Sigma detection rules, expert-reviewed

Malicious EDRKillShifter Defense Evasion Tool Execution Linked to RansomHub

This rule detects execution of the EDRKillShifter loader by image name, a bring-your-own-vulnerable-driver utility used by RansomHub affiliates to disable endpoint protection. The tool loads a signed but vulnerable driver to terminate security agents from kernel space, so any execution is a critical pre-ransomware defense-evasion event.

Suspicious Cloud Exfiltration via Rclone Linked to INC Ransomware

This rule detects rclone invoked with copy or sync arguments toward a remote target, an exfiltration technique used by INC ransomware operators. Attackers use rclone to push stolen data to cloud storage before encryption, so command-line rclone transfers on servers and workstations are a strong exfiltration indicator.

Suspicious Selective Archiving via 7-Zip Linked to INC Ransomware Exfiltration

This rule detects 7-Zip archiving that explicitly excludes executable, video, and virtual-disk file types, a staging pattern seen in INC ransomware data theft. Operators exclude bulky non-document files to keep exfiltration archives small and focused on sensitive documents, so exclusion switches on 7-Zip are a targeted collection signal.

Suspicious Executable Launched From AppData Roaming Linked to GootLoader

This rule detects processes executing directly from the user AppData Roaming directory, a location GootLoader uses to stage and run its payloads. Legitimate installers occasionally run from AppData, so this pattern is heuristic, but user-writable execution paths are a common malware staging behavior warranting review.

Suspicious Batch Script Execution From Temp via Command Interpreter Linked to GootLoader

This rule detects the Windows command interpreter launching a .bat file located in a Temp directory, an execution pattern used by GootLoader scheduled-task persistence. GootLoader registers a task that runs command.exe against a batch file dropped in Temp to relaunch its loader, so command-interpreted batch files from Temp are a strong indicator of this loader.

Suspicious BrightMetricAgent Remote Tool Execution Associated With Volt Typhoon

This rule detects execution of brightmetricagent.exe, a remote support agent binary abused during Volt Typhoon intrusions for persistent access. Because this specific agent is uncommon in most enterprise fleets and was used as attacker tooling, its presence on endpoints should be verified against sanctioned software inventories.

Suspicious Misspelled WMIC Binary Execution Associated With Volt Typhoon

This rule detects execution of a binary named wminc.exe, a misspelled masquerade of the legitimate wmic.exe tied to Volt Typhoon living-off-the-land tradecraft. The deliberately mistyped name is an anomalous constant that legitimate software does not produce, so any execution is highly suspicious and worth immediate triage.

Suspicious Data Exfiltration via WinSCP Command Line in BlackSuit Ransomware

This rule detects WinSCP driven from the command line with an embedded session and scripted transfer commands, an exfiltration behavior used by BlackSuit ransomware operators. Attackers script WinSCP to push stolen data to attacker-controlled SFTP servers before encryption, so scripted WinSCP sessions on servers are a strong exfiltration signal.

Suspicious Remote Process Creation via WMIC in BlackSuit Ransomware

This rule detects wmic.exe invoking process creation against a remote node, a lateral-movement technique used by BlackSuit ransomware affiliates. Attackers abuse WMI to spawn payloads on other hosts without dropping remote services, so remote wmic process calls warrant investigation.

Malicious Volume Shadow Copy Deletion via BlackSuit Ransomware

This rule detects deletion of volume shadow copies through vssadmin, wmic, or PowerShell as seen in BlackSuit ransomware operations. Adversaries remove shadow copies to inhibit system recovery immediately before file encryption, so this activity is a strong indicator of imminent ransomware impact.

Malicious Boot Configuration Tampering to Disable Recovery via BlackSuit Ransomware

This rule detects bcdedit being used to delete recovery settings or force safe boot, an inhibit-system-recovery behavior observed in BlackSuit ransomware intrusions. Operators run this before encryption to prevent victims from booting into recovery and to weaken protections, making it a high-value pre-encryption signal.

Suspicious LNK Persistence Dropped in Startup Folder

This rule detects creation of shortcut files inside the user Start Menu Startup directory which Spectre RAT uses to persist across reboots. Unexpected LNK files written to the Startup folder are a reliable indicator of autostart based persistence.

Suspicious Execution Delay via Ping to Loopback Address

This rule detects ping.exe being directed at the loopback address which Spectre RAT uses as a time based execution delay to evade sandbox analysis and space out its actions. Pinging localhost in combination with follow on execution is a common defense evasion trick seen in loaders and RATs.

Suspicious MsMpEng Execution from Non-Standard Directory

This rule detects the Microsoft Defender engine binary MsMpEng.exe running from a directory outside its trusted install paths which indicates an infostealer masquerading as a security process to blend in. The legitimate MsMpEng only executes from the Defender platform directory so any other location is highly suspicious.

Malicious Windows Event Log Clearing via wevtutil

This rule detects wevtutil being used to clear or reconfigure Windows event logs which Evil Corp operators perform to destroy forensic evidence of their intrusion. Clearing event logs is a deliberate anti forensic action that legitimate administrators rarely automate on endpoints.