Sigma detection rules, expert-reviewed

Malicious Interlock Ransomware Encrypted File and Note Creation (via file_event)

This rule detects creation of files bearing the Interlock ransomware extension or its ransom note marker. The Interlock ransomware appends the interlock extension to encrypted files and drops a note referencing !NT3R10CK. Observing these file artifacts confirms active encryption on the host.

Malicious MuddyRot Payload Drop in ProgramData SoftwareMemory Directory

This rule detects creation of documentsmanagerreporter.exe inside a softwarememory folder under ProgramData, the staging path used by the MuddyWater MuddyRot implant during installation. Writing this specific file marks the initial deployment of the backdoor before persistence and C2 are established. Early detection at the drop stage allows containment before execution.

Suspicious Rootkit Configuration Registry Keys (via registry_set)

This rule detects registry values written under SOFTWARE keys prefixed with the distinctive nya marker. The OBSCURE#BAT campaign stored rootkit DLLs, driver paths, and AES keys under these keys to configure its stealthy user-mode rootkit.

Suspicious Registry Run Key Referencing Public Libraries Folder (via registry_set)

This rule detects a registry Run key value that points to a file located in the Public Libraries directory. The MULTI#STORM campaign created OneDrive Update Run keys referencing url files staged there for persistence.

Suspicious Script Host Spawning PowerShell Download Cradle (via process_creation)

This rule detects wscript or cscript spawning PowerShell that runs an Invoke-RestMethod download cradle. The Veil#Drop campaign used a JavaScript launcher under the script host to invoke a remote PowerShell loader.

Suspicious PowerShell Download Cradle to Blogspot (via process_creation)

This rule detects a PowerShell command using Invoke-RestMethod to fetch content from a Blogspot URL. The Veil#Drop campaign abused Blogspot as trusted infrastructure to stage and deliver a PowerShell loader for the PureLog stealer.

Suspicious Renamed PowerShell Binary Execution (via process_creation)

This rule detects a process whose original filename is PowerShell but which runs under a different image name. The Dead#Vax campaign executed a renamed PowerShell binary named mbs.exe to evade image based detections.

Suspicious Defender Behavior Monitoring Disable via PowerShell (via process_creation)

This rule detects PowerShell disabling Windows Defender behavior monitoring through Set-MpPreference. The DEEP#DOOR campaign disabled behavior and realtime monitoring to protect its Python backdoor from detection.

Suspicious PowerShell Executing Code from Environment Variable (via process_creation)

This rule detects PowerShell using Invoke-Expression to run code stored in an environment variable. The OBSCURE#BAT campaign staged its malicious PowerShell in a user environment variable and executed it fileless via this pattern.

Suspicious MSBuild Spawned by PowerShell (via process_creation)

This rule detects the .NET build engine MSBuild.exe being spawned as a child of PowerShell, a living-off-the-land pattern used to execute code outside normal build workflows. The SHADOW#REACTOR campaign abused MSBuild to run an in-memory Remcos payload.

Suspicious Windows Defender Real-Time Monitoring Disable (via process_creation)

This rule detects PowerShell disabling Windows Defender real-time monitoring through Set-MpPreference. The PHALT#BLYX loader used this together with extension exclusions to blind the endpoint before payload injection.

Suspicious MSBuild Execution of Project File from ProgramData (via process_creation)

This rule detects MSBuild.exe executing a project file located in the ProgramData directory. The PHALT#BLYX campaign abused MSBuild as a trusted utility to run a malicious v.proj payload dropped there.

Suspicious Dism Spawned by Microsoft Management Console (via process_creation)

This rule detects the Microsoft Management Console mmc.exe spawning the Dism.exe binary. The FLUX#CONSOLE campaign abused a malicious MSC file to launch a copied Dism binary that sideloaded a malicious DismCore.dll.

Suspicious Service or Task Named windowsinspectionupdate (via process_creation)

This rule detects creation of a service or scheduled task using the distinctive name windowsinspectionupdate. The SLOW#TEMPEST campaign used this name to persist a shellcode loader executed from the Windows Temp directory.

Suspicious Guest Account Privilege Escalation (via process_creation)

This rule detects the built-in guest account being added to the local Administrators group. The SLOW#TEMPEST campaign re-enabled the guest account and elevated it to maintain covert privileged access.