Sigma detection rules, expert-reviewed

Malicious USN Change Journal Deletion via Fsutil for Anti-Forensics

This rule detects use of fsutil to delete the NTFS USN change journal which NotPetya performed to destroy filesystem forensic evidence as documented by NCC Group. Deletion of the change journal removes records of file activity and is rarely part of legitimate administration.

Suspicious Scheduled Task Creation for System Reboot via Schtasks

This rule detects creation of a scheduled task that invokes shutdown with a forced restart which NotPetya used to reboot hosts into its encryption phase as reported by NCC Group. A scheduled forced reboot combined with disk tampering is a hallmark of destructive ransomware execution.

Suspicious Scheduled Task Masquerading as Google Chrome Updates via Process Creation

This rule detects creation of a scheduled task named to impersonate a Google Chrome update mechanism which Lorenz ransomware uses for persistence. Observed in NCC Group research unmasking Lorenz ransomware tactics techniques and procedures. Attackers disguise persistence as a benign updater which makes this named-task masquerade a useful detection point.

Possible Shellshock Bash Function Definition Injection via Process Creation

This rule detects the Shellshock (CVE-2014-6271) exploitation pattern where an attacker injects a Bash environment-variable function definition prefix into a command line. Captured in NCC Group research on the Shellshock Bash vulnerability targeting CGI endpoints. Exploiting this flaw yields unauthenticated remote code execution which makes early detection of the injection prefix important.

Suspicious Svchost Masquerade Execution from Non-System Path

This rule detects a process named svchost.exe running from a directory outside the Windows System32 or SysWOW64 folders. NCC Group observed the Rclone exfiltration binary renamed to svchost.exe to blend in with legitimate host processes. Attackers rename tooling to trusted system binary names to evade analyst review and simple name based defenses.

Malicious S4U Ticket Request via Impacket getST

This rule detects execution of the Impacket getST tool with impersonation options used to perform S4U2Self and S4U2Proxy requests, the ticket-forging step that abuses resource-based constrained delegation to impersonate a privileged user. Use of this tooling indicates active exploitation for lateral movement and privilege escalation.

Suspicious Hidden Scheduled Task EventLogBackupTask Creation

This rule detects creation of a scheduled task named EventLogBackupTask with a logon trigger, a persistence artifact used in the Rapid Breach intrusion where a benign-sounding task name masks a logon-triggered implant. Creation of this specifically named task via schtasks is a strong indicator of attacker persistence.

Malicious PowerShell Download Cradle Spawned by Quick Assist

This rule detects Quick Assist spawning PowerShell that uses an IEX DownloadString cradle to fetch and execute remote code, the initial-access chain seen when a social-engineering operator drives the victim through Quick Assist to run attacker payloads. A remote-support tool launching an in-memory download cradle is a strong indicator of a tech-support scam intrusion.

Malicious Recovery Disablement via Bcdedit RecoveryEnabled No

This rule detects bcdedit.exe disabling Windows automatic recovery by setting recoveryenabled to no, an inhibit-system-recovery action performed by SafePay and many ransomware families before encryption. Disabling boot recovery has almost no legitimate administrative use on production hosts and indicates preparation for impact.

Suspicious Regsvr32 Execution of SafePay Loader DLL

This rule detects regsvr32.exe being used to execute the soc.dll loader observed in SafePay ransomware intrusions, a signed-binary-proxy technique to run malicious code while evading application controls. Regsvr32 loading a payload DLL named soc.dll is a strong indicator of the SafePay staging chain.

Malicious SafePay Ransomware Encryptor Command-Line Execution

This rule detects the SafePay ransomware encryptor invoked with its characteristic password, encryption and self-delete parameters used to encrypt targeted paths and remove the binary afterward. This combination of flags is unique to the SafePay payload and indicates active data-encryption impact.

Malicious Scheduled Task Persistence for Lazarus VPN Loader (via process_creation)

This rule detects creation of a scheduled task named Windows Java Vpn Interface via schtasks, used by Lazarus to persist the rundll32 loader with a daily trigger. The masqueraded task name mimics a legitimate VPN component. Establishing a scheduled task ensures the implant re-launches to maintain access for follow-on espionage activity.

Malicious rundll32 Execution of Lazarus JavaPackage DLL (via process_creation)

This rule detects rundll32.exe executing a DLL from the ProgramData Oracle Java path via the VpnUserInterface export, the loader used in a Lazarus social engineering initial access chain. The masqueraded Java path combined with the VpnUserInterface export is a specific implant artifact. This proxies malicious code through a signed binary to establish a foothold for follow-on tasking.

Malicious Defender Exclusion Added via Add-MpPreference (via process_creation)

This rule detects use of the Add-MpPreference cmdlet to add a Microsoft Defender exclusion, observed as MetaStealer excluded executable files from scanning. Adding exclusions blinds the antivirus to malicious binaries in the excluded scope. This defence evasion clears the way for the infostealer to run and persist without detection.

Malicious Cobalt Strike Loader via rundll32 From ProgramData (via process_creation)

This rule detects rundll32.exe executing a DLL from the ProgramData directory using the DllRegisterServer export, the Cobalt Strike loading pattern seen in a LockBit 3.0 intrusion. Legitimate DLLs are rarely staged in ProgramData and run this way. Proxying a beacon through a signed binary from a writable path enables stealthy command-and-control ahead of ransomware deployment.