Sigma detection rules, expert-reviewed

Suspicious npm Postinstall Node Execution From Fixtures Path (BeaverTail OtterCookie)

This rule detects node.exe executing a script from a test fixtures eval path, the malicious npm postinstall chain used by the BeaverTail and OtterCookie malware families delivered through compromised packages. This lures developers into running staged JavaScript modules such as index.js and file15.js. Node execution from fixture directories during package installation indicates a supply-chain compromise.

Suspicious Impacket smbexec Command Execution Pattern

This rule detects the Impacket smbexec execution pattern where a command interpreter runs with the quiet and command flags, echoes a command, and redirects output to a share path ending in __output. This service-based semi-interactive shell is used for lateral movement during these ransomware attacks. The __output redirection artifact is a reliable smbexec indicator.

Suspicious Velociraptor Agent Deployment via msiexec From Cloud Storage

This rule detects silent installation of an MSI package hosted on Azure blob storage via msiexec, the delivery method used to deploy the Velociraptor DFIR tool during ransomware intrusions. Adversaries abuse Velociraptor as a covert remote-access agent. Silent MSI installs pulled directly from remote cloud URLs are a common malicious tooling delivery pattern.

Suspicious Archiving of Registry Hives via WinRAR (UAT-8099)

This rule detects use of WinRAR to compress the SAM and SYSTEM registry hives for exfiltration. UAT-8099 archives these hives to extract credentials offline from compromised IIS servers. Archiving registry hives is a collection step supporting credential access and later exfiltration.

Malicious Volume Shadow Copy Deletion via vssadmin or WMIC

This rule detects deletion of volume shadow copies via vssadmin Delete Shadows or wmic shadowcopy delete. Ransomware families in this report remove shadow copies to prevent victims from restoring encrypted files. Shadow copy deletion is a hallmark inhibit-recovery step performed during ransomware execution.

Suspicious PowerShell WebClient DownloadFile of Archive Payload (UAT-7237)

This rule detects PowerShell using the System.Net.WebClient DownloadFile method to retrieve a remote archive payload. UAT-7237 uses this technique to stage tooling including SoftEther VPN packaged as a RAR archive for persistence. Scripted downloads of archives via WebClient are a common malware staging behavior.

Malicious JuicyPotato Privilege Escalation Execution (UAT-7237)

This rule detects execution of the JuicyPotato privilege-escalation tool identified by its characteristic target, CLSID and program arguments. UAT-7237 uses a JuicyPotato variant to abuse token impersonation and escalate to SYSTEM on web hosting servers. Presence of these arguments together indicates active local privilege escalation.

Suspicious Script Host Execution of Decoy-Named JavaScript Dropper (PS1Bot)

This rule detects the Windows Script Host executing a JavaScript file named to impersonate a document, such as FULL DOCUMENT.js, delivered inside a decoy ZIP archive. PS1Bot uses this dropper to write and run obfuscated VBScript that stages further PowerShell payloads. Script host execution of document-themed .js files indicates malicious delivery.

Suspicious Security Software Uninstallation via WMIC Product Call Uninstall (Chaos Ransomware)

This rule detects use of WMIC to silently uninstall installed software via the product call uninstall method. The Chaos ransomware group leverages this to remove multi-factor authentication agents and security tooling prior to encryption. Programmatic uninstallation of defensive software is an impair-defenses technique that precedes impact.

Suspicious OpenSSH Reverse Tunnel Over HTTPS Port (Chaos Ransomware)

This rule detects use of the OpenSSH client to establish a reverse tunnel with the -R option forwarding traffic over port 443. The Chaos ransomware group abuses OpenSSH reverse tunneling to blend remote access and command-and-control into HTTPS traffic. Reverse tunnels over common web ports are used to evade network monitoring and maintain covert access.

Malicious Remote Encryptor Execution via WMIC Process Call Create (Chaos Ransomware)

This rule detects the Chaos ransomware group using WMIC to remotely spawn its encryptor binary with campaign-specific arguments such as lkey, encrypt_step and work_mode. Remote process creation over WMI is used to deploy the encryptor across the network. This behavior indicates active ransomware deployment combined with lateral movement.

Suspicious SharePoint Worker Process Spawning Command Interpreter via ToolShell

This rule detects the IIS worker process w3wp.exe spawning a command interpreter such as cmd.exe or PowerShell on a SharePoint server. This behavior is associated with ToolShell exploitation of SharePoint (CVE-2025-53770) leading to remote code execution and webshell deployment. Command interpreter execution under the SharePoint worker process indicates active exploitation and hands-on-keyboard activity.

Suspicious Python Interpreter Launching Encoded PowerShell via subprocess

This rule detects a Python process spawning PowerShell with an encoded command, the behavior of the checkbalance.py component in this Emmenhtal and Amadey MaaS operation that uses subprocess.run to execute obfuscated PowerShell. A Python-to-encoded-PowerShell parent-child relationship is unusual on endpoints and indicates scripted payload execution.

Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell

This rule detects wscript.exe or cscript.exe executing a .js file and spawning PowerShell with an encoded command. The Emmenhtal loader used in this MaaS operation against Ukrainian entities runs JavaScript such as Work.js via WScript.Shell to launch encoded PowerShell that fetches the Amadey payload, so this script-to-encoded-PowerShell chain is the core delivery behavior.

Suspicious Rclone Exfiltration Masquerading as wininit.exe

This rule detects a process named wininit.exe running with Rclone-style cloud transfer arguments such as copy with remote configuration flags. Talos IR observed the Rclone exfiltration binary renamed to wininit.exe to blend with a legitimate system process while bulk-copying victim data to attacker cloud storage, so this Image and command-line mismatch flags staged exfiltration.