Sigma detection rules, expert-reviewed

Malicious Volume Shadow Copy Deletion via vssadmin or WMIC

This rule detects deletion of volume shadow copies via vssadmin Delete Shadows or wmic shadowcopy delete. Ransomware families in this report remove shadow copies to prevent victims from restoring encrypted files. Shadow copy deletion is a hallmark inhibit-recovery step performed during ransomware execution.

Suspicious Security Software Uninstallation via WMIC Product Call Uninstall (Chaos Ransomware)

This rule detects use of WMIC to silently uninstall installed software via the product call uninstall method. The Chaos ransomware group leverages this to remove multi-factor authentication agents and security tooling prior to encryption. Programmatic uninstallation of defensive software is an impair-defenses technique that precedes impact.

Malicious Remote Encryptor Execution via WMIC Process Call Create (Chaos Ransomware)

This rule detects the Chaos ransomware group using WMIC to remotely spawn its encryptor binary with campaign-specific arguments such as lkey, encrypt_step and work_mode. Remote process creation over WMI is used to deploy the encryptor across the network. This behavior indicates active ransomware deployment combined with lateral movement.

Suspicious Security Product Uninstall via wmic product call uninstall

This rule detects wmic being used to enumerate a product and invoke call uninstall, the technique Talos IR observed removing the Duo multi-factor agent to weaken defenses before ransomware deployment. Programmatic uninstallation of security or MFA software via WMI is a defense-evasion step that clears obstacles to lateral movement and encryption.

Suspicious ToyMaker LAGTOY Service Creation Masquerading as WmiPrvSV via sc.exe

This rule detects creation of a Windows service named WmiPrvSV via sc.exe, a name that mimics the legitimate WMI Provider Host (WmiPrvSE) to blend in. The LAGTOY implant used by the ToyMaker initial access broker installs itself under this masqueraded service name for persistence, so this is a strong indicator of that access broker preparing hands-on-keyboard follow-up for double extortion gangs.

Malicious Impacket Wmiexec Remote Command Execution Pattern

This rule detects the command redirection pattern produced by Impacket wmiexec where cmd.exe is spawned by WmiPrvSE.exe to run a command and write output to a local admin share path. This semi interactive execution over WMI is a hallmark of lateral movement using stolen credentials as seen in the UAT-5918 activity.

Malicious Shadow Copy Deletion Via WMI

This rule detects PowerShell querying Win32_Shadowcopy and piping the result to Remove-WmiObject to delete volume shadow copies. Akira ransomware used Get-WmiObject Win32_Shadowcopy piped to Remove-WmiObject to destroy shadow copies before encryption. Deleting shadow copies is an inhibit-recovery action that prevents victims from restoring files without paying the ransom.

Volume Shadow Copy Deletion via vssadmin or wmic

This rule detects deletion of Volume Shadow Copies through vssadmin or wmic, an anti-recovery step performed by Phobos ransomware deployed by the 8Base group. Removing shadow copies prevents victims from restoring encrypted files without paying. This inhibit-recovery behavior almost always precedes or accompanies ransomware encryption.

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

This rule detects the IIS process inetinfo.exe loading wmicodegen.dll, a DLL sideloading technique UAT-8099 uses to run Cobalt Strike on compromised web servers. The inetinfo.exe process has no legitimate reason to load this library. This load indicates in-memory beacon deployment via search-order hijacking.

Suspicious Volume Shadow Copy Deletion via PowerShell WMI by Akira Ransomware

This rule detects PowerShell deleting Volume Shadow Copies through the Win32_ShadowCopy WMI class, an inhibit-recovery step used by Akira ransomware before encryption. Removing shadow copies prevents victims from restoring files without paying.

Suspicious PebbleDash C2 Configuration Stored Under WMI Security Key (via registry_set)

This rule detects writes to the HKLM SYSTEM CurrentControlSet Control WMI Security value with the GUID used by the Kimsuky PebbleDash backdoor to store its encrypted command and control address. This registry location is not normally written by user applications.

Malicious Invoke-WMIExec Lateral Movement Download and Execute (via ps_script)

This rule detects a PowerShell one liner that downloads Invoke-WMIExec via a web client and executes it against a remote target using a pass the hash argument as observed in the MeshAgent and SuperShell intrusion. This chains in memory script download with WMI based lateral movement.

XSL Script Processing via WMIC or MSXSL (via process_creation)

This rule detects XSL script processing through wmic.exe /format with a remote or local .xsl stylesheet or through msxsl.exe, both of which execute embedded script and proxy code past application allowlisting. XSL script processing is a signed-binary-proxy-execution technique highlighted in the Red Canary Threat Detection Report. Detecting these invocations surfaces trusted-binary abuse used to run attacker-controlled script.

Suspicious Remote Process Creation via WMIC Process Call Create (via process_creation)

This rule detects wmic.exe invoking process call create, frequently against a remote node, which spawns a process through WMI for lateral movement or remote execution. WMIC-based remote execution is a technique tracked in the Red Canary Threat Detection Report for its use in hands-on-keyboard intrusions. Detecting this invocation surfaces attacker movement that blends into legitimate management traffic.

Suspicious Security Software Discovery via WMI or Defender Query (via process_creation)

This rule detects command lines that enumerate installed antivirus or EDR products through the SecurityCenter2 WMI namespace or Get-MpComputerStatus, a security-software-discovery step taken to plan defense evasion. Security software discovery is tracked in the Red Canary Threat Detection Report. Detecting these queries surfaces an attacker profiling defenses before acting.