Sigma detection rules, expert-reviewed

Malicious Volume Shadow Copy Deletion for Ransomware Recovery Inhibition

This rule detects deletion of volume shadow copies and disabling of Windows recovery through vssadmin wmic and bcdedit as performed prior to Hive ransomware encryption and this matters because destroying shadow copies and recovery options immediately before mass file encryption is a defining behavior of ransomware impact and rarely legitimate on production systems.

Malicious JADEPUFFER Lockd Ransomware Payload Download

This rule detects download of the lockd ransomware binary into a hidden temp directory, the staging step of the evolved JADEPUFFER campaign built to destroy AI models. The actor writes the encryptor to a concealed path before execution. This named artifact in a hidden directory is a strong ransomware deployment indicator.

Suspicious Mass Locked Extension File Creation by Ransomware

This rule detects creation of files with a locked extension, the encryption footprint left by the evolved JADEPUFFER ransomware as it encrypts AI model files across the host. Each encrypted file is renamed with this suffix during the impact phase. A burst of such files indicates active ransomware encryption requiring immediate response.

Malicious Interlock Ransomware Encrypted File and Note Creation (via file_event)

This rule detects creation of files bearing the Interlock ransomware extension or its ransom note marker. The Interlock ransomware appends the interlock extension to encrypted files and drops a note referencing !NT3R10CK. Observing these file artifacts confirms active encryption on the host.

Suspicious File Download via bitsadmin Transfer by Medusa Ransomware

This rule detects use of bitsadmin with the transfer argument to download files through the Background Intelligent Transfer Service, matching tooling ingress used by Medusa ransomware operators per Unit 42. Adversaries abuse the trusted bitsadmin utility to fetch payloads while evading application controls which supports staging of ransomware components.

Malicious CatB Ransomware Oci.dll Hijack via Msdtc (via image_load)

This rule detects the Microsoft Distributed Transaction Coordinator service loading an oci.dll, the phantom DLL hijack CatB ransomware abuses by planting its payload in System32 where msdtc.exe searches for the absent Oracle Call Interface library. Windows ships no oci.dll by default, so this load reliably indicates the CatB persistence and execution mechanism rather than a genuine Oracle dependency.

Malicious Ransomware Encryption Extension x2anylock

This rule detects files being created or renamed with the .x2anylock extension. The ransomware deployed in the Project AK47 campaign appends this extension to encrypted files. Mass creation of .x2anylock files is a definitive indicator of active ransomware encryption.

Malicious SafePay Ransomware Encryptor Command-Line Execution

This rule detects the SafePay ransomware encryptor invoked with its characteristic password, encryption and self-delete parameters used to encrypt targeted paths and remove the binary afterward. This combination of flags is unique to the SafePay payload and indicates active data-encryption impact.

Malicious Recon Output Staged in Qlik Sense Fonts Directory by Cactus Ransomware

This rule detects discovery command output being redirected into the Qlik Sense web-served fonts directory using the qle.ttf or qle.woff filenames, a data-staging technique used by Cactus ransomware operators after exploiting Qlik Sense to make recon results retrievable over HTTP. Writing whoami or quser output into a webroot fonts path is a strong indicator of hands-on-keyboard exploitation.

Malicious The Gentlemen Ransomware Encryptor via Distinctive CLI Flags

This rule detects execution of The Gentlemen ransomware Go encryptor invoked with its signature command line flags controlling self propagation and fast encryption. The presence of these operator flags together indicates active deployment of a self-propagating encryptor and imminent data destruction across the environment.

Suspicious Windows Event Log Cleared via wevtutil during Ransomware Staging (via process_creation)

This rule detects wevtutil clearing an event log, the anti-forensic action taken during the CLFS zero-day intrusion to erase evidence before ransomware encryption. Adversaries clear logs such as Application to hinder response after credential theft and recovery inhibition, so wevtutil cl outside sanctioned maintenance is an indicator of tampering.

Malicious System Recovery Inhibition via bcdedit and wbadmin before Ransomware (via process_creation)

This rule detects recovery-inhibition commands that disable Windows automatic recovery via bcdedit or delete the backup catalog via wbadmin, the pre-encryption destruction step in the CLFS zero-day intrusion that led to ransomware. Adversaries remove recovery options to maximize damage and pressure victims, so these commands appearing together with staging activity are a critical pre-ransomware indicator.

Malicious GigaWiper Ransomware File Extension .candy

This rule detects creation of files with the .candy extension, the marker appended to encrypted files by the GigaWiper destructive backdoor. A burst of files gaining this extension indicates active data destruction and encryption in progress across the host.

Suspicious Firewall Rule Allowing SSH via New-NetFirewallRule During Ransomware

This rule detects a PowerShell New-NetFirewallRule command that opens the host for sshd inbound access as observed when ransomware operators enable SSH for lateral movement and persistence. Attackers create this rule to establish a resilient remote access path across the environment.

Suspicious Scheduled Task Launching rundll32 DLL via Ransomware

This rule detects schtasks creating a task that periodically executes rundll32 against a DLL as observed in ransomware persistence and re execution routines. Attackers schedule loader DLLs to survive reboots and re trigger their payload on a recurring interval.