Sigma detection rules, expert-reviewed

Windows Process Command-Line Indicators of BlackByte Ransomware Activity

Flags Windows process creation command-line patterns consistent with BlackByte ransomware techniques.

BlackByte ransomware Registry Set Persistence and Privilege Changes (Windows)

Alerts on BlackByte-specific Windows registry value changes to DWORD 1 across three predefined keys.

Windows: .txt Created on User Desktop via cmd.exe

Flags cmd.exe creating .txt files under user Desktop, a common ransomware-style artifact placement pattern.

Microsoft 365 Cloud App Security - Potential Ransomware Activity Alerts on File Upload

Flags successful Microsoft Cloud App Security reports of potential ransomware-related file uploads in Microsoft 365.

Windows process creation patterns associated with DarkSide ransomware helpers

Detects Windows process creation consistent with DarkSide ransomware helper execution using encoded command-line content.

LockerGoga Ransomware Indicators in Windows Process Command Line

Flags Windows processes with a specific LockerGoga-style command-line argument pattern.

Windows Process Creation Indicators for Snatch Ransomware Word Document Droppers

Alerts on Windows process command lines showing instant safe-mode shutdown/reboot and stopping SuperBackupMan service.

Windows Process Creation: Maze Ransomware Doc Dropper and Shadow Copy Deletion Indicators

Alerts on Word-to-temp execution followed by wmic shadowcopy deletion consistent with Maze-style ransomware droppers.

Windows Process Execution Indicative of Ryuk-Style Ransomware Behavior

Flags suspicious Windows process command lines combining autorun persistence, public staging, file backup wiping, and service stoppage behavior.

Windows Application Logs: Match Antivirus/Malware Signature Keywords

Alerts on Windows application log lines containing known AV signatures and malware keywords, excluding some anti-ransomware/keygen/crack terms.