Sigma detection rules, expert-reviewed

Malicious Shadow Copy Removal via WMI PowerShell

This rule detects PowerShell enumerating and removing volume shadow copies through the Win32_Shadowcopy WMI class. This behavior matches Akira ransomware which deletes shadow copies via WMI to prevent recovery before encrypting files. Programmatic shadow copy removal is a strong impact indicator that precedes ransomware detonation.

Suspicious Remote Apple Events Enablement via systemsetup

This rule detects enabling of Remote Apple Events on macOS via systemsetup. This behavior matches in-the-wild macOS lateral movement where attackers turn on the eppc service to send AppleScript commands to remote hosts over the network. Enabling Remote Apple Events is rare in managed environments and provides attackers a native channel for remote code execution.

Suspicious Hidden Encoded PowerShell Execution

This rule detects PowerShell launched with a hidden window, bypassed execution policy, and a base64-encoded command. This behavior matches the BlackSuit intrusion chain where operators run obfuscated encoded payloads to stage tooling while evading logging. The combination of hidden execution and encoding is a common obfuscation pattern used to conceal malicious in-memory activity.

Malicious NTDS Database Dump via ntdsutil

This rule detects use of ntdsutil to create a full copy of the Active Directory NTDS.dit database. This behavior matches BlackSuit ransomware operators who dump the domain credential store for offline extraction of password hashes. Access to NTDS.dit enables domain-wide credential compromise and is a high-severity precursor to lateral movement and full domain takeover.

Malicious Volume Shadow Copy Deletion via vssadmin

This rule detects deletion of all volume shadow copies via vssadmin with the quiet flag. This behavior matches BlackSuit ransomware operated by Ignoble Scorpius which removes shadow copies to inhibit system recovery before encryption. Shadow copy deletion is a strong pre-encryption indicator and warrants immediate response to prevent irreversible data loss.

Malicious FrostyGoop OT Encryptor Execution with Modbus Config

This rule detects execution of the FrostyGoop OT malware binary go-encrypt.exe or any process referencing its task_test.json Modbus configuration file. This behavior matches the FrostyGoop campaign targeting industrial control systems where the tool read a JSON target list to issue unauthorized Modbus commands. Detecting the encryptor and its config is critical because it directly manipulates OT device registers and can disrupt physical processes.

Suspicious Kubernetes Enumeration via kubectl in Cloud Compromise

This rule detects cluster-wide pod enumeration via kubectl across all namespaces from a node or workload context. This behavior matches the ModeLeak reconnaissance phase where a compromised Vertex AI custom job used service agent credentials to map cluster resources. Broad cross-namespace enumeration from non-administrative contexts often precedes privilege escalation and lateral access to model artifacts.

Suspicious Container Image Export via ctr in Cloud Model Exfiltration

This rule detects use of the containerd ctr client to export a container image to a local tar archive on a Kubernetes node. This behavior matches the ModeLeak attack against Vertex AI where an attacker abused a compromised service agent to pull and export proprietary LLM model images. Exporting images to disk is a precursor to staging and exfiltrating sensitive model or workload data from cloud tenants.

Suspicious Windows Defender Exclusion Enumeration via reg query (via process_creation)

This rule detects reg query enumerating the Microsoft Defender exclusions registry path, reconnaissance the Silent Skimmer actor used to learn which folders evade scanning before staging payloads. Querying exclusion policy indicates an actor mapping defensive gaps to abuse.

Malicious Windows Defender Exclusion Added via PowerShell (via process_creation)

This rule detects PowerShell using Add-MpPreference to register a Microsoft Defender path exclusion, a defense-evasion step the Silent Skimmer actor performed to protect payload directories from scanning. Excluding attacker-controlled folders lets malware run and persist without antivirus detection.

Suspicious LSASS Credential Access via PowerShell (via process_creation)

This rule detects PowerShell command lines referencing lsass, the mechanism the extortion actor used to dump credentials from the Local Security Authority Subsystem Service memory. Reading or dumping LSASS through PowerShell exposes plaintext credentials and hashes for lateral movement.

Suspicious Executable Launched from Public Music Staging Directory (via process_creation)

This rule detects processes executing from the C users Public Music directory, a world-writable staging location Jumpy Pisces used to hold PsExec and the TokenPlayer tool during Play ransomware operations. Binaries running from this non-standard path are rarely legitimate and often mark attacker tooling.

Suspicious SMB Admin Share Mapping for Lateral Tool Transfer (via process_creation)

This rule detects mapping of a remote C$ administrative share with net use, the step Jumpy Pisces used to copy malware to peer hosts over SMB before deploying Play ransomware. Mounting admin shares to stage tooling is a common lateral-movement precursor to network-wide encryption.

Suspicious SSH Reverse Tunnel via plink (via process_creation)

This rule detects the plink utility establishing an SSH connection with a remote port forward, the reverse-tunnel technique SnipBot operators used alongside a socks5 proxy to route traffic through the victim. Reverse SSH tunneling grants the actor an internal foothold and hides command-and-control behind an encrypted channel.

Suspicious Curl Download and Chmod Execute Chain on Linux (via process_creation)

This rule detects a shell command line that downloads a payload with curl and immediately makes it executable with chmod, the download-and-run staging chain Gleaming Pisces used to install PondRAT on Linux and macOS. Fetching and executing a remote binary in a single command is a common malware bootstrap and warrants review on servers.