Sigma detection rules, expert-reviewed

Possible Ransomware Pre-Encryption VM Termination via esxcli

This rule detects use of esxcli to force kill running virtual machines, a step ransomware performs on ESXi hosts to unlock VM disk files before encryption. Multiple studied families run vm process kill with type force to stop guests prior to mass encryption. Detecting it can interrupt the attack before data is locked.

Suspicious Execution of spools.exe from Public Directory

This rule detects execution of a binary named spools.exe from the C-Users-Public directory, a masquerade of the Windows print spooler dropped by the IndigoZebra APT. Placing a spooler lookalike in a world writable public path is a strong sign of the group dropper. This catches the staged payload before it establishes persistence.

Malicious NTDS.dit Extraction via Ntdsutil (via process_creation)

This rule detects ntdsutil creating an Install From Media snapshot of the Active Directory database, the domain credential theft step used in Rhysida ransomware intrusions. Dumping NTDS.dit exposes every domain hash and is a high-severity precursor to full domain compromise.

Malicious Shadow Copy and Backup Catalog Deletion (via process_creation)

This rule detects deletion of volume shadow copies or the backup catalog through vssadmin, wmic, or wbadmin, an inhibit-recovery action executed by the Rorschach ransomware. Removing shadow copies and backups prevents victims from restoring encrypted files and is a defining ransomware behaviour.

Malicious Boot Recovery Disabled via Bcdedit (via process_creation)

This rule detects bcdedit disabling boot recovery or ignoring boot failures, an inhibit-recovery step performed by the Rorschach ransomware before encryption. Tampering with the boot configuration to block Windows recovery is a hallmark of ransomware preparing to deny system restoration.

Malicious Regsvr32 ShellExec_RunDLL Proxy Execution (via process_creation)

This rule detects regsvr32 invoking shell32.dll ShellExec_RunDLL with the unregister and silent flags, a proxy execution trick used by Raspberry Robin to run commands through a trusted binary. This LOLBIN pattern is used to evade application controls and is not produced by normal component registration.

Malicious LSASS Credential Dump via ProcDump (via process_creation)

This rule detects ProcDump being used to create a full memory dump of the LSASS process, a credential access technique observed in the Agrius MoneyBird intrusions against Israeli organizations. Adversaries dump LSASS to harvest cached credentials and enable lateral movement, so this activity strongly indicates hands-on-keyboard compromise.

Malicious dal_keepalives.dll Sideloaded By Signed Binary (via image_load)

This rule detects loading of dal_keepalives.dll, a uniquely named malicious module sideloaded through signed binaries in the Stayin Alive campaign against telecoms and government ministries in Asia. The specific DLL name is a distinctive loader artifact with no legitimate use.

Malicious Storm-2603 Ransom Note File Creation

This rule detects the creation of the ransom note file 'How to decrypt my data.txt' dropped by Storm-2603 ransomware payloads. Appearance of this file across user directories signals that file encryption has already executed on the host and the operator is presenting extortion instructions to the victim.

Possible Akira Ransomware Note or Encrypted Extension Creation

This rule detects creation of files with the akiranew extension or the akiranew.txt ransom note produced by the Akira Rust ransomware variant. Both artifacts appear only after files have been encrypted on the host. Detecting them confirms an active Akira encryption event for rapid isolation.

Possible Ransomware Note or Encrypted File Extension Creation

This rule detects creation of ransom note files or files renamed with encrypted extensions used by the ransomware families compared in this research. The specific note names and extensions appear only after data has been encrypted on the victim host. Detecting them confirms an active encryption event so responders can isolate the machine.

Possible React2Shell CVE-2025-55182 Prototype Pollution Exploitation

This rule detects web requests carrying prototype pollution markers that reach Node.js command execution primitives. This is the exploitation pattern for CVE-2025-55182 also known as React2Shell against public facing Node.js and React applications.

Xeno Stealer Persistence via Display Calibration Run Key

This rule detects creation of a Run key value named Display Calibration used by the Xeno stealer for autostart persistence. The value points to a JAR staged under the GameDVR directory and masquerades as a benign display setting.

Possible PurpleFox MSHTA to Msiexec Remote MSI Chain

This rule detects msiexec.exe spawned by mshta.exe to install a remotely hosted MSI package often disguised as an image file. This execution chain matches the PurpleFox loader delivery observed in MSHTA abuse campaigns.

Suspicious MSHTA VBScript WScript Shell Execution

This rule detects mshta.exe executing an inline vbscript command that instantiates WScript.Shell to run a child process. This fileless technique is used by PurpleFox and XWorm loaders to spawn cmd or PowerShell without dropping a script to disk.