Sigma detection rules, expert-reviewed

Malicious Volume Shadow Copy Deletion via wmic and vssadmin (via process_creation)

This rule detects deletion of volume shadow copies through wmic shadowcopy delete and vssadmin Delete Shadows commands. This behavior is used by the Helldown ransomware to inhibit system recovery prior to encrypting files. Removing shadow copies prevents victims from restoring their data which maximizes the impact of the intrusion.

Malicious MuddyRot Implant Execution From ProgramData SoftwareMemory Path

This rule detects execution of a binary from the ProgramData softwarememory documentsmanagerreporter.exe location, the fixed install path and filename used by the MuddyWater MuddyRot implant. The actor drops the payload here and registers persistence to maintain access. The hardcoded path and masqueraded name make this a high confidence indicator of MuddyRot infection.

Malicious System Recovery Inhibition via bcdedit and vssadmin in Mallox

This rule detects Mallox disabling recovery by editing boot configuration with bcdedit and deleting volume shadow copies with vssadmin. Turning off recovery and wiping shadows prevents restoration of encrypted files, a hallmark pre-encryption step of the Mallox ransomware.

Malicious MS-SQL Server Spawning Command Shell via Mallox

This rule detects the MS-SQL service process sqlservr.exe spawning cmd.exe or PowerShell. Mallox affiliates abuse xp_cmdshell and OLE automation after compromising weak SQL Server instances, so a shell child of the database engine strongly indicates SQL exploitation.

Suspicious PlugX Self-Cleanup Batch Execution

This rule detects execution of the del_AsvastSvcpCP.bat cleanup script used by the PlugX worm to remove its staging artifacts. Running this uniquely named batch indicates PlugX is tidying up its footprint after installation or removal.

Malicious PlugX DLL Sideloading via CEFHelper from RECYCLER.BIN

This rule detects the PlugX loader CEFHelper.exe running from a hidden RECYCLER.BIN directory on a USB or local volume. The worm sideloads its payload DLL through this renamed helper stored in a fake recycle bin folder to evade inspection.

Suspicious Doenerium Host Fingerprinting via cmd.exe

This rule detects the Doenerium stealer fingerprinting a host by running chcp or tasklist through cmd.exe with the /d /s /c flags. The stealer enumerates the code page and running processes early in execution to profile the victim and evade sandboxes.

Suspicious HijackLoader Component Execution via ClearFake

This rule detects execution of the AiStubX64 and KSPSService binaries dropped by the ClearFake APPX payload to stage HijackLoader. These named components accompany the fake-update infection chain and their execution indicates the loader is running.

Malicious Microsoft Defender Services Stopped via sc.exe

This rule detects sc.exe stopping core Microsoft Defender services such as WinDefend, Sense or WdNisSvc. Disabling these services terminates endpoint and EDR telemetry, a defense evasion step used by intruders before continuing their operation as described by Sekoia.

Suspicious Microsoft Defender Definitions Removed via MpCmdRun

This rule detects MpCmdRun.exe being used to remove all Defender signature definitions. Adversaries strip antivirus definitions to degrade detection coverage before executing malware, an evasion behaviour highlighted in Sekoia Defender tampering research.

Malicious AddInProcess32 Network Beacon on PureRAT C2 Ports

This rule detects the .NET AddInProcess32.exe host process establishing outbound connections to TCP ports 56001 through 56003. Attackers reflectively load the PureRAT payload into AddInProcess32.exe to blend malicious traffic with a signed Microsoft binary. Outbound traffic from this process to the fixed high port range is a strong indicator of PureRAT command and control.

Suspicious ctfmon.exe Network Connection to PikaBot C2 Ports

This rule detects the injected ctfmon.exe process establishing outbound connections to uncommon high ports used by PikaBot command and control such as 2078, 2083, 2222 and the 13720-13786 range. Because ctfmon.exe never initiates network traffic legitimately, any such connection indicates the malware beacon operating from hijacked memory. This helps surface active C2 that evaded process based detection.

Possible Trojanised Python Native Extension Load of gradient Module

This rule detects a Python process loading a gradient native extension module which was used to deliver a Python RAT to vulnerability researchers. The ChocoPoCs campaign ships trojanised packages whose native gradient extension executes attacker code on import. Because the module name is generic this pattern needs corroboration from the surrounding package before it is treated as malicious.

Possible python311 DLL Side-Loading by Non Python Host Process

This rule detects a process that is not a Python interpreter loading python311.dll which can indicate DLL side-loading. Silver Fox side-loads a malicious python311.dll alongside a decoy executable to run ValleyRAT shellcode. Because many legitimate applications embed Python this pattern requires context before it can be confirmed as malicious.

Suspicious HTA File Dropped into Startup Folder

This rule detects creation of an HTA file inside the user Startup folder. Gamaredon abuses a WinRAR path traversal flaw to place an HTA into Startup for persistence in the GammaPhish chain. Auto-executed HTML applications in a Startup directory are almost always malicious persistence.