Sigma detection rules, expert-reviewed

Malicious Windows Defender Disabling via DC.exe Defender Control by Elpaco Ransomware

This rule detects execution of the Defender Control utility (DC.exe) with a disable switch to turn off Windows Defender. This behavior is used by the Elpaco ransomware, a Mimic variant, to blind endpoint protection before encryption. Disabling defenses removes the primary barrier to file encryption and lateral movement, making early detection critical.

Suspicious Mock Trusted Directory with Trailing Space (via process_creation)

This rule detects the DBatLoader UAC bypass technique that creates a mock system directory whose name carries a trailing space before the System32 segment to satisfy trusted-directory checks. Any process image path containing Windows followed by a space and then a backslash indicates this masquerade. Legitimate Windows binaries never execute from such a path.

Suspicious Hidden PowerShell Encoded IEX Execution

This rule detects PowerShell launched with stealth flags together with in-memory execution of Base64 content, matching the spyware loader from the Pakistan-targeted fake dating app campaign. The combination of hidden window, bypassed policy and IEX-decoded payload indicates fileless execution of downloaded malware.

Malicious DeadLock Ransomware Encrypted File Extension Creation (via file_event)

This rule detects creation of files carrying the .dlock extension appended by the DeadLock ransomware encryptor as reported by Group-IB. Adversaries rename encrypted files with this extension during impact, so these writes indicate active DeadLock encryption on the host.

Malicious Disabling of macOS Automatic Software Updates via Defaults

This rule detects use of the defaults command to turn off automatic macOS software update checks or downloads. The XCSSET v4.0 malware disables SoftwareUpdate AutomaticCheckEnabled and AutomaticDownload to keep the host on vulnerable software and preserve its foothold. Detecting this configuration change exposes defense evasion that weakens the system patch posture.

Suspicious SSH Reverse Tunnel via Renamed plink Utility on Triofox Host

This rule detects renamed plink or putty binaries sihosts.exe and silcon.exe establishing a reverse SSH tunnel with the -R flag as observed after Triofox exploitation. Attackers proxy RDP over an outbound tunnel to a non standard port to maintain covert remote access.

Suspicious Astaroth Spambot Browser Profile Staging Directory (via file_event)

This rule detects creation of the browser profile staging directory used by the Astaroth spambot component. Astaroth copies the victim browser profile into a ChromeAuto directory under the public temp folder to drive an automated headless browser session. This directory pattern is a high-fidelity host indicator.

Suspicious Shell Spawned by Oracle WebLogic Identity Manager Process (via process_creation)

This rule detects a WebLogic or Oracle Identity Manager Java process spawning a command shell. Such a child process is consistent with post-exploitation of the CVE-2025-61757 remote code execution chain. Identity servers rarely launch interactive shells from the JVM.

Malicious DeadBolt Ransomware Note and Encrypted File Artifacts

This rule detects the creation of the DeadBolt ransom note or files bearing the .deadbolt extension which mark encrypted data on compromised QNAP network attached storage devices. The note and extension appear as the ransomware finishes encrypting shares. It is important because their presence confirms an active DeadBolt impact event requiring immediate response.

Malicious Vice Society Directory Crawling Script for Data Exfiltration - Via Ps_script (via ps_script)

This rule detects data exfiltration performed by the Vice Society ransomware gang using a custom built PowerShell script. More precisely, the script enumerates the volumes mounted on the system, then starts crawling the different directories before initiating the data exfiltration over HTTP by creating multiple different jobs. As PowerShell script block logs the script execution into multiple events, the detection aggregates the different log chunks using the ScriptBlockId and then ensure that at least 3 of the 4 detection strings are found.

DragonForce Ransomware File Association Registration for Encrypted Extension (via registry_set)

This rule detects registration of a DefaultIcon association for the .dragonforce_encrypted file extension, an impact behavior DragonForce ransomware performs so all encrypted files display an attacker-supplied icon dropped under the public profile. Registering an icon for a novel encrypted extension is a strong post-encryption indicator, making detection useful for scoping ransomware impact across a host.

PowerShell Reflective Shellcode Loader via Dynamic API Delegates (via ps_script)

This rule detects a PowerShell Cobalt Strike loader that resolves Windows APIs through reflection helper functions and allocates executable memory before copying and running shellcode. Adversaries leverage dynamic delegate creation and VirtualAlloc to execute a beacon in memory while avoiding static API imports.

Malicious Bash Dev-TCP Reverse Shell via Shell (via process_creation)

This rule detects an interactive bash shell redirecting input and output through a /dev/tcp network socket on Linux hosts. This reverse shell technique was used by the marimo blockchain botnet campaign to obtain interactive access after exploitation. Bash reverse shells over /dev/tcp are almost never legitimate and indicate hands on access.

HttpSpy Payload Registration via Regsvr32 of Non-DLL File (via process_creation)

This rule detects regsvr32.exe silently registering a payload with a data or non standard extension staged in ProgramData or the public users directory, the loader behavior of the Kimsuky HttpSpy variant that hides its spyLoader DLL as cacheMon.dat and mTSTCv8.mdxm. Adversaries leverage regsvr32 as a signed proxy to execute a disguised DLL while evading extension based controls, making early detection critical for catching the loader before the HttpSpy main module runs.

Malicious DragonForce Ransomware Encrypted File Extension (via file_event)

This rule detects creation of files bearing the .dragonforce_encrypted extension written by the DragonForce ransomware payload during mass file encryption. Presence of this extension confirms active data-encryption impact on the host. Rapid detection enables containment before encryption spreads across shares.