Sigma detection rules, expert-reviewed

Suspicious ESXi execInstalledOnly Disabled via esxcli During Ransomware

This rule detects esxcli disabling the execInstalledOnly enforcement setting on an ESXi host which ransomware crews do to allow unsigned binaries to run before encrypting virtual machines. Attackers weaken hypervisor integrity controls to deploy their locker at scale.

Malicious Firewall Disable via netsh by Key Group Ransomware

This rule detects netsh disabling the Windows firewall for all profiles, a defense-evasion action performed by Key Group ransomware to weaken host protections before impact. Turning off the firewall across all profiles is rarely legitimate on production endpoints and precedes further malicious activity.

Suspicious Remote Desktop Enablement via Registry By Ransomware

This rule detects the registry change that clears fDenyTSConnections to enable inbound RDP on a host. The Qilin ransomware group flips this key to open a Terminal Server access path for lateral movement. Enabling RDP on a workstation that normally has it disabled is a strong pre-encryption footprint.

Malicious Snatch Ransomware SuperBackupMan SafeBoot Service Registration

This rule detects registration of the SuperBackupMan service or its SafeBoot Minimal registry key used by Snatch ransomware to force encryption while booted into Safe Mode where security tooling is inactive. The service name is a meaningful campaign constant tied to this defense-evasion technique. Its creation strongly indicates Snatch pre-encryption staging.

Suspicious Sysinternals EULA Acceptance Registry Write Linked to INC Ransomware

This rule detects the EulaAccepted registry value being written under a Sysinternals product key, indicating first-run command-line use of a Sysinternals tool as seen in INC ransomware intrusions. Because operators use PsExec and similar tools with the -accepteula flag, an unexpected EULA write on a server can reveal attacker tool staging, though administrators also trigger it legitimately.

Malicious CACTUS Ransomware Deployment via TotalExec Script (via ps_script)

This rule detects PowerShell content referencing the TotalExec deployment script combined with PsExec, the automation CACTUS uses to push ransomware across hosts. TotalExec wraps PsExec to remotely execute the encryptor on many machines at once, enabling network-wide impact.

Malicious Volume Shadow Copy Deletion Before Ransomware Encryption

This rule detects deletion of Volume Shadow Copies through vssadmin, wmic or PowerShell, an inhibit-recovery step the Qilin ransomware group performs before encrypting files. Removing shadow copies prevents victims from restoring data without paying. This activity almost always precedes or accompanies encryption.

Suspicious Service Termination via Net Stop Before Ransomware (via process_creation)

This rule detects net.exe being used to stop database, backup or security services, a staging step commonly seen before file encryption. Ransomware operators halt these services so that data files are unlocked and defensive tooling is silenced ahead of the payload. Targeted service shutdown of backup and security software is a high-value pre-encryption indicator.

Malicious Quantum Ransomware ttsel Payload Execution via Command Line

This rule detects execution of the ttsel.exe payload used during Quantum ransomware intrusions to stage tooling on compromised hosts. The named binary is a meaningful constant tied to this campaign chain that follows IcedID access. Its execution indicates hands-on-keyboard activity progressing toward ransomware deployment.

Suspicious Cloud Exfiltration via Rclone Linked to INC Ransomware

This rule detects rclone invoked with copy or sync arguments toward a remote target, an exfiltration technique used by INC ransomware operators. Attackers use rclone to push stolen data to cloud storage before encryption, so command-line rclone transfers on servers and workstations are a strong exfiltration indicator.

Suspicious Selective Archiving via 7-Zip Linked to INC Ransomware Exfiltration

This rule detects 7-Zip archiving that explicitly excludes executable, video, and virtual-disk file types, a staging pattern seen in INC ransomware data theft. Operators exclude bulky non-document files to keep exfiltration archives small and focused on sensitive documents, so exclusion switches on 7-Zip are a targeted collection signal.

Suspicious Data Exfiltration via WinSCP Command Line in BlackSuit Ransomware

This rule detects WinSCP driven from the command line with an embedded session and scripted transfer commands, an exfiltration behavior used by BlackSuit ransomware operators. Attackers script WinSCP to push stolen data to attacker-controlled SFTP servers before encryption, so scripted WinSCP sessions on servers are a strong exfiltration signal.

Suspicious Remote Process Creation via WMIC in BlackSuit Ransomware

This rule detects wmic.exe invoking process creation against a remote node, a lateral-movement technique used by BlackSuit ransomware affiliates. Attackers abuse WMI to spawn payloads on other hosts without dropping remote services, so remote wmic process calls warrant investigation.

Malicious Volume Shadow Copy Deletion via BlackSuit Ransomware

This rule detects deletion of volume shadow copies through vssadmin, wmic, or PowerShell as seen in BlackSuit ransomware operations. Adversaries remove shadow copies to inhibit system recovery immediately before file encryption, so this activity is a strong indicator of imminent ransomware impact.

Malicious Boot Configuration Tampering to Disable Recovery via BlackSuit Ransomware

This rule detects bcdedit being used to delete recovery settings or force safe boot, an inhibit-system-recovery behavior observed in BlackSuit ransomware intrusions. Operators run this before encryption to prevent victims from booting into recovery and to weaken protections, making it a high-value pre-encryption signal.