Sigma detection rules, expert-reviewed

Malicious Microsoft Defender Default Action Changed to Allow Any Threat - Command (via process_creation)

This rule detects change Defender default action to allow any threats.

Malicious DNS Hosts File Accessed via Network Share (via security)

This rule detects attempt read the Hosts file content via network share.

Malicious Akira Ransomware Execution via Encryption Command-Line Parameters

This rule detects process execution using the distinctive encryption command-line parameters of the Akira ransomware encryptor, matching intrusions where a renamed akira.exe is run against mounted network shares. The switches control encryption scope and percentage across targeted paths and shares. Detecting these parameters catches the encryptor even when the binary is renamed to evade name-based controls.

Malicious Windows Defender Disabling via DC.exe Defender Control by Elpaco Ransomware

This rule detects execution of the Defender Control utility (DC.exe) with a disable switch to turn off Windows Defender. This behavior is used by the Elpaco ransomware, a Mimic variant, to blind endpoint protection before encryption. Disabling defenses removes the primary barrier to file encryption and lateral movement, making early detection critical.

Suspicious Firewall Configuration Enumerated - PowerShell (via powershell)

This rule detects extract current Windows firewall configuration to prepare an attack.

Suspicious Mock Trusted Directory with Trailing Space (via process_creation)

This rule detects the DBatLoader UAC bypass technique that creates a mock system directory whose name carries a trailing space before the System32 segment to satisfy trusted-directory checks. Any process image path containing Windows followed by a space and then a backslash indicates this masquerade. Legitimate Windows binaries never execute from such a path.

Suspicious Hidden PowerShell Encoded IEX Execution

This rule detects PowerShell launched with stealth flags together with in-memory execution of Base64 content, matching the spyware loader from the Pakistan-targeted fake dating app campaign. The combination of hidden window, bypassed policy and IEX-decoded payload indicates fileless execution of downloaded malware.

Malicious DeadLock Ransomware Encrypted File Extension Creation (via file_event)

This rule detects creation of files carrying the .dlock extension appended by the DeadLock ransomware encryptor as reported by Group-IB. Adversaries rename encrypted files with this extension during impact, so these writes indicate active DeadLock encryption on the host.

Suspicious SSH Reverse Tunnel via Renamed plink Utility on Triofox Host

This rule detects renamed plink or putty binaries sihosts.exe and silcon.exe establishing a reverse SSH tunnel with the -R flag as observed after Triofox exploitation. Attackers proxy RDP over an outbound tunnel to a non standard port to maintain covert remote access.

Suspicious Astaroth Spambot Browser Profile Staging Directory (via file_event)

This rule detects creation of the browser profile staging directory used by the Astaroth spambot component. Astaroth copies the victim browser profile into a ChromeAuto directory under the public temp folder to drive an automated headless browser session. This directory pattern is a high-fidelity host indicator.

Suspicious Shell Spawned by Oracle WebLogic Identity Manager Process (via process_creation)

This rule detects a WebLogic or Oracle Identity Manager Java process spawning a command shell. Such a child process is consistent with post-exploitation of the CVE-2025-61757 remote code execution chain. Identity servers rarely launch interactive shells from the JVM.

Suspicious CoffeeLoader Armoury DLL Dropped to User Writable Path (via file_event)

This rule detects the ArmouryAIOSDK.dll payload being written to ProgramData, LocalAppData or the Temp directory as performed by CoffeeLoader during installation. The genuine ASUS DLL is not expected in these user writable locations.

Suspicious PowerShell Script Execution With Unrestricted Execution Policy

This rule detects PowerShell launched to run a script file while forcing an unrestricted execution policy. The GoPix banking trojan started its payload with an ExecutionPolicy Unrestricted -File command line delivered via a malicious LNK as reported by Kaspersky. Bypassing the execution policy to run an external script is a common defense-evasion step for script-based loaders.

Malicious Vice Society Directory Crawling Script for Data Exfiltration - Via Ps_script (via ps_script)

This rule detects data exfiltration performed by the Vice Society ransomware gang using a custom built PowerShell script. More precisely, the script enumerates the volumes mounted on the system, then starts crawling the different directories before initiating the data exfiltration over HTTP by creating multiple different jobs. As PowerShell script block logs the script execution into multiple events, the detection aggregates the different log chunks using the ScriptBlockId and then ensure that at least 3 of the 4 detection strings are found.

DragonForce Ransomware File Association Registration for Encrypted Extension (via registry_set)

This rule detects registration of a DefaultIcon association for the .dragonforce_encrypted file extension, an impact behavior DragonForce ransomware performs so all encrypted files display an attacker-supplied icon dropped under the public profile. Registering an icon for a novel encrypted extension is a strong post-encryption indicator, making detection useful for scoping ransomware impact across a host.