Sigma detection rules, expert-reviewed

Malicious Volume Shadow Copy Deletion via vssadmin

This rule detects deletion of all volume shadow copies via vssadmin with the quiet flag. This behavior matches BlackSuit ransomware operated by Ignoble Scorpius which removes shadow copies to inhibit system recovery before encryption. Shadow copy deletion is a strong pre-encryption indicator and warrants immediate response to prevent irreversible data loss.

Malicious FrostyGoop OT Encryptor Execution with Modbus Config

This rule detects execution of the FrostyGoop OT malware binary go-encrypt.exe or any process referencing its task_test.json Modbus configuration file. This behavior matches the FrostyGoop campaign targeting industrial control systems where the tool read a JSON target list to issue unauthorized Modbus commands. Detecting the encryptor and its config is critical because it directly manipulates OT device registers and can disrupt physical processes.

Suspicious Windows Defender Exclusion Enumeration via reg query (via process_creation)

This rule detects reg query enumerating the Microsoft Defender exclusions registry path, reconnaissance the Silent Skimmer actor used to learn which folders evade scanning before staging payloads. Querying exclusion policy indicates an actor mapping defensive gaps to abuse.

Malicious Windows Defender Exclusion Added via PowerShell (via process_creation)

This rule detects PowerShell using Add-MpPreference to register a Microsoft Defender path exclusion, a defense-evasion step the Silent Skimmer actor performed to protect payload directories from scanning. Excluding attacker-controlled folders lets malware run and persist without antivirus detection.

Suspicious LSASS Credential Access via PowerShell (via process_creation)

This rule detects PowerShell command lines referencing lsass, the mechanism the extortion actor used to dump credentials from the Local Security Authority Subsystem Service memory. Reading or dumping LSASS through PowerShell exposes plaintext credentials and hashes for lateral movement.

Suspicious Executable Launched from Public Music Staging Directory (via process_creation)

This rule detects processes executing from the C users Public Music directory, a world-writable staging location Jumpy Pisces used to hold PsExec and the TokenPlayer tool during Play ransomware operations. Binaries running from this non-standard path are rarely legitimate and often mark attacker tooling.

Suspicious SMB Admin Share Mapping for Lateral Tool Transfer (via process_creation)

This rule detects mapping of a remote C$ administrative share with net use, the step Jumpy Pisces used to copy malware to peer hosts over SMB before deploying Play ransomware. Mounting admin shares to stage tooling is a common lateral-movement precursor to network-wide encryption.

Suspicious SSH Reverse Tunnel via plink (via process_creation)

This rule detects the plink utility establishing an SSH connection with a remote port forward, the reverse-tunnel technique SnipBot operators used alongside a socks5 proxy to route traffic through the victim. Reverse SSH tunneling grants the actor an internal foothold and hides command-and-control behind an encrypted channel.

Suspicious Windows Event Log Clearing via wevtutil (via process_creation)

This rule detects the wevtutil utility clearing Windows event logs, an anti-forensic step Repellent Scorpius uses to destroy evidence during Cicada3301 ransomware intrusions. Wiping event logs hinders incident response and hides the actor's earlier activity.

Malicious Inhibit System Recovery via Shadow Copy and Boot Config Tampering (via process_creation)

This rule detects deletion of Volume Shadow Copies via vssadmin or wmic and disabling of Windows recovery via bcdedit, the recovery-inhibition sequence Repellent Scorpius runs before deploying Cicada3301 ransomware. Destroying backups and recovery options maximizes encryption impact and pressures victims to pay.

Suspicious Data Exfiltration to Dropbox via curl (via process_creation)

This rule detects the curl utility uploading data to the Dropbox API, a channel Stately Taurus used to exfiltrate rar archives of stolen files from compromised government networks. Exfiltration through a trusted cloud storage provider blends with normal web traffic and evades data-loss controls that whitelist Dropbox.

Malicious zqtxmo Batch Script Execution by Fighting Ursa

This rule detects execution of the zqtxmo.bat batch script run by Fighting Ursa after a sideloaded DLL entry point, a stage that launches msedge with a base64 argument to reach its webhook based command and control. The named batch file is a distinctive artifact of this infection chain. Detecting it exposes the follow-on execution stage of the campaign.

Suspicious Double Extension Image Executable by Fighting Ursa

This rule detects execution of a file using a deceptive image double extension ending in jpg.exe, the disguise Fighting Ursa applies to a renamed calc.exe delivered in its car-for-sale phishing lure. The double extension tricks users into launching a program that appears to be a photo. Detecting this exposes user execution of the masqueraded first-stage binary.

Malicious NTDS Extraction from Volume Shadow Copy by RA World

This rule detects copying of the Active Directory database or SAM and SYSTEM hives out of a volume shadow copy through a GLOBALROOT HarddiskVolumeShadowCopy path, a credential theft step used by the RA World ransomware group. Reading domain secrets from a shadow copy bypasses locks on the live files. Detecting this exposes domain credential harvesting ahead of ransomware deployment.

Suspicious SUID Bit Set on Binary from Container Context

This rule detects the setuid bit being applied to a binary via chmod, a privilege escalation step used after container escapes to leave a root-owned SUID backdoor on the host. Creating a SUID binary provides a durable path back to root. Detecting this exposes privilege escalation and persistence following a breakout.