Sigma detection rules, expert-reviewed

Malicious Data Exfiltration via Renamed Rclone Using Masqueraded Configuration

This rule detects execution referencing a Rclone configuration file masquerading as a Windows host process file which Conti operators use to exfiltrate data to cloud storage. Observed in NCC Group research on Conti operations after the leaks using a renamed Rclone binary with a svchost.conf configuration. Cloud exfiltration via renamed Rclone is a common ransomware pre-encryption step.

Suspicious Cloud Exfiltration via Rclone

This rule detects execution of the rclone cloud sync utility with copy or sync operations, a data-exfiltration technique used by the Karakurt extortion actor to push staged files to attacker-controlled cloud storage. Bulk transfer of internal data to an external cloud provider is a strong sign of exfiltration ahead of extortion.

Suspicious Silent Security Product Uninstaller Execution

This rule detects an Inno Setup product uninstaller being launched with fully silent flags, a behavior observed in LemonDuck first-stage payloads that silently remove Malwarebytes and other security products via their unins000.exe with /verysilent. Running an uninstaller with no user interaction is a strong indicator of automated defense removal by malware.

Malicious Antivirus Removal via WMIC Product Uninstall

This rule detects abuse of wmic.exe to enumerate installed products through the product class and invoke their uninstall method non-interactively, a technique used by LemonDuck first-stage payloads to silently remove antivirus and endpoint protection. Stripping defensive software before the next stage runs weakens host protections and lets the attacker operate undetected.

Suspicious Domain Computer Enumeration via Net Group Command

This rule detects enumeration of domain computer accounts via the net group domain computers command which the RM3 banking malware used for network discovery as documented by NCC Group. Adversaries enumerate domain assets to plan lateral movement and identify high value targets.

Suspicious VBScript Execution from ProgramLogs Directory via Windows Script Host

This rule detects the Windows script host executing a VBScript from a non standard ProgramLogs directory used in the Lazarus shellcode execution chain analysed by NCC Group. Placement of scripts in an atypical top level folder is a masquerading and staging technique preceding shellcode injection.

Malicious Script Execution via Cisco AnyConnect OnConnect Handler Abuse

This rule detects the Cisco AnyConnect agent or downloader spawning a Windows script host to run OnConnect or OnDisconnect scripts which NCC Group showed can be abused to drop and execute attacker payloads on VPN connect events. Abusing the trusted VPN client for script execution evades application allow lists and provides connection triggered persistence.

Malicious USN Change Journal Deletion via Fsutil for Anti-Forensics

This rule detects use of fsutil to delete the NTFS USN change journal which NotPetya performed to destroy filesystem forensic evidence as documented by NCC Group. Deletion of the change journal removes records of file activity and is rarely part of legitimate administration.

Suspicious Scheduled Task Creation for System Reboot via Schtasks

This rule detects creation of a scheduled task that invokes shutdown with a forced restart which NotPetya used to reboot hosts into its encryption phase as reported by NCC Group. A scheduled forced reboot combined with disk tampering is a hallmark of destructive ransomware execution.

Suspicious Windows Event Log Clearing via wevtutil

This rule detects use of wevtutil to clear Windows event logs which ransomware operators use to destroy forensic evidence during an intrusion. Observed in NCC Group research into active ransomware families. Clearing event logs is a defense-evasion and anti-forensic behavior that rarely occurs in normal administration.

Suspicious Credential String Enumeration via findstr to Temp Directory

This rule detects use of findstr to search files for password strings with output directed into the Windows Temp directory which Lorenz ransomware uses to harvest credentials from local files. Observed in NCC Group research unmasking Lorenz ransomware. Bulk searching for password keywords is a hands-on-keyboard credential-access behavior worth surfacing.

Suspicious Scheduled Task Masquerading as Google Chrome Updates via Process Creation

This rule detects creation of a scheduled task named to impersonate a Google Chrome update mechanism which Lorenz ransomware uses for persistence. Observed in NCC Group research unmasking Lorenz ransomware tactics techniques and procedures. Attackers disguise persistence as a benign updater which makes this named-task masquerade a useful detection point.

Possible Driver Enumeration via Driverquery for Rootkit Discovery

This rule detects execution of the driverquery utility used to enumerate installed kernel drivers. NCC Group observed this discovery step around deployment of the malicious netfilter driver. While the tool is legitimate its use in interactive attacker sessions can indicate reconnaissance for driver based persistence.

Suspicious Svchost Masquerade Execution from Non-System Path

This rule detects a process named svchost.exe running from a directory outside the Windows System32 or SysWOW64 folders. NCC Group observed the Rclone exfiltration binary renamed to svchost.exe to blend in with legitimate host processes. Attackers rename tooling to trusted system binary names to evade analyst review and simple name based defenses.

Suspicious Rclone Cloud Sync Execution for Data Exfiltration via Command Line

This rule detects execution of the Rclone command-line tool with cloud remote sync subcommands used to stage and copy local data to attacker controlled storage. It aligns with NCC Group observations of Rclone abused to exfiltrate data to MEGA cloud storage. Adversaries use Rclone to move large volumes of stolen data out of a network prior to extortion.