Sigma detection rules, expert-reviewed

Malicious Akira Shadow Copy Deletion via PowerShell WMI (via process_creation)

This rule detects PowerShell enumerating and deleting Volume Shadow Copies through WMI. Akira ransomware runs a PowerShell one-liner that queries Win32_Shadowcopy and calls Delete to remove backups before encryption, so this command indicates inhibition of system recovery during a ransomware attack.

Malicious Shadow Copy Deletion via WMI PowerShell

This rule detects PowerShell querying Win32_Shadowcopy through WMI and deleting the returned shadow copies, an alternative recovery-inhibition technique that avoids the vssadmin binary. It is associated with REvil ransomware-as-a-service affiliate operations seeking to destroy backups prior to encryption. Detecting the WMI-based variant closes a common evasion gap around shadow copy deletion.

Malicious Shadow Copy Deletion via WMI PowerShell (via ps_script)

This rule detects PowerShell that queries the Win32_Shadowcopy WMI class and then deletes the returned instances. Ransomware uses this WMI approach to remove Volume Shadow Copies without invoking vssadmin, evading command-line detections focused on that utility. Scripted shadow copy destruction through WMI is a clear recovery-inhibition behavior.

Malicious Volume Shadow Copy Deletion via Vssadmin or WMIC (via process_creation)

This rule detects deletion of Volume Shadow Copies through vssadmin or wmic. Ransomware removes shadow copies so that victims cannot roll back encrypted files from local snapshots, maximizing pressure to pay. Programmatic shadow copy deletion is a well-established impact behavior seen immediately before or during encryption.

Suspicious WMIC Remote Process Creation for Lateral Movement

This rule detects use of wmic with the /node switch to spawn processes on remote hosts, a lateral movement technique observed in Quantum ransomware intrusions alongside PsExec and C$ share abuse. Adversaries leverage WMI process call create to run payloads remotely without dropping additional tooling. Legitimate administrative WMI usage exists, so context and target frequency should be reviewed.

Suspicious System Discovery via WMIC Query Commands (via process_creation)

This rule detects wmic being used with path or list query parameters to enumerate system, operating-system and network configuration details. Adversaries abuse WMIC to profile a compromised host prior to lateral movement, so path and list query usage indicates hands-on discovery activity.

Suspicious Shadow Copy Deletion via WMIC or PowerShell (via process_creation)

This rule detects deletion of Volume Shadow Copies via wmic or PowerShell referencing the shadowcopy class with a delete operation. VanHelsing removes shadow copies before encryption to inhibit recovery, so this command pattern flags pre-ransomware impact activity.

Suspicious Impacket WMIExec Command Execution Pattern Linked to Salt Typhoon

This rule detects the command shell being spawned with the quiet-mode output-redirection pattern that Impacket wmiexec uses to capture results over an admin share, a remote-execution technique used by Salt Typhoon. The tool runs cmd with /Q /c and redirects output to a file on ADMIN$, so this distinctive command structure is a strong indicator of Impacket-based lateral movement.

Suspicious Misspelled WMIC Binary Execution Associated With Volt Typhoon

This rule detects execution of a binary named wminc.exe, a misspelled masquerade of the legitimate wmic.exe tied to Volt Typhoon living-off-the-land tradecraft. The deliberately mistyped name is an anomalous constant that legitimate software does not produce, so any execution is highly suspicious and worth immediate triage.

Suspicious Remote Process Creation via WMIC in BlackSuit Ransomware

This rule detects wmic.exe invoking process creation against a remote node, a lateral-movement technique used by BlackSuit ransomware affiliates. Attackers abuse WMI to spawn payloads on other hosts without dropping remote services, so remote wmic process calls warrant investigation.

Suspicious WMI Event Consumer Creation for MbRemoval Persistence via ps_script

This rule detects PowerShell content that registers a WMI event subscription tied to Win32_ProcessStartTrace with a consumer named MbRemoval. The Dragon Boss PUP used permanent WMI event consumers to react to process starts and remove security tooling, so creation of this MbRemoval consumer indicates stealthy WMI-based persistence and defense evasion.

Malicious Volume Shadow Copy Deletion via WMI PowerShell

This rule detects PowerShell that enumerates Win32_Shadowcopy objects and pipes them to Remove-WmiObject to destroy volume shadow copies, an inhibit-recovery step preceding encryption. This behavior was observed in RMM-enabled intrusions leading to Akira ransomware. Removing shadow copies denies victims local recovery and signals imminent ransomware detonation.

WMI Event Consumer Persistence Named System__Cmr

This rule detects references to the WMI event consumer name System__Cmr, a persistence artifact created during ScreenConnect post-exploitation to re-execute payloads on system events. Huntress recovered this named consumer as an operator-specific persistence mechanism. The distinctive consumer name is a reliable indicator of this intrusion set installing WMI-based persistence.

Malicious Shadow Copy Deletion via WMIC by DragonForce Ransomware (via process_creation)

This rule detects WMIC invoking shadowcopy delete to destroy Volume Shadow Copies, an inhibit-recovery step performed by DragonForce ransomware prior to file encryption. Removing shadow copies prevents victims from restoring data without paying. Detecting this command provides a high-fidelity late-stage ransomware indicator.

Malicious Shadow Copy and Backup Deletion via vssadmin wmic and wbadmin (via process_creation)

This rule detects deletion of Volume Shadow Copies and system backups through vssadmin delete shadows, wmic shadowcopy delete and wbadmin delete commands used by the Hunters International ransomware group per Group-IB. Adversaries remove these recovery points to prevent restoration before encrypting data, so this activity is a strong indicator of imminent ransomware impact.