Sigma detection rules, expert-reviewed

Volume Shadow Copy Deletion via vssadmin or wmic

This rule detects deletion of Volume Shadow Copies through vssadmin or wmic, an anti-recovery step performed by Phobos ransomware deployed by the 8Base group. Removing shadow copies prevents victims from restoring encrypted files without paying. This inhibit-recovery behavior almost always precedes or accompanies ransomware encryption.

Malicious Inhibit System Recovery via Backup and Shadow Copy Deletion (via process_creation)

This rule detects deletion of volume shadow copies and backup catalogs and disabling of recovery via native tools, a destructive precursor observed in Phobos ransomware affiliate activity. Removing recovery options prevents victims from restoring data without paying, increasing the impact of the subsequent encryption.

Explorer WebDAV UNC Download Using At-Port Syntax

This rule detects explorer.exe launched with a UNC path that embeds an HTTP port using the WebDAV at-port syntax such as \\\\host@80\\. Qakbot-affiliated actors distributing Ransom Knight abused LNK files to run explorer against a remote WebDAV share like 89.23.96.203@80 to fetch information.exe. This at-port UNC form is a hallmark of WebDAV-based payload retrieval and rarely appears in legitimate use.

Msiexec Spawning Batch Script Child Process

This rule detects msiexec.exe spawning a command interpreter that runs a batch file. The GPU miner installer abused msiexec with EnforcedRunAsAdmin to launch core.bat and kick off its infection chain. A signed MSI installer invoking cmd to execute a local batch script is an abuse of the trusted installer for proxy execution.

Interactive Service Creation Executing cmd via sc.exe

This rule detects use of sc.exe to create a service whose binary path launches cmd with an interactive start command. Lazarus created a service named WindowsNotification with an interactive binpath of cmd /K start to execute QuiteRAT. Registering a service that spawns an interactive command shell is a persistence and privilege abuse technique rarely seen in legitimate administration.

Curl Downloading Executable to Public User Directory

This rule detects curl.exe fetching a remote file and writing an executable into the C:\\Users\\Public directory. Lazarus operators used curl to download a payload as notify.exe into the public user folder after exploiting a ManageEngine vulnerability. Staging a downloaded binary in a world-writable public path is a common precursor to persistence and execution.

Potential StyleSmuggler (CVE-2026-75650) Exploitation Attempt - Magento GraphQL Styles Parameter (via webserver)

Detects POST requests to the Magento GraphQL endpoint carrying a styles[...] query parameter, the pattern reported for exploitation of StyleSmuggler (CVE-2026-75650), an unauthenticated remote code execution vulnerability in Magento Open Source and Adobe Commerce 2.4.4 through 2.4.9. A match indicates an exploitation attempt, not confirmed compromise; correlate with implant process and file indicators on the host.

Possible Plink Reverse Tunnel Command Line Execution

This rule detects Plink invoked to establish a reverse SSH tunnel with no interactive shell, using the -N and -R switches together. The Lazarus Group deployed a customized Plink (including a renamed pvhost.exe) to build reverse tunnels such as -N -R 18118 and -N -R 4443 -P 443 for command-and-control relaying. This tunneling technique lets attackers pivot into internal networks through an outbound SSH connection.

Suspicious svchost.exe Execution From AppData Roaming Directory

This rule detects svchost.exe running from a user AppData Roaming path instead of the System32 directory. The customized Yashma ransomware dropped a malicious svchost.exe copy into %AppData%\\Roaming to masquerade as the legitimate Windows service host. Attackers abuse this trusted name and wrong path to blend malicious execution into normal process activity and evade defenders.

Malicious StyleSmuggler (CVE-2026-75650) Web Shell Dropped In Magento Product Image Cache (via file_event)

Detects creation of a PHP web shell under the Magento product image cache using the ss_<10hex>/sync_<10hex>.php naming pattern. The web shell was dropped by a second threat actor observed exploiting StyleSmuggler (CVE-2026-75650), separate from the operator deploying the Rust implant. The shell returns 404 unless the request carries the expected X-Cache-Token header and executes arbitrary PHP supplied in the task parameter.

Malicious StyleSmuggler (CVE-2026-75650) Post-Exploitation Implant Process (via process_creation)

Detects execution of the Rust backdoor deployed on Magento and Adobe Commerce servers after successful exploitation of StyleSmuggler (CVE-2026-75650). The implant masquerades as a kernel thread ([kworker/u:8:0]) or as legitimate system binaries (fc-cache, chronyd, gvfsd-user) running from temporary or hidden home-directory paths. Kernel threads are never created through exec, so a kworker-like command line in a process creation event indicates masquerading; genuine fc-cache and chronyd binaries do not run from these paths.

Suspicious Network Connection From wabmig.exe (Turian Injection)

This rule detects the Windows Contacts import utility wabmig.exe initiating outbound network connections. The Turian backdoor injects into wabmig.exe, an application with no legitimate need for network communication, to mask its command-and-control traffic. Outbound connections from this process strongly indicate process injection and active C2.

Malicious Evilginx AiTM Phishing Proxy Default TLS Certificate

This rule detects TLS certificates carrying the Evilginx default issuer strings Evilginx Signature Trust Co. or Evilginx Super-Evil Root CA. These constants are baked into the Evilginx reverse-proxy adversary-in-the-middle framework used in this MFA-bypass phishing campaign to relay victim sessions, so observing them indicates an active AiTM proxy harvesting credentials and session cookies.

Suspicious Outbound Network Connection from Explorer Process

This rule detects the Windows explorer.exe process establishing outbound network connections to external hosts which is anomalous because Explorer does not normally initiate internet beacons. In the Gamaredon campaign the Remcos backdoor injected into explorer.exe to blend command and control traffic with a trusted process.

Suspicious Outbound Connection To MoonPeak C2 High Ports

This rule detects outbound network connections to the non-standard high ports used by MoonPeak command-and-control infrastructure. MoonPeak a XenoRAT-based implant tracked to North Korean actors communicated with its C2 over ports 9999 9966 9936 and 8936. Beaconing to fixed uncommon high ports is a strong indicator of covert C2 that bypasses port-based egress assumptions.