Sigma detection rules, expert-reviewed

Suspicious Service Principal Name Enumeration via Setspn by UAT-8837

This rule detects use of setspn to query service principal names across the domain. UAT-8837 enumerates SPNs as a precursor to Kerberoasting service accounts. Harvesting SPNs allows an actor to request and crack service ticket hashes offline.

Malicious SOCKS Proxy Tunnel via Earthworm Rssocks by UAT-8837

This rule detects execution of the Earthworm tunneling tool in rssocks reverse SOCKS mode connecting outbound. UAT-8837 uses Earthworm renamed as v.ico or verr.ico to tunnel traffic into victim networks. Reverse SOCKS proxies give an actor interactive access to internal systems while evading perimeter controls.

Malicious Group Policy Preferences Credential Hunting via Findstr by UAT-8837

This rule detects use of findstr to recursively search policy files for the cpassword attribute. UAT-8837 harvests Group Policy Preferences passwords which can be decrypted with a publicly known AES key. Locating cpassword values yields reusable domain credentials for privilege escalation and lateral movement.

Suspicious Domain Controller Enumeration via Nltest by DeadLock Ransomware

This rule detects use of nltest to list domain controllers during reconnaissance. The DeadLock ransomware actors run nltest and quser to map the domain prior to lateral movement. Domain controller enumeration is an early sign of an actor preparing to spread across the network.

Malicious Disabling of Microsoft Defender Real-Time Protection via SystemSettingsAdminFlows by DeadLock Ransomware

This rule detects use of SystemSettingsAdminFlows to toggle Microsoft Defender real-time protection. The DeadLock ransomware loader invokes this living-off-the-land binary to disable endpoint protection before deploying its payload. Turning off real-time protection blinds the defender to subsequent malicious activity.

Suspicious Cloudflared Tunnel Execution for Command and Control by Kraken Ransomware

This rule detects execution of the cloudflared client to establish an outbound tunnel. The Kraken ransomware group abuses Cloudflare Tunnel together with SSHFS and RDP to maintain covert access and move laterally. Attacker use of cloudflared can bypass perimeter controls by tunneling traffic over trusted Cloudflare infrastructure.

Malicious Mass Hyper-V Virtual Machine Shutdown via PowerShell by Kraken Ransomware

This rule detects PowerShell forcibly stopping Hyper-V virtual machines by piping Get-VM into Stop-VM with the force and turnoff switches. This technique is used by the Kraken ransomware group to shut down virtualized workloads before encryption. Terminating running virtual machines unlocks their files for encryption and maximizes operational impact.

Suspicious Shadow Copy Deletion via Vssadmin by Kraken Ransomware

This rule detects deletion of Volume Shadow Copies using vssadmin with the delete shadows and all flags. This behavior is associated with the Kraken ransomware group which inhibits system recovery prior to encryption. Removing shadow copies prevents victims from restoring files without paying the ransom.

Suspicious Ransomware Fan-Out Deployment via PsExec Spread (Qilin)

This rule detects execution of a deployment tool with a spread argument used by the Qilin group to push its ransomware encryptor across hosts. Automated fan-out deployment over remote channels is a lateral-movement and impact accelerant. The spread flag distinguishes mass deployment from routine remote administration.

Suspicious npm Postinstall Node Execution From Fixtures Path (BeaverTail OtterCookie)

This rule detects node.exe executing a script from a test fixtures eval path, the malicious npm postinstall chain used by the BeaverTail and OtterCookie malware families delivered through compromised packages. This lures developers into running staged JavaScript modules such as index.js and file15.js. Node execution from fixture directories during package installation indicates a supply-chain compromise.

Suspicious Impacket smbexec Command Execution Pattern

This rule detects the Impacket smbexec execution pattern where a command interpreter runs with the quiet and command flags, echoes a command, and redirects output to a share path ending in __output. This service-based semi-interactive shell is used for lateral movement during these ransomware attacks. The __output redirection artifact is a reliable smbexec indicator.

Suspicious Velociraptor Agent Deployment via msiexec From Cloud Storage

This rule detects silent installation of an MSI package hosted on Azure blob storage via msiexec, the delivery method used to deploy the Velociraptor DFIR tool during ransomware intrusions. Adversaries abuse Velociraptor as a covert remote-access agent. Silent MSI installs pulled directly from remote cloud URLs are a common malicious tooling delivery pattern.

Suspicious Archiving of Registry Hives via WinRAR (UAT-8099)

This rule detects use of WinRAR to compress the SAM and SYSTEM registry hives for exfiltration. UAT-8099 archives these hives to extract credentials offline from compromised IIS servers. Archiving registry hives is a collection step supporting credential access and later exfiltration.

Malicious Volume Shadow Copy Deletion via vssadmin or WMIC

This rule detects deletion of volume shadow copies via vssadmin Delete Shadows or wmic shadowcopy delete. Ransomware families in this report remove shadow copies to prevent victims from restoring encrypted files. Shadow copy deletion is a hallmark inhibit-recovery step performed during ransomware execution.

Suspicious PowerShell WebClient DownloadFile of Archive Payload (UAT-7237)

This rule detects PowerShell using the System.Net.WebClient DownloadFile method to retrieve a remote archive payload. UAT-7237 uses this technique to stage tooling including SoftEther VPN packaged as a RAR archive for persistence. Scripted downloads of archives via WebClient are a common malware staging behavior.