Sigma detection rules, expert-reviewed

Suspicious Rclone Exfiltration Masquerading as wininit.exe

This rule detects a process named wininit.exe running with Rclone-style cloud transfer arguments such as copy with remote configuration flags. Talos IR observed the Rclone exfiltration binary renamed to wininit.exe to blend with a legitimate system process while bulk-copying victim data to attacker cloud storage, so this Image and command-line mismatch flags staged exfiltration.

Malicious Volume Shadow Copy Deletion via vssadmin

This rule detects vssadmin deleting volume shadow copies, an inhibit-recovery action performed in Talos IR ransomware engagements immediately before encryption. Removing shadow copies prevents victims from restoring files and is a near-universal precursor to ransomware detonation.

Suspicious Security Product Uninstall via wmic product call uninstall

This rule detects wmic being used to enumerate a product and invoke call uninstall, the technique Talos IR observed removing the Duo multi-factor agent to weaken defenses before ransomware deployment. Programmatic uninstallation of security or MFA software via WMI is a defense-evasion step that clears obstacles to lateral movement and encryption.

Malicious Renamed Python Interpreter Executing nvidia.py RAT

This rule detects a Python interpreter executing a script named nvidia.py, the Python GolangGhost RAT payload run by Famous Chollima after a VBScript unpacks and renames the interpreter. The nvidia.py filename masquerades as GPU tooling while providing RC4-encrypted HTTP command-and-control and credential theft.

Suspicious PowerShell Download of lib.zip Archive

This rule detects PowerShell using Invoke-WebRequest or curl to download an archive named lib.zip. Famous Chollima's Python GolangGhost RAT chain fetches this archive, which is then unpacked and used to launch a renamed Python interpreter, so this ingress step precedes RAT execution and Run-key persistence.

Suspicious sha256sum.exe Execution from Windows Temp Directory

This rule detects a binary named sha256sum.exe executing from C:\Windows\Temp, the masqueraded filename PathWiper used for its wiper component. A legitimate-sounding hashing utility running from Windows Temp rather than a standard install location is the destructive payload disguised to evade casual inspection before it overwrites NTFS structures.

Malicious PathWiper Loader Script Execution from Windows Temp via WScript

This rule detects wscript.exe executing uacinstall.vbs from the C:\Windows\Temp directory, the loader stage of the PathWiper wiper used against Ukrainian critical infrastructure. A VBScript with this name running from Windows Temp is the delivery vehicle that drops and launches the destructive wiper payload.

Suspicious Free Space Wipe via cipher.exe

This rule detects cipher.exe invoked with the /w switch to overwrite unallocated disk space, an anti-recovery action used by the fake AI-tool installer ransomware to prevent carving of deleted originals. Wiping free space alongside encryption inhibits data recovery and signals destructive intent on the host.

Malicious IIS Worker Process Spawning Command Shell Reconnaissance

This rule detects the IIS worker process w3wp.exe spawning cmd.exe or powershell.exe to run host reconnaissance such as ipconfig, tasklist or dir. UAT-6382 exploited a Cityworks zero-day to drop web shells and then executed this recon under the web server context, a hallmark of post-exploitation web-shell activity that precedes tooling download and Cobalt Strike deployment.

Suspicious NFe-Themed Brazilian Lure Executable Execution

This rule detects execution of NFe (Nota Fiscal) invoice-themed droppers such as AGENT_NFe, Boleto_NFe or NOTA_FISCAL_NFe executables that carry a random suffix. This Brazil-focused spam campaign delivered these lures via Dropbox to trick recipients into launching them, after which trial-account RMM software is installed to grant the operator remote access.

Malicious Local Account Creation of Support or Whiteninja via net.exe

This rule detects creation of the local accounts support or whiteninja using net user add, the backdoor accounts provisioned by the ToyMaker access broker after gaining a foothold. Attacker-created local accounts give the operator a persistent, credentialed re-entry path that survives reboots and is later reused by the double extortion crews ToyMaker sells access to.

Malicious Scheduled Task Masquerading as GoogleUpdate Launching SSH Reverse Shell

This rule detects creation of a scheduled task named GoogleUpdateTaskMachine whose action invokes OpenSSH to establish a reverse shell. The ToyMaker access broker registers this masqueraded task so an outbound SSH connection provides durable remote access, letting the operator hand off footholds to ransomware affiliates while appearing to be a benign updater.

Suspicious ToyMaker LAGTOY Service Creation Masquerading as WmiPrvSV via sc.exe

This rule detects creation of a Windows service named WmiPrvSV via sc.exe, a name that mimics the legitimate WMI Provider Host (WmiPrvSE) to blend in. The LAGTOY implant used by the ToyMaker initial access broker installs itself under this masqueraded service name for persistence, so this is a strong indicator of that access broker preparing hands-on-keyboard follow-up for double extortion gangs.

Malicious Impacket Wmiexec Remote Command Execution Pattern

This rule detects the command redirection pattern produced by Impacket wmiexec where cmd.exe is spawned by WmiPrvSE.exe to run a command and write output to a local admin share path. This semi interactive execution over WMI is a hallmark of lateral movement using stolen credentials as seen in the UAT-5918 activity.

Malicious Credential Dumping via Mimikatz Sekurlsa Command

This rule detects command line usage of the mimikatz sekurlsa module which the intrusion set used to extract plaintext credentials and hashes from LSASS memory during the attacks on Japanese targets. The sekurlsa keyword in a command line is a high confidence indicator of credential theft tooling even when the binary has been renamed.