Sigma detection rules, expert-reviewed

Malicious Inhibit System Recovery via bcdedit Boot Policy Change by Chaos Ransomware (via process_creation)

This rule detects Chaos C++ ransomware disabling Windows recovery by running bcdedit to ignore all boot failures and to turn off the recovery environment prior to encryption. These bcdedit modifications remove the user ability to recover the system. They are a reliable pre encryption indicator.

Malicious Hunters International Ransomware Execution via rundll32

This rule detects rundll32.exe executing the Hunters International ransomware encryptor DLL through its Open export with the operator flags used to target running processes. This proxy execution technique masks the ransomware payload behind a signed Windows binary immediately before mass file encryption, making it a critical late-stage indicator.

Suspicious EKANS Ransomware Payload Dropped to Drive Root (via file_event)

This rule detects creation of the file update.exe directly in the root of the C drive, a staging behavior of EKANS ransomware prior to encryption of ICS environments. EKANS drops its payload and ransom note to the drive root and user desktop before terminating industrial and database processes. Writing an executable named update.exe to the drive root is highly unusual and warrants immediate investigation.

Malicious BlackSuit Ransomware Execution via Process Creation

This rule detects the distinctive command-line flags of BlackSuit ransomware combining virtual machine termination, full-file encryption, and a victim identifier. This flag combination is unique to the BlackSuit encryptor and signals an active encryption run.

Suspicious BlackSuit Ransomware Note and Encrypted File Artifacts via File Event

This rule detects creation of the readme.blacksuit.txt ransom note or files renamed with the .blacksuit extension, the on-disk artifacts left by BlackSuit ransomware during encryption. Their appearance across a host or share indicates an in-progress or completed encryption event.

Possible Azure Storage Ransomware via Customer-Managed Key Encryption

This rule detects Azure Activity operations that rewrite storage account encryption to attacker-controlled key material, a hijack path for blob storage ransomware. Writing an encryption scope or setting the account key source to Key Vault lets an actor re-encrypt blobs under a key they hold and then deny the victim access. These control-plane encryption changes on production storage accounts warrant urgent review.

Suspicious Enabling of Remote Desktop via fDenyTSConnections Registry by DeadLock Ransomware

This rule detects modification of the fDenyTSConnections value to zero which enables inbound Remote Desktop connections. The DeadLock ransomware operators enable RDP and open the firewall to facilitate lateral movement. Enabling remote desktop on compromised hosts expands attacker access across the environment.

Suspicious ThrottleStop Driver Abuse for Defense Evasion in Ransomware Attacks

This rule detects execution of the ThrottleStop utility which ships a vulnerable driver abused to disable endpoint protection. Ransomware operators in Japanese incidents load ThrottleStop as part of their EDR-killer tooling before encryption. Bring-your-own-vulnerable-driver tools let an actor terminate security software from kernel space.

Suspicious Local Account Creation via Net User in Pre-Ransomware Phase

This rule detects creation of a new account using net user with the add flag. Ransomware actors targeting Japanese organizations create rogue accounts such as Attacker1 for persistence before deploying encryption. New account creation during an intrusion often precedes hands-on ransomware staging.

Suspicious Domain Controller Enumeration via Nltest by DeadLock Ransomware

This rule detects use of nltest to list domain controllers during reconnaissance. The DeadLock ransomware actors run nltest and quser to map the domain prior to lateral movement. Domain controller enumeration is an early sign of an actor preparing to spread across the network.

Malicious Disabling of Microsoft Defender Real-Time Protection via SystemSettingsAdminFlows by DeadLock Ransomware

This rule detects use of SystemSettingsAdminFlows to toggle Microsoft Defender real-time protection. The DeadLock ransomware loader invokes this living-off-the-land binary to disable endpoint protection before deploying its payload. Turning off real-time protection blinds the defender to subsequent malicious activity.

Suspicious Cloudflared Tunnel Execution for Command and Control by Kraken Ransomware

This rule detects execution of the cloudflared client to establish an outbound tunnel. The Kraken ransomware group abuses Cloudflare Tunnel together with SSHFS and RDP to maintain covert access and move laterally. Attacker use of cloudflared can bypass perimeter controls by tunneling traffic over trusted Cloudflare infrastructure.

Malicious Mass Hyper-V Virtual Machine Shutdown via PowerShell by Kraken Ransomware

This rule detects PowerShell forcibly stopping Hyper-V virtual machines by piping Get-VM into Stop-VM with the force and turnoff switches. This technique is used by the Kraken ransomware group to shut down virtualized workloads before encryption. Terminating running virtual machines unlocks their files for encryption and maximizes operational impact.

Suspicious Shadow Copy Deletion via Vssadmin by Kraken Ransomware

This rule detects deletion of Volume Shadow Copies using vssadmin with the delete shadows and all flags. This behavior is associated with the Kraken ransomware group which inhibits system recovery prior to encryption. Removing shadow copies prevents victims from restoring files without paying the ransom.

Suspicious Ransomware Fan-Out Deployment via PsExec Spread (Qilin)

This rule detects execution of a deployment tool with a spread argument used by the Qilin group to push its ransomware encryptor across hosts. Automated fan-out deployment over remote channels is a lateral-movement and impact accelerant. The spread flag distinguishes mass deployment from routine remote administration.