Sigma detection rules, expert-reviewed

Malicious Inhibition of System Recovery via Shadow Copy or Backup Deletion (via process_creation)

This rule detects command lines that delete volume shadow copies or backups or disable boot-time recovery, using vssadmin, wmic shadowcopy, wbadmin or bcdedit. Inhibiting system recovery is a high-impact technique in the Red Canary Threat Detection Report and a hallmark of ransomware preparing to prevent victims from restoring encrypted data. Detecting these destructive commands provides a critical, high-fidelity signal immediately before or during encryption.

Suspicious Scheduled Task Enumerated (via process_creation)

This rule detects enumerates scheduled task configuration.

Malicious IIS Application Pool Credential Dumping (via process_creation)

This rule detects scenarios where an attacker.

ClickFix PowerShell In-Memory Execution via Invoke-RestMethod Piped to Invoke-Expression (via process_creation)

This rule detects the ClickFix golden pattern in which PowerShell retrieves a remote payload with Invoke-RestMethod and immediately runs it through Invoke-Expression, executing code entirely in memory. Adversaries leverage this download-and-run one-liner delivered through pastejacking overlays, making the paired cmdlets a reliable ClickFix execution indicator.

Malicious RDP BlueeKeep Connection Closed - CVE-2019-0708 (via rdp)

This rule detects exploit the BlueKeep vulnerability.

OpenSSH Native Server Feature Installation (via powershell)

This rule detects enables the native OpenSSH server feature on Windows to perform stealthy lateral movement.

Malicious Impacket DCOMexec Process Abuse via MMC (via process_creation)

This rule detects execute the Impacket DCOMexec tool in order to abuse DCOM services.

Malicious Anonymous Login - Domain Specified (via security)

This rule detects scenarios where a suspicious anonymous login is performed during discovery phases.

BITS Payload Downloaded via Commandline (via process_creation)

This rule detects downloads a payload by abusing BITS software. For more precise information, inspect "Bits-client" event log and search for ID 59 and 60.

Suspicious Group Discovery - Command (via process_creation)

This rule detects enumerate local or domain groups via commandline.

Malicious Service Deactivation - Command (via process_creation)

This rule detects disable.

BitLocker Feature Activation on Multiple Hosts - Native (via bitlocker)

This rule detects enable or reconfigure BitLocker on multiple hosts for ransomware purposes.

Malicious Brutforce Enumeration on Windows OpenSSH Server with Non Existing User (via security)

This rule detects sSH brutforce a Windows OpenSSH server with non existing users.

Malicious Massive Remote Service Creation via Named Pipes - Tchopper (via security)

This rule detects uses the Tchopper tool by remotely creating multiple services via named pipes.

Malicious Audit Policy Disabled by Command Line (via process_creation)

This rule detects disbale or clear the audit policy for defense evasion purposes.