Sigma detection rules, expert-reviewed

Malicious Shadow Copy Deletion and Recovery Inhibition via process_creation

This rule detects the destruction of volume shadow copies and disabling of Windows recovery options, a hallmark of WannaCry and other ransomware families. The activity removes backups via vssadmin and wmic, disables boot recovery via bcdedit, or deletes the backup catalog via wbadmin to prevent victim recovery. This behavior almost always precedes or accompanies file encryption and warrants immediate response.

Suspicious Print Filter Pipeline Host Running Outside System32 via Process Creation

This rule detects the print filter pipeline host binary printfilterpipelinesvc executing from any path other than System32 which reflects a WinSxS directory masquerade used by an in the wild Windows local privilege escalation exploit to run code under a trusted system process name. The legitimate binary only runs from System32 so execution elsewhere signals a masquerade.

Suspicious Script Host Spawning PowerShell via Process Creation

This rule detects the Windows script host wscript or cscript launching PowerShell which mirrors the PIKABOT delivery chain where an obfuscated JavaScript file spawns PowerShell to download the loader. This parent child relationship is a frequent indicator of scripted phishing payloads executing.

Suspicious PIKABOT PowerShell Download to Public Directory via Process Creation

This rule detects PowerShell using Invoke-WebRequest to download an executable into the public users directory which is the delivery step of the PIKABOT infection chain after an obfuscated script launches PowerShell. Fetching a payload directly into a world-writable path is a common malware staging behavior.

Malicious Credential Hive Dump via Reg Save

This rule detects use of reg save to export the SAM registry hive which the REF0657 intrusion used to steal local account password hashes for offline cracking. Saving the SAM hive is a credential access action with no benign use case in normal administration.

Malicious Windows Event Log Clearing via Wevtutil

This rule detects use of wevtutil to clear Windows event logs which the REF0657 actors performed against the System and Security logs to destroy evidence of their activity. Clearing event logs is a deliberate anti-forensic action that rarely has a legitimate operational reason.

Malicious SQL Server Command Execution Spawning Download Utilities via Process Creation

This rule detects the SQL Server service process spawning download capable utilities such as certutil bitsadmin powershell or cmd which in the REF0657 financial services intrusion followed xp_cmdshell abuse to pull tooling onto a compromised database server. The database engine launching these binaries indicates command execution through SQL and should not occur in normal operation.

Malicious UAC Bypass via Eventvwr Execution Hijack via Process Creation

This rule detects the Event Viewer binary spawning a child process other than the Microsoft Management Console which indicates a registry hijack UAC bypass abusing the eventvwr auto-elevation to run an attacker controlled elevated process. Filtering the expected mmc child keeps focus on the abusive execution.

Malicious UAC Bypass via Fodhelper or ComputerDefaults Execution Hijack via Process Creation

This rule detects child processes spawned by the auto-elevating fodhelper or computerdefaults binaries which is the hallmark of a registry based UAC bypass where an attacker hijacks the shell open command to launch an elevated process without a consent prompt. Any child of these settings handlers should be treated as suspicious elevation.

Suspicious GPG Decryption of Downloaded Payload via GPG

This rule detects batch mode GPG decryption on Windows endpoints which GHOSTPULSE uses to decrypt a downloaded tar gpg payload with a preset passphrase supplied on a file descriptor. Non-interactive gpg decrypt invocations are uncommon on typical workstations and here signal payload staging and defense evasion.

Malicious REF5961 PsExec-Style Remote Service Execution from Windows Help Directory via Process Creation

This rule detects PsExec-style remote execution that runs a payload as a service from the Windows help directory as seen in the REF5961 intrusion set deploying RUDEBIRD, where an actor uses the accepteula system service flags together with a help directory path to move laterally and run code under a masqueraded location for stealth.

Malicious PIPEDANCE Named Pipe Command and Control Channel via Pipe Created

This rule detects creation of the hardcoded PIPEDANCE named pipe used as an inter-process SMB command and control channel where the pipe name doubles as the RC4 key u0hxc1q44vhhbj5oo4ohjieo8uh7ufxe. PIPEDANCE uses this pipe to relay operator commands for shellcode injection and token hijacking so its presence indicates active backdoor communication.

Suspicious Outbound Network Connection from explorer.exe

This rule detects explorer.exe initiating an outbound network connection to an external host, anomalous behavior consistent with the DOUBLELOADER backdoor injecting into explorer.exe and beaconing to command-and-control. explorer.exe does not normally make direct external connections, so this pattern indicates process injection and covert C2.

Suspicious Network Connection from fsutil or Defender Client via network_connection

This rule detects outbound network connections from fsutil.exe or the Defender client rmclient.exe, processes that do not normally initiate network traffic. The REMCOS watchdog component injects into these binaries to maintain a covert command-and-control channel. Such connections indicate likely process injection and should be investigated.

Malicious Libcurl DLL Side-Loading by Paint Backdoor (via image_load)

This rule detects the BRUSHWORM paint.exe backdoor side-loading a malicious libcurl.dll from a non-standard directory. Observed in Elastic Security Labs analysis where DLL search order hijacking of libcurl.dll executes attacker code under a benign-looking process against financial services.