Sigma detection rules, expert-reviewed

Malicious Windows Event Log and Backup Clearing by BabLock Ransomware

This rule detects clearing of Windows event logs and deletion of the backup catalog performed by BabLock ransomware. The operators run wevtutil clear-log and wbadmin to erase forensic evidence and remove backups. This anti-forensic behavior hampers incident response and blocks recovery.

Suspicious Remote Desktop Enablement via Registry fDenyTSConnections

This rule detects the fDenyTSConnections registry value being set to zero from the command line which the Hancitor to Cuba operators use in rdp.bat to enable Remote Desktop for interactive access. Turning on RDP alongside firewall changes opens a hands-on-keyboard lateral movement channel. It matters because attacker driven RDP enablement precedes ransomware staging.

Malicious Credential Dumping via Mimikatz Sekurlsa Commands

This rule detects Mimikatz sekurlsa commands such as logonpasswords and pth on the command line which the Hancitor to Cuba ransomware operators use to steal credentials and perform pass the hash. These modules extract cleartext passwords and hashes from LSASS memory. Detecting them exposes active credential theft driving lateral movement toward ransomware deployment.

Malicious Volume Shadow Copy Deletion via Vssadmin

This rule detects vssadmin deleting all volume shadow copies quietly which Eldorado ransomware runs to inhibit system restore before encryption. Removing shadow copies prevents victims from recovering files without paying the ransom. It is important because shadow copy deletion is a reliable pre-encryption impact indicator.

Suspicious Screen and Audio Capture via Problem Steps Recorder

This rule detects psr.exe being started in silent capture mode which the Dark Pink APT repurposes to record victim screen activity for espionage. The Problem Steps Recorder is a signed Windows utility rarely launched from automation or headless flags. It matters because unattended psr execution indicates covert surveillance of the user.

Malicious Termination of Veeam Backup Services

This rule detects command line termination of Veeam backup services which BlackMatter ransomware performs to disable backups before encrypting data. Stopping backup and recovery services prevents victims from restoring files and maximizes extortion leverage. It matters because deliberate backup service teardown is a strong pre-encryption indicator.

Suspicious Process Creation via WMIC Process Call Create

This rule detects wmic.exe launching a new process through the process call create method which APT41 leverages for stealthy local and remote execution. The technique spawns children under WmiPrvSE outside normal parent chains to evade detection. It matters because it is a frequent whitelisting bypass used during hands-on-keyboard activity.

Suspicious Scheduled Task Created to Run at System Startup

This rule detects schtasks.exe creating a task triggered on system startup which APT41 uses to persist its implants across reboots. The onstart trigger runs the payload with elevated context before user interaction. It is important because startup triggered tasks are a durable and often overlooked persistence vector.

Malicious LSASS Memory Dump via Procdump

This rule detects a full memory dump of lsass.exe requested on the command line which APT41 performs with procdump to extract cleartext credentials and hashes. The dumped process memory is exfiltrated and parsed offline with Mimikatz. Detecting it exposes an active credential theft attempt against the LSA subsystem.

Malicious NTDS Extraction via Ntdsutil IFM Snapshot

This rule detects ntdsutil.exe creating an Install From Media snapshot which APT41 abuses to dump the Active Directory NTDS.dit database and SYSTEM hive from a domain controller. The technique harvests every domain credential hash for lateral movement. It is high value because legitimate IFM creation is rare and tightly scoped.

Suspicious Certutil Decode of Payload to Executable

This rule detects certutil.exe being invoked with a decode flag which APT41 uses to reconstruct an encoded payload such as dns.txt into an executable dns.exe. The living-off-the-land technique evades download-based detection by decoding a locally staged file. It matters because it is a common APT41 first-stage unpacking step.

Suspicious Node.js Spawning Python or Tar Interpreter

This rule detects node.exe spawning python.exe or tar.exe which reflects the Lazarus loader chain where a malicious server.js executes downloaded Python payloads and unpacks archives. The behaviour extracts and runs second-stage InvisibleFerret and BeaverTail components. It is important because it reveals code execution smuggled through a seemingly benign development runtime.

Possible Krasue Linux RAT Command and Control on Uncommon Port 52699

This rule detects network traffic to the uncommon port 52699 which the Krasue Linux RAT uses for its embedded command and control server on compromised hosts. The rootkit hides this port range while relaying operator commands over it. Detecting connections to it can surface Krasue infected servers despite the kernel level concealment.

Suspicious svchost.exe Loading Unsigned DLL (via image_load)

This rule detects svchost.exe loading an unsigned DLL, a service-hosting abuse pattern highlighted by Group-IB hunting guidance where malicious service DLLs are loaded into the shared Windows service host process. Adversaries leverage service DLL loading to run code under a trusted process and blend with legitimate service activity, making unsigned loads worth surfacing for baselining and outlier review.

Suspicious Acrobat.exe Loading Co-located DLL from ProgramData

This rule detects a signed Acrobat.exe located under ProgramData side-loading a co-located Acrobat.dll. Adversaries plant an unsigned malicious DLL beside a legitimate signed executable in ProgramData so it is loaded under a trusted process. This masquerade plus wrong-path context is a strong indicator of DLL side-loading.