalous and points to the rootkit installation routine.

Malicious ValleyRAT RuntimeBroker Masquerade in RunTime Directory

This rule detects execution of RuntimeBroker.exe from C:\Program Files\RunTime, a masquerading location used by the Silver Fox APT to deploy its ValleyRAT loader. The legitimate RuntimeBroker.exe lives in System32, so a same-named binary under a RunTime folder is a trusted-name wrong-context indicator of the ValleyRAT dropper.

Suspicious Execution of Dotnet Injection Target Utilities

This rule detects execution of InstallUtil, AddInProcess32, or CasPol outside of a development context, the signed dotnet utilities abused as injection hosts by the PureHVNC loader from the fake Kling AI site. The loader hollows these trusted binaries to run its RAT payload. Detecting unexpected launches exposes process injection into living off the land binaries.

Malicious Shadow Copy Deletion via vssadmin

This rule detects vssadmin deleting all volume shadow copies quietly, an inhibit recovery step in the FunkSec ransomware chain. Removing shadow copies prevents victims from restoring encrypted files. Detecting it exposes recovery sabotage that typically precedes encryption.

Malicious Security Event Log Disabled via wevtutil

This rule detects wevtutil disabling the Security event log channel, a logging impairment used by FunkSec ransomware to hide its actions. Disabling the Security log blinds defenders to subsequent malicious activity. Detecting the command surfaces anti forensic behavior on the host.

Malicious Defender Real Time Monitoring Disabled via Set-MpPreference

This rule detects PowerShell disabling Microsoft Defender real time monitoring through Set-MpPreference, an impairment step in the FunkSec ransomware routine. Turning off real time protection lets the encryptor and its tools run without interference. Detecting the command exposes defense evasion before encryption.

Malicious BugSleep Scheduled Task Persistence with Sample Comment

This rule detects creation of a scheduled task carrying the literal description sample comment, a fingerprint of the BugSleep backdoor deployed by MuddyWater. The malware registers a task named after its mutex with this hardcoded comment and a thirty minute trigger. Detecting the constant comment string exposes the backdoor persistence.

Suspicious PowerShell Execution via SyncAppvPublishingServer LOLBIN

This rule detects abuse of the signed SyncAppvPublishingServer.vbs script to proxy execution of PowerShell, a technique used in the GuLoader to Remcos infection chain. The LNK lure invokes this LOLBIN to run obfuscated PowerShell that stages shellcode. Detecting the script use surfaces the proxied execution step of the chain.

Suspicious Execution of spools.exe from Public Directory

This rule detects execution of a binary named spools.exe from the C-Users-Public directory, a masquerade of the Windows print spooler dropped by the IndigoZebra APT. Placing a spooler lookalike in a world writable public path is a strong sign of the group dropper. This catches the staged payload before it establishes persistence.

Suspicious Scheduled Task Masquerading As OneDrive (via process_creation)

This rule detects creation of a scheduled task named OneDrive whose action does not point to the legitimate OneDrive installation, a persistence masquerade used in the Stayin Alive campaign. Reusing a trusted product name for a task that launches a binary from an unexpected path is a common way to blend implant persistence into normal telemetry.

Malicious NTDS.dit Extraction via Ntdsutil (via process_creation)

This rule detects ntdsutil creating an Install From Media snapshot of the Active Directory database, the domain credential theft step used in Rhysida ransomware intrusions. Dumping NTDS.dit exposes every domain hash and is a high-severity precursor to full domain compromise.

Suspicious Event Log Clearing via Wevtutil (via process_creation)

This rule detects wevtutil being used to clear Windows event logs, an anti-forensic step used by the Rorschach ransomware to erase traces of its activity. Bulk clearing of event logs is uncommon in normal administration and often accompanies destructive or ransomware operations.

Malicious Shadow Copy and Backup Catalog Deletion (via process_creation)

This rule detects deletion of volume shadow copies or the backup catalog through vssadmin, wmic, or wbadmin, an inhibit-recovery action executed by the Rorschach ransomware. Removing shadow copies and backups prevents victims from restoring encrypted files and is a defining ransomware behaviour.

Malicious Boot Recovery Disabled via Bcdedit (via process_creation)

This rule detects bcdedit disabling boot recovery or ignoring boot failures, an inhibit-recovery step performed by the Rorschach ransomware before encryption. Tampering with the boot configuration to block Windows recovery is a hallmark of ransomware preparing to deny system restoration.

Suspicious AppLaunch.exe Spawned As Injection Target (via process_creation)

This rule detects the .NET AppLaunch.exe utility being spawned as a standalone process, the hollowing target Rhadamanthys injects its stealer payload into. AppLaunch is rarely launched directly outside of a Visual Studio debugging context, so its creation by non-developer parents suggests process injection.