Sigma detection rules, expert-reviewed

Suspicious Rogue Machine Account Creation via Powermad New-MachineAccount

This rule detects use of the Powermad New-MachineAccount cmdlet to create a rogue computer account in Active Directory, the first step of a resource-based constrained delegation attack that leads to privilege escalation. Creation of attacker-controlled machine accounts through this tooling is a strong indicator of an RBCD abuse chain.

Suspicious Download Utility Spawned by Java Process

This rule detects a Java process spawning a download utility such as curl or wget which is a common post exploitation pattern after Log4Shell remote code execution as described in NCC Group Log4Shell detection research. Adversaries use the compromised Java application to pull second stage payloads onto the host so a Java parented download tool warrants investigation.

Malicious Fivehands Go Encryptor Execution via Command Line Flags

This rule detects execution of the Fivehands Go based file encryptor identified by its characteristic command line flags key path blocks and full as described in NCC Group Fivehands ransomware research. The operator invokes the encryptor with a supplied key and target path to encrypt files and append the crypt extension which is the destructive final stage of the intrusion.

Suspicious Security Software Removal Batch Script Execution

This rule detects execution referencing batch scripts named to uninstall Sophos endpoint protection which Conti operators run to disable defenses before deploying ransomware. Observed in NCC Group research on Conti operations after the leaks using Removesophos and uninstallSophos batch files. Scripted removal of security tooling is a defense-evasion behavior that precedes impact.

Malicious Data Exfiltration via Renamed Rclone Using Masqueraded Configuration

This rule detects execution referencing a Rclone configuration file masquerading as a Windows host process file which Conti operators use to exfiltrate data to cloud storage. Observed in NCC Group research on Conti operations after the leaks using a renamed Rclone binary with a svchost.conf configuration. Cloud exfiltration via renamed Rclone is a common ransomware pre-encryption step.

Suspicious Cloud Exfiltration via Rclone

This rule detects execution of the rclone cloud sync utility with copy or sync operations, a data-exfiltration technique used by the Karakurt extortion actor to push staged files to attacker-controlled cloud storage. Bulk transfer of internal data to an external cloud provider is a strong sign of exfiltration ahead of extortion.

Suspicious Silent Security Product Uninstaller Execution

This rule detects an Inno Setup product uninstaller being launched with fully silent flags, a behavior observed in LemonDuck first-stage payloads that silently remove Malwarebytes and other security products via their unins000.exe with /verysilent. Running an uninstaller with no user interaction is a strong indicator of automated defense removal by malware.

Malicious Antivirus Removal via WMIC Product Uninstall

This rule detects abuse of wmic.exe to enumerate installed products through the product class and invoke their uninstall method non-interactively, a technique used by LemonDuck first-stage payloads to silently remove antivirus and endpoint protection. Stripping defensive software before the next stage runs weakens host protections and lets the attacker operate undetected.

Suspicious Domain Computer Enumeration via Net Group Command

This rule detects enumeration of domain computer accounts via the net group domain computers command which the RM3 banking malware used for network discovery as documented by NCC Group. Adversaries enumerate domain assets to plan lateral movement and identify high value targets.

Suspicious VBScript Execution from ProgramLogs Directory via Windows Script Host

This rule detects the Windows script host executing a VBScript from a non standard ProgramLogs directory used in the Lazarus shellcode execution chain analysed by NCC Group. Placement of scripts in an atypical top level folder is a masquerading and staging technique preceding shellcode injection.

Malicious Script Execution via Cisco AnyConnect OnConnect Handler Abuse

This rule detects the Cisco AnyConnect agent or downloader spawning a Windows script host to run OnConnect or OnDisconnect scripts which NCC Group showed can be abused to drop and execute attacker payloads on VPN connect events. Abusing the trusted VPN client for script execution evades application allow lists and provides connection triggered persistence.

Malicious USN Change Journal Deletion via Fsutil for Anti-Forensics

This rule detects use of fsutil to delete the NTFS USN change journal which NotPetya performed to destroy filesystem forensic evidence as documented by NCC Group. Deletion of the change journal removes records of file activity and is rarely part of legitimate administration.

Suspicious Scheduled Task Creation for System Reboot via Schtasks

This rule detects creation of a scheduled task that invokes shutdown with a forced restart which NotPetya used to reboot hosts into its encryption phase as reported by NCC Group. A scheduled forced reboot combined with disk tampering is a hallmark of destructive ransomware execution.

Suspicious Windows Event Log Clearing via wevtutil

This rule detects use of wevtutil to clear Windows event logs which ransomware operators use to destroy forensic evidence during an intrusion. Observed in NCC Group research into active ransomware families. Clearing event logs is a defense-evasion and anti-forensic behavior that rarely occurs in normal administration.

Suspicious Credential String Enumeration via findstr to Temp Directory

This rule detects use of findstr to search files for password strings with output directed into the Windows Temp directory which Lorenz ransomware uses to harvest credentials from local files. Observed in NCC Group research unmasking Lorenz ransomware. Bulk searching for password keywords is a hands-on-keyboard credential-access behavior worth surfacing.