Sigma detection rules, expert-reviewed

Malicious CACTUS Ransomware Note and Encrypted File Artifacts (via file_event)

This rule detects creation of the CACTUS ransom note cAcTuS.readme.txt or files renamed with the .cts extension appended during encryption. These artifacts confirm active CACTUS ransomware impact on the host and mark the encryption phase of the intrusion.

BlackCat ALPHV Ransomware Execution With access-token Argument

This rule detects a process launched with the --access-token argument required by the BlackCat ALPHV ransomware encryptor to unlock and run. Huntress observed affiliates passing this token to detonate the payload on compromised hosts. The mandatory access-token flag is a distinctive execution signature that separates this ransomware from benign tooling.

Malicious Akira Ransomware Ransom Note Creation

This rule detects creation of the Akira ransomware ransom note akira_readme.txt on disk. Akira writes this note across encrypted directories as part of its extortion workflow. Ransom note creation confirms active or completed encryption on the host and demands immediate response.

Malicious INC Ransomware Ransom Note Creation

This rule detects creation of the INC ransomware ransom note file INC-README.txt on disk. INC ransomware writes this note across encrypted directories during and after the encryption phase. Ransom note creation is a high-confidence indicator that encryption is underway or complete on the host.

Malicious Shadow Copy Deletion via WMIC by DragonForce Ransomware (via process_creation)

This rule detects WMIC invoking shadowcopy delete to destroy Volume Shadow Copies, an inhibit-recovery step performed by DragonForce ransomware prior to file encryption. Removing shadow copies prevents victims from restoring data without paying. Detecting this command provides a high-fidelity late-stage ransomware indicator.

Suspicious Hidden PowerShell Download Cradle Used by DragonForce Ransomware (via process_creation)

This rule detects PowerShell executed with a hidden window that also invokes a remote download cradle, matching the DragonForce ransomware intrusion pattern for staging Cobalt Strike beacons. Operators use this to fetch second-stage payloads while evading user visibility. Early detection blocks the ransomware kill chain before encryption and lateral movement.

Malicious Hunters International Ransomware Encryptor Execution via Distinctive CLI Flags (via process_creation)

This rule detects the Hunters International encryptor invoked with its distinctive flags such as --low-key, --no-erase and --no-remote documented by Group-IB. Adversaries pass these flags to control process termination, skip files and limit remote encryption during deployment, so the combination is a high-confidence sign of Hunters encryption.

Malicious DeadLock Ransomware Dropper Masquerading as svhost.exe (via process_creation)

This rule detects execution of svhost.exe, a deliberate misspelling of the legitimate svchost.exe used as the DeadLock ransomware dropper filename reported by Group-IB. Adversaries name the dropper to visually mimic the Windows service host and evade cursory review, so any svhost.exe process is a strong malicious indicator.

Malicious Lynx Ransomware Encryptor Execution via Distinctive CLI Flags (via process_creation)

This rule detects the Lynx ransomware encryptor launched with its distinctive command-line flags such as --encrypt-network, --load-drives, --stop-processes and --safe-mode documented by Group-IB. Adversaries pass these flags to terminate processes, mount hidden drives and encrypt network paths during deployment, so the combination is a high-confidence sign of active Lynx encryption.

Suspicious Executable Launched from PerfLogs Directory by Estate Ransomware

This rule detects executables running from the C:\PerfLogs directory, an unusual location abused by Estate Ransomware to stage the LB3 LockBit payload. PsExec deploys the binary here to evade attention on the endpoint. Execution from PerfLogs is anomalous and strongly suggests malicious staging.

Suspicious Rogue VeeamBkp Account Creation by Estate Ransomware

This rule detects creation of a rogue local account named VeeamBkp via net user, used by Estate Ransomware operators. The account impersonates a Veeam backup service identity to blend into the environment and retain access. Creation of this disguised account indicates hands-on-keyboard intrusion.

Malicious Scheduled Task Masquerading as svchost by Estate Ransomware

This rule detects creation of a scheduled task named or pointing at svchost.exe, used by Estate Ransomware for daily persistence. Naming the task after a core system process disguises the malicious autostart. A user-created task masquerading as svchost is a strong indicator of compromise.

Malicious Windows Event Log and Backup Clearing by BabLock Ransomware

This rule detects clearing of Windows event logs and deletion of the backup catalog performed by BabLock ransomware. The operators run wevtutil clear-log and wbadmin to erase forensic evidence and remove backups. This anti-forensic behavior hampers incident response and blocks recovery.

Malicious Ransomware Payload Execution via HWP Word Processor Spawning Executable from Temp

This rule detects the Hancom HWP word processor spawning an executable file from the user AppData Local Temp directory, a behavior observed in an EDR-analyzed ransomware campaign delivered through malicious HWP documents. It captures the initial code-execution stage where a lure document drops and launches a payload leading to file encryption. Detecting this parent-child anomaly is important because office document processors should not launch arbitrary executables from temporary folders.

Suspicious javaw.exe Executing JAR From Masqueraded Roaming Directory via Interlock Ransomware (via process_creation)

This rule detects the Interlock Windows ransomware which runs through a legitimate javaw.exe copied into Roaming subfolders that impersonate FortiClient, VMware or a Welcome application to execute its JAR payload. Java runtimes staged under these AppData paths are not normal on endpoints. This execution indicates ransomware deployment.