Sigma detection rules, expert-reviewed

Suspicious PowerShell Download Cradle Writing Executable To Windows Temp

This rule detects a PowerShell process bypassing execution policy and using Invoke-WebRequest to save an executable into the Windows Temp directory. Initial access brokers use this cradle to stage tooling on freshly compromised hosts before handing off access. Writing a remote binary into a world-writable temp path and running it is a common first-stage foothold.

Malicious Volume Shadow Copy Deletion Before Ransomware Encryption

This rule detects deletion of Volume Shadow Copies through vssadmin, wmic or PowerShell, an inhibit-recovery step the Qilin ransomware group performs before encrypting files. Removing shadow copies prevents victims from restoring data without paying. This activity almost always precedes or accompanies encryption.

Malicious Potato Privilege Escalation Tooling Execution

This rule detects execution of JuicyPotatoNG or iislpe, local privilege escalation tools observed in the ToolShell intrusion to abuse impersonation privileges and elevate from the IIS service account to SYSTEM. These tool names are meaningful campaign constants with no legitimate use. Their presence indicates a post-exploitation privilege escalation attempt.

Malicious IIS w3wp Worker Spawning Command Interpreter via SharePoint Web Shell

This rule detects the IIS worker process w3wp.exe spawning cmd.exe or powershell.exe, behavior consistent with the ToolShell SharePoint exploitation chain executing operator commands through a deployed .aspx web shell. A web server worker launching a shell indicates server-side code execution following exploitation. This is a strong indicator of an active web shell on a SharePoint or IIS host.

Suspicious mshta Execution of Remote or Inline Payload (via process_creation)

This rule detects mshta.exe executing content from a remote URL or an inline script protocol, a proxied execution step in Storm-0978 CVE-2023-36884 exploitation. Attackers use mshta to run downloaded OLE-delivered payloads while blending with the trusted HTML application host.

Suspicious Antivirus Uninstallation via msiexec (via process_creation)

This rule detects msiexec launched with a quiet uninstall of an installed product, a technique CACTUS ransomware uses to silently remove endpoint antivirus. Uninstalling security agents through the trusted Windows installer disables protection ahead of credential theft and encryption.

Malicious rundll32 Execution of BoomBox NativeCache DLL (via process_creation)

This rule detects rundll32.exe loading a DLL from the AppData Microsoft NativeCache path with the _configNativeCache export, the BoomBox downloader execution chain. BoomBox uses this proxied DLL execution to run in memory under a trusted binary and stage follow-on payloads used by Nobelium.

Suspicious Defender Exclusion Added via Add-MpPreference (via process_creation)

This rule detects PowerShell adding a Microsoft Defender exclusion path via Add-MpPreference. AresLoader excludes a broad path such as the C drive root so its downloaded payload runs without antivirus scanning. Programmatic creation of Defender exclusions is a common impair-defenses step that precedes payload deployment.

Suspicious MSBuild Execution as LOLBin from User-Writable Path (via process_creation)

This rule detects MSBuild.exe compiling or executing a project located in a user-writable directory rather than a development workspace. Macaw ransomware abuses MSBuild as a signed living-off-the-land binary to run inline C2 tasks and evade application controls. MSBuild driven from Temp or AppData outside of a build pipeline is a defense-evasion indicator.

Malicious Volume Shadow Copy Deletion via Vssadmin or WMIC (via process_creation)

This rule detects deletion of Volume Shadow Copies through vssadmin or wmic. Ransomware removes shadow copies so that victims cannot roll back encrypted files from local snapshots, maximizing pressure to pay. Programmatic shadow copy deletion is a well-established impact behavior seen immediately before or during encryption.

Malicious Credential Dumping via Mimikatz Sekurlsa Command (via process_creation)

This rule detects Mimikatz module commands on the command line regardless of the executable name, catching renamed copies of the tool. The sekurlsa and lsadump modules extract plaintext credentials, hashes and tickets from LSASS memory and the SAM. These module strings are highly specific to credential theft and rarely appear in legitimate activity.

Suspicious Service Termination via Net Stop Before Ransomware (via process_creation)

This rule detects net.exe being used to stop database, backup or security services, a staging step commonly seen before file encryption. Ransomware operators halt these services so that data files are unlocked and defensive tooling is silenced ahead of the payload. Targeted service shutdown of backup and security software is a high-value pre-encryption indicator.

Malicious MSDT Command Line Invoking Follina Payload (via process_creation)

This rule detects the Microsoft Support Diagnostic Tool running with the diagnostic parameters and script markers used by Follina exploitation. CVE-2022-30190 passes an IT_BrowseForFile payload through the PCWDiagnostic package so that MSDT executes embedded PowerShell. MSDT command lines carrying these markers indicate an active exploit rather than genuine troubleshooting.

Malicious MSDT Execution Spawned by Office Application via Follina (via process_creation)

This rule detects a Microsoft Office application spawning the Microsoft Support Diagnostic Tool. CVE-2022-30190 (Follina) abuses a remote Office template and the ms-msdt MSProtocol URI to launch MSDT and run attacker code even when macros are disabled. An Office parent invoking msdt.exe is a reliable signal of exploitation attempting code execution.

Suspicious Zone.Identifier Mark-of-the-Web Removal (via process_creation)

This rule detects command lines that strip the Zone.Identifier alternate data stream from downloaded files, either by deleting the stream directly or via the PowerShell Unblock-File cmdlet. Emotet removes the Mark-of-the-Web so that dropped payloads run without SmartScreen or Protected View warnings. Clearing web-origin marks on freshly downloaded content is a defense-evasion behavior worth investigating.