Sigma detection rules, expert-reviewed

Malicious Akira Ransomware Ransom Note Creation

This rule detects creation of the Akira ransomware ransom note akira_readme.txt on disk. Akira writes this note across encrypted directories as part of its extortion workflow. Ransom note creation confirms active or completed encryption on the host and demands immediate response.

Malicious INC Ransomware Ransom Note Creation

This rule detects creation of the INC ransomware ransom note file INC-README.txt on disk. INC ransomware writes this note across encrypted directories during and after the encryption phase. Ransom note creation is a high-confidence indicator that encryption is underway or complete on the host.

ScreenConnect Administrator Provisioning XML Written to Temp Directory (CWE-288)

This rule detects XML files written under the Windows Temp ScreenConnect directory, where exploitation of the ConnectWise authentication bypass (CWE-288) drops a temporary User definition to provision a rogue administrator. Huntress observed newly created admin entries with null default login dates confirming abuse. Any XML staged in this temp path during setup indicates unauthorized account creation via the vulnerability.

Malicious INC Ransom Ransom Note File Creation

This rule detects creation of files ending in inc-readme.txt, the ransom note dropped by the INC Ransom group after encryption. Widespread creation of this note filename across a host indicates active ransomware impact and demands immediate response.

Suspicious ASP.NET ViewState Deserialization Failure Event During Gladinet Exploitation

This rule detects ASP.NET ViewState validation and deserialization failure event 1316 which was observed being generated during exploitation of the Gladinet CentreStack and Triofox cryptography vulnerability. A burst of these events on an internet-facing server can indicate an attacker probing or abusing a forged ViewState to achieve deserialization-based code execution. Correlate with subsequent process creation from the IIS worker process to confirm compromise.

Suspicious Run Key Persistence With Masqueraded System Binary by Millenium RAT (via registry_set)

This rule detects a CurrentVersion Run key pointing to a binary named svchost.exe or MsEdgeUpdate.exe located under a user-writable AppData, Temp, or Public path, matching the Millenium RAT persistence and masquerading technique. Legitimate copies of these binaries never run from those locations, so the wrong path plus a trusted name is a strong tell. Detecting it exposes RAT persistence.

Suspicious Autostart Persistence via Run Key Pointing Outside Program Files (via registry_set)

This rule detects creation or modification of a Run or RunOnce registry value whose data points to an executable outside the Program Files directories, a persistence-hunting heuristic from Group-IB Hunting Rituals. Adversaries register autostart entries that launch payloads from user-writable locations to survive reboot, so Run values referencing non-standard paths warrant review.

Suspicious Modification of Service ImagePath or ServiceDll

This rule detects modification of a service ImagePath or ServiceDll value in the registry. Adversaries alter these values to hijack existing services or point them at malicious binaries for persistence and SYSTEM-level execution. Review changes for unsigned or unusual target paths, as legitimate updates also touch these keys.

Malicious Windows Defender Real-Time Protection Disabled via Registry

This rule detects registry modifications that disable Windows Defender real-time and behavior monitoring. Bundled malware sets DisableRealtimeMonitoring and DisableBehaviorMonitoring to one to blind the built-in antivirus. Turning off protection precedes deployment of stealers and remote access payloads.

Suspicious Logon Script Persistence via UserInitMprLogonScript

This rule detects a value written to the UserInitMprLogonScript key which the Dark Pink APT abuses together with forfiles.exe to autorun a payload at every user logon. This environment key is almost never set legitimately so its modification is a strong persistence signal. It is important because logon script persistence survives reboots and is frequently overlooked.

Malicious Winlogon Shell Hijack Loading MSBuild

This rule detects the Winlogon Shell value being altered to reference MSBuild which the Dark Pink APT uses to persist and proxy execute code at logon through a trusted developer binary. The Shell key should only launch explorer.exe so any MSBuild reference signals abuse. It matters because it combines stealthy persistence with signed binary proxy execution.

Suspicious RunOnce Persistence Relaunching Payload with Safe Mode Flag

This rule detects a RunOnce registry value configured to relaunch a binary with a safe mode argument which BlackMatter ransomware sets to resume encryption after rebooting the host into Safe Mode. Running in Safe Mode disables security tooling while the RunOnce entry guarantees the payload restarts. It is important because this combination signals an in-progress ransomware detonation.

Windows: Detect Defendnot HackTool Process Execution

Alerts on Windows process executions referencing Defendnot, including its URL and known IMPHASH values.

Uncommon Child Process Spawned by XBootMgrSleep.exe (Windows Performance Toolkit)

Alerts when XBootMgrSleep.exe launches an unexpected child process on Windows, indicating potential delayed execution abuse.

Suspicious ftp.exe Script Execution via -s Flag by JadeProx TriBack Loader (via process_creation)

This rule detects the Windows ftp.exe client executing a script file through the -s flag, a living-off-the-land technique the JadeProx TriBack loader uses to run attacker-supplied commands from script.dat. Abusing ftp.exe as a script runner evades controls focused on interpreters. Detecting this invocation exposes JadeProx staging activity.