Sigma detection rules, expert-reviewed

Possible Azure Storage Ransomware via Customer-Managed Key Encryption

This rule detects Azure Activity operations that rewrite storage account encryption to attacker-controlled key material, a hijack path for blob storage ransomware. Writing an encryption scope or setting the account key source to Key Vault lets an actor re-encrypt blobs under a key they hold and then deny the victim access. These control-plane encryption changes on production storage accounts warrant urgent review.

Suspicious Enabling of Remote Desktop via fDenyTSConnections Registry by DeadLock Ransomware

This rule detects modification of the fDenyTSConnections value to zero which enables inbound Remote Desktop connections. The DeadLock ransomware operators enable RDP and open the firewall to facilitate lateral movement. Enabling remote desktop on compromised hosts expands attacker access across the environment.

Suspicious ThrottleStop Driver Abuse for Defense Evasion in Ransomware Attacks

This rule detects execution of the ThrottleStop utility which ships a vulnerable driver abused to disable endpoint protection. Ransomware operators in Japanese incidents load ThrottleStop as part of their EDR-killer tooling before encryption. Bring-your-own-vulnerable-driver tools let an actor terminate security software from kernel space.

Suspicious Local Account Creation via Net User in Pre-Ransomware Phase

This rule detects creation of a new account using net user with the add flag. Ransomware actors targeting Japanese organizations create rogue accounts such as Attacker1 for persistence before deploying encryption. New account creation during an intrusion often precedes hands-on ransomware staging.

Suspicious Domain Controller Enumeration via Nltest by DeadLock Ransomware

This rule detects use of nltest to list domain controllers during reconnaissance. The DeadLock ransomware actors run nltest and quser to map the domain prior to lateral movement. Domain controller enumeration is an early sign of an actor preparing to spread across the network.

Malicious Disabling of Microsoft Defender Real-Time Protection via SystemSettingsAdminFlows by DeadLock Ransomware

This rule detects use of SystemSettingsAdminFlows to toggle Microsoft Defender real-time protection. The DeadLock ransomware loader invokes this living-off-the-land binary to disable endpoint protection before deploying its payload. Turning off real-time protection blinds the defender to subsequent malicious activity.

Suspicious Cloudflared Tunnel Execution for Command and Control by Kraken Ransomware

This rule detects execution of the cloudflared client to establish an outbound tunnel. The Kraken ransomware group abuses Cloudflare Tunnel together with SSHFS and RDP to maintain covert access and move laterally. Attacker use of cloudflared can bypass perimeter controls by tunneling traffic over trusted Cloudflare infrastructure.

Malicious Mass Hyper-V Virtual Machine Shutdown via PowerShell by Kraken Ransomware

This rule detects PowerShell forcibly stopping Hyper-V virtual machines by piping Get-VM into Stop-VM with the force and turnoff switches. This technique is used by the Kraken ransomware group to shut down virtualized workloads before encryption. Terminating running virtual machines unlocks their files for encryption and maximizes operational impact.

Suspicious Shadow Copy Deletion via Vssadmin by Kraken Ransomware

This rule detects deletion of Volume Shadow Copies using vssadmin with the delete shadows and all flags. This behavior is associated with the Kraken ransomware group which inhibits system recovery prior to encryption. Removing shadow copies prevents victims from restoring files without paying the ransom.

Suspicious Ransomware Fan-Out Deployment via PsExec Spread (Qilin)

This rule detects execution of a deployment tool with a spread argument used by the Qilin group to push its ransomware encryptor across hosts. Automated fan-out deployment over remote channels is a lateral-movement and impact accelerant. The spread flag distinguishes mass deployment from routine remote administration.

Suspicious Security Software Uninstallation via WMIC Product Call Uninstall (Chaos Ransomware)

This rule detects use of WMIC to silently uninstall installed software via the product call uninstall method. The Chaos ransomware group leverages this to remove multi-factor authentication agents and security tooling prior to encryption. Programmatic uninstallation of defensive software is an impair-defenses technique that precedes impact.

Suspicious OpenSSH Reverse Tunnel Over HTTPS Port (Chaos Ransomware)

This rule detects use of the OpenSSH client to establish a reverse tunnel with the -R option forwarding traffic over port 443. The Chaos ransomware group abuses OpenSSH reverse tunneling to blend remote access and command-and-control into HTTPS traffic. Reverse tunnels over common web ports are used to evade network monitoring and maintain covert access.

Malicious Remote Encryptor Execution via WMIC Process Call Create (Chaos Ransomware)

This rule detects the Chaos ransomware group using WMIC to remotely spawn its encryptor binary with campaign-specific arguments such as lkey, encrypt_step and work_mode. Remote process creation over WMI is used to deploy the encryptor across the network. This behavior indicates active ransomware deployment combined with lateral movement.

Malicious Scheduled Task Creation TaskSystem via Interlock Ransomware

This rule detects creation of a scheduled task named TaskSystem that runs in the SYSTEM context which Interlock ransomware operators use to establish persistence and execute payloads with elevated privileges. The fixed task name combined with SYSTEM execution distinguishes this from routine administrative task creation.

Suspicious CyberLock Ransomware Encrypted File Creation

This rule detects creation of files bearing the .cyberlock extension, the marker appended by the ransomware distributed through fake AI-tool installers. Appearance of this extension indicates active encryption of user data on the host and imminent extortion.