Sigma detection rules, expert-reviewed

Suspicious PowerShell WebClient DownloadFile of Archive Payload (UAT-7237)

This rule detects PowerShell using the System.Net.WebClient DownloadFile method to retrieve a remote archive payload. UAT-7237 uses this technique to stage tooling including SoftEther VPN packaged as a RAR archive for persistence. Scripted downloads of archives via WebClient are a common malware staging behavior.

Malicious JuicyPotato Privilege Escalation Execution (UAT-7237)

This rule detects execution of the JuicyPotato privilege-escalation tool identified by its characteristic target, CLSID and program arguments. UAT-7237 uses a JuicyPotato variant to abuse token impersonation and escalate to SYSTEM on web hosting servers. Presence of these arguments together indicates active local privilege escalation.

Suspicious Script Host Execution of Decoy-Named JavaScript Dropper (PS1Bot)

This rule detects the Windows Script Host executing a JavaScript file named to impersonate a document, such as FULL DOCUMENT.js, delivered inside a decoy ZIP archive. PS1Bot uses this dropper to write and run obfuscated VBScript that stages further PowerShell payloads. Script host execution of document-themed .js files indicates malicious delivery.

Suspicious Security Software Uninstallation via WMIC Product Call Uninstall (Chaos Ransomware)

This rule detects use of WMIC to silently uninstall installed software via the product call uninstall method. The Chaos ransomware group leverages this to remove multi-factor authentication agents and security tooling prior to encryption. Programmatic uninstallation of defensive software is an impair-defenses technique that precedes impact.

Suspicious OpenSSH Reverse Tunnel Over HTTPS Port (Chaos Ransomware)

This rule detects use of the OpenSSH client to establish a reverse tunnel with the -R option forwarding traffic over port 443. The Chaos ransomware group abuses OpenSSH reverse tunneling to blend remote access and command-and-control into HTTPS traffic. Reverse tunnels over common web ports are used to evade network monitoring and maintain covert access.

Malicious Remote Encryptor Execution via WMIC Process Call Create (Chaos Ransomware)

This rule detects the Chaos ransomware group using WMIC to remotely spawn its encryptor binary with campaign-specific arguments such as lkey, encrypt_step and work_mode. Remote process creation over WMI is used to deploy the encryptor across the network. This behavior indicates active ransomware deployment combined with lateral movement.

Suspicious SharePoint Worker Process Spawning Command Interpreter via ToolShell

This rule detects the IIS worker process w3wp.exe spawning a command interpreter such as cmd.exe or PowerShell on a SharePoint server. This behavior is associated with ToolShell exploitation of SharePoint (CVE-2025-53770) leading to remote code execution and webshell deployment. Command interpreter execution under the SharePoint worker process indicates active exploitation and hands-on-keyboard activity.

Suspicious Python Interpreter Launching Encoded PowerShell via subprocess

This rule detects a Python process spawning PowerShell with an encoded command, the behavior of the checkbalance.py component in this Emmenhtal and Amadey MaaS operation that uses subprocess.run to execute obfuscated PowerShell. A Python-to-encoded-PowerShell parent-child relationship is unusual on endpoints and indicates scripted payload execution.

Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell

This rule detects wscript.exe or cscript.exe executing a .js file and spawning PowerShell with an encoded command. The Emmenhtal loader used in this MaaS operation against Ukrainian entities runs JavaScript such as Work.js via WScript.Shell to launch encoded PowerShell that fetches the Amadey payload, so this script-to-encoded-PowerShell chain is the core delivery behavior.

Suspicious Rclone Exfiltration Masquerading as wininit.exe

This rule detects a process named wininit.exe running with Rclone-style cloud transfer arguments such as copy with remote configuration flags. Talos IR observed the Rclone exfiltration binary renamed to wininit.exe to blend with a legitimate system process while bulk-copying victim data to attacker cloud storage, so this Image and command-line mismatch flags staged exfiltration.

Malicious Volume Shadow Copy Deletion via vssadmin

This rule detects vssadmin deleting volume shadow copies, an inhibit-recovery action performed in Talos IR ransomware engagements immediately before encryption. Removing shadow copies prevents victims from restoring files and is a near-universal precursor to ransomware detonation.

Suspicious Security Product Uninstall via wmic product call uninstall

This rule detects wmic being used to enumerate a product and invoke call uninstall, the technique Talos IR observed removing the Duo multi-factor agent to weaken defenses before ransomware deployment. Programmatic uninstallation of security or MFA software via WMI is a defense-evasion step that clears obstacles to lateral movement and encryption.

Malicious Renamed Python Interpreter Executing nvidia.py RAT

This rule detects a Python interpreter executing a script named nvidia.py, the Python GolangGhost RAT payload run by Famous Chollima after a VBScript unpacks and renames the interpreter. The nvidia.py filename masquerades as GPU tooling while providing RC4-encrypted HTTP command-and-control and credential theft.

Suspicious PowerShell Download of lib.zip Archive

This rule detects PowerShell using Invoke-WebRequest or curl to download an archive named lib.zip. Famous Chollima's Python GolangGhost RAT chain fetches this archive, which is then unpacked and used to launch a renamed Python interpreter, so this ingress step precedes RAT execution and Run-key persistence.

Suspicious sha256sum.exe Execution from Windows Temp Directory

This rule detects a binary named sha256sum.exe executing from C:\Windows\Temp, the masqueraded filename PathWiper used for its wiper component. A legitimate-sounding hashing utility running from Windows Temp rather than a standard install location is the destructive payload disguised to evade casual inspection before it overwrites NTFS structures.