Sigma detection rules, expert-reviewed

Suspicious ThrottleStop Driver Abuse for Defense Evasion in Ransomware Attacks

This rule detects execution of the ThrottleStop utility which ships a vulnerable driver abused to disable endpoint protection. Ransomware operators in Japanese incidents load ThrottleStop as part of their EDR-killer tooling before encryption. Bring-your-own-vulnerable-driver tools let an actor terminate security software from kernel space.

Suspicious Local Account Creation via Net User in Pre-Ransomware Phase

This rule detects creation of a new account using net user with the add flag. Ransomware actors targeting Japanese organizations create rogue accounts such as Attacker1 for persistence before deploying encryption. New account creation during an intrusion often precedes hands-on ransomware staging.

Suspicious Scheduled Task Creation for WSPrint Persistence by UAT-9244

This rule detects creation of a scheduled task that runs at system startup, matching the WSPrint persistence used by UAT-9244. The actor registers a task to relaunch a side-loaded implant on boot under a printing service name. Startup scheduled tasks provide durable persistence across reboots.

Suspicious Script Download via Curl and PowerShell by Dohdoor

This rule detects the curl utility downloading a batch or command script over HTTP. The Dohdoor campaign uses PowerShell wrapped curl requests to stage follow-on .bat and .cmd payloads. Fetching executable scripts through curl is characteristic of malware staging.

Malicious Native IIS Module Installation via Appcmd by UAT-8099

This rule detects registration of a native IIS module using appcmd. UAT-8099 installs malicious BadIIS modules to intercept web traffic on compromised servers. Rogue IIS modules give an actor passive persistence and traffic manipulation inside the web server process.

Suspicious Hidden Local Account Creation via Net User by UAT-8099

This rule detects creation of a local account whose name ends with a dollar sign which hides it from standard enumeration. UAT-8099 creates hidden accounts such as admin and mysql with a trailing dollar sign for stealthy persistence. Hidden accounts let an actor retain access while evading routine account audits.

Suspicious Service Principal Name Enumeration via Setspn by UAT-8837

This rule detects use of setspn to query service principal names across the domain. UAT-8837 enumerates SPNs as a precursor to Kerberoasting service accounts. Harvesting SPNs allows an actor to request and crack service ticket hashes offline.

Malicious SOCKS Proxy Tunnel via Earthworm Rssocks by UAT-8837

This rule detects execution of the Earthworm tunneling tool in rssocks reverse SOCKS mode connecting outbound. UAT-8837 uses Earthworm renamed as v.ico or verr.ico to tunnel traffic into victim networks. Reverse SOCKS proxies give an actor interactive access to internal systems while evading perimeter controls.

Malicious Group Policy Preferences Credential Hunting via Findstr by UAT-8837

This rule detects use of findstr to recursively search policy files for the cpassword attribute. UAT-8837 harvests Group Policy Preferences passwords which can be decrypted with a publicly known AES key. Locating cpassword values yields reusable domain credentials for privilege escalation and lateral movement.

Suspicious Domain Controller Enumeration via Nltest by DeadLock Ransomware

This rule detects use of nltest to list domain controllers during reconnaissance. The DeadLock ransomware actors run nltest and quser to map the domain prior to lateral movement. Domain controller enumeration is an early sign of an actor preparing to spread across the network.

Malicious Disabling of Microsoft Defender Real-Time Protection via SystemSettingsAdminFlows by DeadLock Ransomware

This rule detects use of SystemSettingsAdminFlows to toggle Microsoft Defender real-time protection. The DeadLock ransomware loader invokes this living-off-the-land binary to disable endpoint protection before deploying its payload. Turning off real-time protection blinds the defender to subsequent malicious activity.

Suspicious Cloudflared Tunnel Execution for Command and Control by Kraken Ransomware

This rule detects execution of the cloudflared client to establish an outbound tunnel. The Kraken ransomware group abuses Cloudflare Tunnel together with SSHFS and RDP to maintain covert access and move laterally. Attacker use of cloudflared can bypass perimeter controls by tunneling traffic over trusted Cloudflare infrastructure.

Malicious Mass Hyper-V Virtual Machine Shutdown via PowerShell by Kraken Ransomware

This rule detects PowerShell forcibly stopping Hyper-V virtual machines by piping Get-VM into Stop-VM with the force and turnoff switches. This technique is used by the Kraken ransomware group to shut down virtualized workloads before encryption. Terminating running virtual machines unlocks their files for encryption and maximizes operational impact.

Suspicious Shadow Copy Deletion via Vssadmin by Kraken Ransomware

This rule detects deletion of Volume Shadow Copies using vssadmin with the delete shadows and all flags. This behavior is associated with the Kraken ransomware group which inhibits system recovery prior to encryption. Removing shadow copies prevents victims from restoring files without paying the ransom.

Suspicious Ransomware Fan-Out Deployment via PsExec Spread (Qilin)

This rule detects execution of a deployment tool with a spread argument used by the Qilin group to push its ransomware encryptor across hosts. Automated fan-out deployment over remote channels is a lateral-movement and impact accelerant. The spread flag distinguishes mass deployment from routine remote administration.