Sigma detection rules, expert-reviewed

Malicious BitLocker Encryption With Shadow Copy Removal via manage-bde (via process_creation)

This rule detects manage-bde being used to turn on BitLocker encryption while removing volume shadow copies in a single operation. This tradecraft is used to weaponise the built-in BitLocker feature for ransomware encryption while destroying recovery data. Encrypting volumes and deleting shadow copies denies access to systems and inhibits restoration to extort the victim.

Suspicious Lock Screen Image Path Modification via Registry

This rule detects modification of the Windows lock screen image path registry value, a personalization change Qilin ransomware applied to display its ransom messaging. While policy tooling can set this value, an unexpected change alongside other intrusion signals indicates ransomware defacement.

Malicious Vulnerable Driver Load for BYOVD Defense Evasion (via image_load)

This rule detects loading of the rwdrv.sys, hlpdrv.sys and churchill_driver.sys kernel drivers abused in bring-your-own-vulnerable-driver attacks. Akira ransomware operators loaded these drivers to disable endpoint protection and tamper with security product access controls prior to encryption.

Malicious Vulnerable Driver Deployment for EDR Termination via file_event

This rule detects deployment of the vulnerable drivers aswArPots.sys and IObitUnlockers.sys that GHOSTENGINE abuses to terminate endpoint security processes and delete their binaries. These bring-your-own-vulnerable-driver components provide kernel-level primitives to disable defenses. Their presence indicates an active attempt to blind security tooling.

Suspicious Service Reconfiguration of SessionEnv or IKEEXT for DLL Injection by EAGERBEE

This rule detects reconfiguration of the SessionEnv or IKEEXT services via sc config, a technique the EAGERBEE backdoor uses to load a malicious service DLL such as tsvipsrv.dll. These services are known targets for phantom-DLL loading under svchost. Modifying their binary path or service DLL indicates service hijacking for persistence.

Suspicious Active Directory Enumeration via ADWS PowerShell Cmdlets via ps_script

This rule detects PowerShell script content invoking bulk Active Directory enumeration cmdlets such as Get-ADComputer or Get-ADObject that query the directory over Active Directory Web Services. Threat actors route enumeration through ADWS on port 9389 to avoid classic LDAP monitoring, so wide directory queries via these cmdlets indicate reconnaissance of domain assets and delegation.

Malicious PowerShell In-Memory Download Cradle via IEX DownloadString

This rule detects PowerShell invoking IEX together with a Net.WebClient DownloadString call to fetch and execute code directly in memory. This tradecraft was used by APT41 to stage ShadowPad and Cobalt Strike against a Taiwanese government-affiliated research institute. In-memory download cradles let attackers run remote payloads without writing them to disk which frustrates file-based detection.

Suspicious LucidRook DLL Side-Loading via Renamed msedge.exe

This rule detects msedge.exe executing from a WindowsApps directory under the user profile, matching the LucidRook loader that renames the DISM index.exe binary to msedge.exe to side-load a malicious DismCore.dll. Legitimate Microsoft Edge runs from Program Files, so an msedge.exe launched from AppData WindowsApps is an impostor used for search-order hijacking. This behavior indicates initial execution of the Lua-based LucidRook malware.

Possible Telegram Bot API Command and Control Channel

This rule detects DNS resolution of the Telegram bot API host api.telegram.org. QwixxRAT and similar stealers abuse the Telegram Bot API as a command-and-control and exfiltration channel to receive commands and upload stolen data. Because legitimate Telegram clients also resolve this host this signal should be correlated with unexpected processes making the query.

Office Persistence via WLL Add-in Dropped to Word STARTUP Folder

This rule detects a .wll Word add-in written to the Microsoft Word STARTUP folder, the persistence mechanism used by the PortDoor backdoor against the Russian defense sector. Word automatically loads WLL add-ins from this folder at launch, giving attackers stealthy code execution on every Word start.

SPN Added to an Account by Command Line (via process_creation)

This rule detects adds a SPN to an account in order to perform different type of abuse (Kerberoast, delegation abuse, ...).

Malicious PlugX DLL Sideloading via Canon cnmpaui Utility (via image_load)

This rule detects the legitimate Canon cnmpaui.exe utility loading a cnmpaui.dll from a user AppData Roaming directory. UNC6384 abused DLL search-order sideloading with this signed Canon binary to load a malicious loader that decrypted and ran PlugX.

Malicious Massive Services Termination Burst (via process_creation)

This rule detects stop multiples services on a host. Attacker may target services related to databases, security products or backups (Veeam, Symantec, Acronis ...).

Malicious Keylogger DLL Execution via Rundll32 klg.dll

This rule detects rundll32.exe loading a DLL named klg.dll which Interlock ransomware operators deploy as a keylogger to capture credentials and keystrokes. The specific module name executed through rundll32 is a reliable behavioral indicator of the keylogging component.

Malicious DLL Side-Loading of vcl120.bpl From AppData via HijackLoader (via image_load)

This rule detects a vcl120.bpl Delphi runtime package being loaded from a user AppData Roaming directory, the side-loading step used by the IObit-abusing HijackLoader to stage AsyncRAT. The legitimate vcl120.bpl resides with its application, not under AppData.