Sigma detection rules, expert-reviewed

Suspicious Sysinternals EULA Acceptance Registry Write Linked to INC Ransomware

This rule detects the EulaAccepted registry value being written under a Sysinternals product key, indicating first-run command-line use of a Sysinternals tool as seen in INC ransomware intrusions. Because operators use PsExec and similar tools with the -accepteula flag, an unexpected EULA write on a server can reveal attacker tool staging, though administrators also trigger it legitimately.

Malicious Microsoft Defender Tampering via Registry Values

This rule detects modification of Microsoft Defender protection registry values such as TamperProtection DisableBehaviorMonitoring and DisableOnAccessProtection which infostealers set to blind endpoint defenses before harvesting credentials. Turning off these real time protections is a strong defense evasion indicator that precedes credential theft.

Malicious Windows Defender DisableAntiSpyware Registry Modification

This rule detects the DisableAntiSpyware registry value being set to disable Microsoft Defender which Black Basta operators use to blind endpoint protection before deploying ransomware. Disabling Defender through this policy value is a strong defense evasion indicator that precedes further malicious activity.

Malicious Shadow Copy Deletion via WMI PowerShell

This rule detects PowerShell querying Win32_Shadowcopy through WMI and deleting the returned shadow copies, an alternative recovery-inhibition technique that avoids the vssadmin binary. It is associated with REvil ransomware-as-a-service affiliate operations seeking to destroy backups prior to encryption. Detecting the WMI-based variant closes a common evasion gap around shadow copy deletion.

Suspicious Active Directory Enumeration via AdsiSearcher

This rule detects PowerShell use of the AdsiSearcher type accelerator to query Active Directory, an enumeration step performed by the actors exploiting CVE-2026-1731. Directory searches map users and groups to plan privilege escalation and lateral movement. AdsiSearcher usage in scripts is uncommon outside of dedicated administrative tooling.

Malicious CACTUS Ransomware Deployment via TotalExec Script (via ps_script)

This rule detects PowerShell content referencing the TotalExec deployment script combined with PsExec, the automation CACTUS uses to push ransomware across hosts. TotalExec wraps PsExec to remotely execute the encryptor on many machines at once, enabling network-wide impact.

Malicious Shadow Copy Deletion via WMI PowerShell (via ps_script)

This rule detects PowerShell that queries the Win32_Shadowcopy WMI class and then deletes the returned instances. Ransomware uses this WMI approach to remove Volume Shadow Copies without invoking vssadmin, evading command-line detections focused on that utility. Scripted shadow copy destruction through WMI is a clear recovery-inhibition behavior.

Malicious Windows Defender Tampering via Set-MpPreference (via ps_script)

This rule detects PowerShell Set-MpPreference usage that disables Microsoft Defender protections or adds broad exclusions. DragonForce operators run these cmdlets to blind endpoint protection before staging and encryption, clearing the way for tooling to execute undetected.

Suspicious PowerShell Remote File Download Cmdlets (via ps_script)

This rule detects PowerShell script blocks that invoke remote download primitives such as Invoke-WebRequest, Start-BitsTransfer or the WebClient DownloadFile method. The BadPilot campaign uses these cmdlets to retrieve additional payloads, so their presence in script telemetry points to ingress tool transfer during intrusion.

Suspicious Bulk Kubernetes Secret Dump via Kubectl

This rule detects kubectl retrieving secrets across all namespaces in a serialized output format, a bulk-collection pattern used to exfiltrate cluster credentials. It is associated with software supply chain attacks that leverage compromised developer tooling to dump Kubernetes secrets. Detecting mass secret reads flags credential harvesting from cluster control planes.

Suspicious Bun Runtime Spawned by Node During npm Lifecycle

This rule detects the Node.js process launching the Bun JavaScript runtime, a chain observed when malicious npm packages execute payloads through Bun during install or lifecycle events. It is associated with software supply chain attacks that weaponize trusted developer workflows to run code on build and developer hosts. Detecting this uncommon parent-child pair surfaces post-install package execution abuse.

Malicious Volume Shadow Copy Deletion via Vssadmin

This rule detects vssadmin being invoked to delete all volume shadow copies quietly, a recovery-inhibition step performed before file encryption. It is associated with REvil ransomware-as-a-service affiliate operations that wipe backups to prevent victims from restoring encrypted data. Catching this activity provides an early signal that ransomware deployment is imminent.

Malicious Chisel Reverse Tunnel Execution for Protocol Tunneling

This rule detects execution of the Chisel tunneling tool either by binary name or by a client command establishing a reverse tunnel, the protocol tunneling method used by Scattered Spider for covert connectivity and persistence. Chisel builds an encrypted tunnel that lets adversaries pivot through the network and evade egress controls. The tool has no legitimate enterprise use in most environments.

Malicious AnyDesk Silent Unattended Installation via Command Line

This rule detects an AnyDesk command line that combines an unattended install flag with a silent and start-with-Windows option, the scripted RMM deployment pattern used by Scattered Spider to plant remote access after help-desk social engineering. A single command carrying install, silent and auto-start flags indicates automated rather than user-initiated setup. This behavior enables covert remote control and persistence.

Malicious MeshCentral Agent Installation With Campaign Naming

This rule detects execution of MeshCentral remote-management agents using the azure-ops and v2 naming observed in ShinyHunters intrusions following the PeopleSoft zero-day exploitation. These specific agent file names are meaningful campaign constants used to blend the remote-access tool into cloud-looking traffic. Their execution indicates attacker-controlled remote management for persistence and lateral movement.