Sigma detection rules, expert-reviewed

Malicious Shadow Copy Deletion via WMIC by DragonForce Ransomware (via process_creation)

This rule detects WMIC invoking shadowcopy delete to destroy Volume Shadow Copies, an inhibit-recovery step performed by DragonForce ransomware prior to file encryption. Removing shadow copies prevents victims from restoring data without paying. Detecting this command provides a high-fidelity late-stage ransomware indicator.

Suspicious Hidden PowerShell Download Cradle Used by DragonForce Ransomware (via process_creation)

This rule detects PowerShell executed with a hidden window that also invokes a remote download cradle, matching the DragonForce ransomware intrusion pattern for staging Cobalt Strike beacons. Operators use this to fetch second-stage payloads while evading user visibility. Early detection blocks the ransomware kill chain before encryption and lateral movement.

Malicious Safe Mode Boot Configuration via bcdedit safeboot network (via process_creation)

This rule detects bcdedit configuring the system to boot into Safe Mode with networking via the safeboot network option, a technique used by RansomHub to run encryption where security tools are disabled per Group-IB. Adversaries force a Safe Mode reboot to bypass endpoint defenses before encrypting, making this a strong pre-impact signal.

Malicious Windows Event Log Clearing via wevtutil (via process_creation)

This rule detects clearing of the Security, System and Application event logs using wevtutil, an anti-forensic action performed by RansomHub per Group-IB. Adversaries clear event logs to destroy evidence of intrusion and encryption, so this activity is a strong indicator of active compromise cleanup.

Suspicious Symlink Evaluation Enablement via fsutil behavior set (via process_creation)

This rule detects fsutil enabling remote-to-local and remote-to-remote symbolic link evaluation through fsutil behavior set SymlinkEvaluation, a configuration change used by RansomHub to reach and encrypt data across links per Group-IB. Adversaries relax symlink restrictions to broaden encryption scope, so this uncommon command warrants review.

Malicious Shadow Copy Deletion via PowerShell Win32_ShadowCopy Remove-CimInstance (via process_creation)

This rule detects PowerShell deleting Volume Shadow Copies by pairing Get-CimInstance Win32_ShadowCopy with Remove-CimInstance, a recovery-inhibition command used by RansomHub per Group-IB. Adversaries remove shadow copies through CIM to block restoration before encryption, making this a strong pre-impact indicator.

Malicious MuddyWater Named Payload Execution from ProgramData and Public Paths (via process_creation)

This rule detects execution of the MuddyWater payloads sysprocupdate.exe from ProgramData and Mononoke.exe from the Public user directory documented by Group-IB. Adversaries stage these named backdoor and persistence binaries in these locations to blend with system files, so their execution indicates MuddyWater activity.

Malicious Masquerading via IEXPLORE.EXE OriginalFileName on Unexpected Image (via process_creation)

This rule detects a process carrying the OriginalFileName IEXPLORE.EXE while running from an image other than the legitimate Internet Explorer binary, a masquerading pattern surfaced in Group-IB Hunting Rituals analysis of Autodrive.exe. Adversaries copy the Internet Explorer version resource onto renamed or relocated binaries to blend in, so a mismatch between the original filename and the actual image path indicates masquerading.

Malicious Hunters International Ransomware Encryptor Execution via Distinctive CLI Flags (via process_creation)

This rule detects the Hunters International encryptor invoked with its distinctive flags such as --low-key, --no-erase and --no-remote documented by Group-IB. Adversaries pass these flags to control process termination, skip files and limit remote encryption during deployment, so the combination is a high-confidence sign of Hunters encryption.

Malicious Shadow Copy and Backup Deletion via vssadmin wmic and wbadmin (via process_creation)

This rule detects deletion of Volume Shadow Copies and system backups through vssadmin delete shadows, wmic shadowcopy delete and wbadmin delete commands used by the Hunters International ransomware group per Group-IB. Adversaries remove these recovery points to prevent restoration before encrypting data, so this activity is a strong indicator of imminent ransomware impact.

Malicious DeadLock Ransomware Dropper Masquerading as svhost.exe (via process_creation)

This rule detects execution of svhost.exe, a deliberate misspelling of the legitimate svchost.exe used as the DeadLock ransomware dropper filename reported by Group-IB. Adversaries name the dropper to visually mimic the Windows service host and evade cursory review, so any svhost.exe process is a strong malicious indicator.

Suspicious PrivacyDrive.exe Execution from AppData Directory (via process_creation)

This rule detects execution of PrivacyDrive.exe from a user AppData path, a payload staging location seen in Group-IB ClickFix intrusions delivering the LummaC2 stealer. Adversaries run binaries from AppData to evade path-based controls and stage stealer components, so this location and name combination warrants review.

Suspicious PowerShell Download Cradle via Invoke-WebRequest Piped to iex (via process_creation)

This rule detects a PowerShell download cradle that retrieves content with Invoke-WebRequest and executes it through iex, the secondary SMOKESABER stage in Group-IB ClickFix intrusions. Adversaries use this in-memory fetch-and-execute pattern to run remote scripts without touching disk, making it a reliable indicator of staged payload delivery.

Malicious Lynx Ransomware Encryptor Execution via Distinctive CLI Flags (via process_creation)

This rule detects the Lynx ransomware encryptor launched with its distinctive command-line flags such as --encrypt-network, --load-drives, --stop-processes and --safe-mode documented by Group-IB. Adversaries pass these flags to terminate processes, mount hidden drives and encrypt network paths during deployment, so the combination is a high-confidence sign of active Lynx encryption.

Suspicious Windows Service Creation via New-Service or nssm

This rule detects Windows service creation through the PowerShell New-Service cmdlet or the nssm service manager. Adversaries use these methods as alternatives to sc.exe to install persistent services. Unexpected use of these tools to register services should be investigated.