Sigma detection rules, expert-reviewed

Suspicious Free Space Wiping via Cipher

This rule detects the cipher utility invoked with the wipe switch to overwrite deallocated disk space, destroying recoverable data. The ReadText34 ransomware operators ran cipher to hinder forensic recovery after encryption. Free-space wiping is an anti-recovery and anti-forensics action associated with the impact phase of ransomware.

Suspicious Svchost Masquerading Binary with Network Connect Flag

This rule detects execution of a binary named svhost.exe, a deliberate misspelling of the legitimate svchost service host, used to run a BianLian backdoor during the ReadText34 ransomware incident. The impostor process reached out with a connect flag to attacker command and control. A svchost look-alike executing from a non-system path is a strong masquerading indicator.

Suspicious Boot Configuration Change Disabling Integrity Checks

This rule detects bcdedit modifying boot load options to disable driver signature integrity checks, a prerequisite for loading unsigned or malicious kernel drivers. This was observed in the ReadText34 ransomware incident alongside bring-your-own-vulnerable-driver activity. Disabling integrity checks lets attackers load kernel-level tooling to tamper with security controls.

Suspicious Command Shell Spawned by MSSQL Server Process

This rule detects the SQL Server service process spawning a command shell or PowerShell, the behavioral signature of xp_cmdshell abuse observed in intrusions against Foundation accounting software. Attackers brute forced exposed database accounts and enabled xp_cmdshell to run operating system commands. Command execution from the database engine indicates hands-on-keyboard post-exploitation.

Suspicious Named Pipe Creation via Command Echo

This rule detects a command shell echoing data into a named pipe device path, a covert local inter-process channel used by an APT targeting Vietnamese human rights defenders for command output relay. Writing to the pipe device path from cmd is atypical of normal administrative activity. Named pipe abuse supports stealthy internal command and control and privilege operations.

Suspicious Scheduled Task Creation with Recurring Minute Interval

This rule detects creation of a scheduled task that recurs every 300 minutes via schtasks, matching persistence tasks used by an APT targeting Vietnamese human rights defenders. The actor masqueraded these tasks to blend with legitimate system activity. Recurring scheduled tasks provide durable persistence and periodic re-execution of implants.

Suspicious Security Product Process Termination via Named Utility

This rule detects command-line termination of the Cylance security service process, observed when INC ransomware operators killed endpoint protection to evade defenses. The command references the CylanceSvc.exe process together with a kill or process-target flag. Disabling running security products is a precursor to unimpeded lateral movement and encryption.

Suspicious Rclone Data Exfiltration with Include Filter

This rule detects use of the rclone cloud copy utility with an include-from filter list to selectively stage and exfiltrate files. Operators behind the INC ransomware intrusion used rclone to copy targeted data to attacker-controlled cloud storage prior to encryption. Selective bulk copying to cloud storage is a strong indicator of pre-ransomware data theft.

Suspicious Windows Defender Disabling via SystemSettingsAdminFlows

This rule detects abuse of the legitimate SystemSettingsAdminFlows binary to disable Windows Defender protections from the command line. This tradecraft was observed in an intrusion that escalated from LOLBin abuse to INC ransomware deployment, where operators disabled defenses before staging and encryption. Blinding endpoint protection precedes data theft and ransomware and warrants immediate review.

Certutil Decoding Encoded Payload to Executable

This rule detects certutil.exe invoked with the decode option to convert an encoded file back into an executable, a deobfuscation step that evades content inspection of the transferred payload. Huntress observed this after a compromised MSSQL host fetched a PHP-served payload and reconstructed it on disk. Using certutil to decode files is a well-known living-off-the-land technique for payload staging.

Restic Backup Tool Exfiltration to Cloud Object Storage

This rule detects the restic backup utility or its environment variables being used together with a cloud object storage endpoint such as Backblaze B2 or Wasabi. Huntress observed operators abusing restic, sometimes renamed to dns.exe, to back up and exfiltrate victim data to attacker-controlled buckets. Pairing backup tooling with third-party object storage destinations indicates data theft rather than sanctioned backup.

BlackCat ALPHV Ransomware Execution With access-token Argument

This rule detects a process launched with the --access-token argument required by the BlackCat ALPHV ransomware encryptor to unlock and run. Huntress observed affiliates passing this token to detonate the payload on compromised hosts. The mandatory access-token flag is a distinctive execution signature that separates this ransomware from benign tooling.

WMI Event Consumer Persistence Named System__Cmr

This rule detects references to the WMI event consumer name System__Cmr, a persistence artifact created during ScreenConnect post-exploitation to re-execute payloads on system events. Huntress recovered this named consumer as an operator-specific persistence mechanism. The distinctive consumer name is a reliable indicator of this intrusion set installing WMI-based persistence.

Windows Defender Exclusion Path Added via Add-MpPreference

This rule detects PowerShell adding a Windows Defender exclusion path with Add-MpPreference, a defense-evasion step that lets subsequent payloads run without antivirus inspection. Huntress observed this during ScreenConnect post-exploitation to shield dropped tooling. Attacker use typically excludes staging directories immediately before payload delivery.

Exchange Worker Process Spawning Command Shell via OWASSRF

This rule detects the IIS Exchange worker process w3wp.exe spawning cmd.exe or PowerShell, a hallmark of web-facing exploitation such as the OWASSRF Exchange remote code execution chain. Huntress observed base64-encoded PowerShell whoami commands launched this way for post-exploitation reconnaissance. Shell children of the Exchange worker almost always indicate a webshell or server-side request forgery exploit.