Sigma detection rules, expert-reviewed

Malicious Vice Society Directory Crawling Script for Data Exfiltration - Via Ps_script (via ps_script)

This rule detects data exfiltration performed by the Vice Society ransomware gang using a custom built PowerShell script. More precisely, the script enumerates the volumes mounted on the system, then starts crawling the different directories before initiating the data exfiltration over HTTP by creating multiple different jobs. As PowerShell script block logs the script execution into multiple events, the detection aggregates the different log chunks using the ScriptBlockId and then ensure that at least 3 of the 4 detection strings are found.

DragonForce Ransomware File Association Registration for Encrypted Extension (via registry_set)

This rule detects registration of a DefaultIcon association for the .dragonforce_encrypted file extension, an impact behavior DragonForce ransomware performs so all encrypted files display an attacker-supplied icon dropped under the public profile. Registering an icon for a novel encrypted extension is a strong post-encryption indicator, making detection useful for scoping ransomware impact across a host.

PowerShell Reflective Shellcode Loader via Dynamic API Delegates (via ps_script)

This rule detects a PowerShell Cobalt Strike loader that resolves Windows APIs through reflection helper functions and allocates executable memory before copying and running shellcode. Adversaries leverage dynamic delegate creation and VirtualAlloc to execute a beacon in memory while avoiding static API imports.

Malicious Bash Dev-TCP Reverse Shell via Shell (via process_creation)

This rule detects an interactive bash shell redirecting input and output through a /dev/tcp network socket on Linux hosts. This reverse shell technique was used by the marimo blockchain botnet campaign to obtain interactive access after exploitation. Bash reverse shells over /dev/tcp are almost never legitimate and indicate hands on access.

Suspicious Remote Script Download and Execution via iwr Piped to iex

This rule detects PowerShell using Invoke-WebRequest piped into Invoke-Expression to download and run an install script in memory, observed in a Huntress Komari intrusion that fetched install.ps1 to deploy the agent. The iwr into iex pattern executes remote code without writing the script to disk. This download-cradle technique is a common precursor to agent and tooling deployment.

HttpSpy Payload Registration via Regsvr32 of Non-DLL File (via process_creation)

This rule detects regsvr32.exe silently registering a payload with a data or non standard extension staged in ProgramData or the public users directory, the loader behavior of the Kimsuky HttpSpy variant that hides its spyLoader DLL as cacheMon.dat and mTSTCv8.mdxm. Adversaries leverage regsvr32 as a signed proxy to execute a disguised DLL while evading extension based controls, making early detection critical for catching the loader before the HttpSpy main module runs.

Malicious DragonForce Ransomware Encrypted File Extension (via file_event)

This rule detects creation of files bearing the .dragonforce_encrypted extension written by the DragonForce ransomware payload during mass file encryption. Presence of this extension confirms active data-encryption impact on the host. Rapid detection enables containment before encryption spreads across shares.

Suspicious DLL Side-Loading of wbemcomn From Non-System Path

This rule detects loading of wbemcomn.dll from a directory outside the Windows system folders, indicating DLL side-loading. In CVE-2025-31324 SAP NetWeaver intrusions a planted wbemcomn.dll was side-loaded by svchost to run a Cobalt Strike beacon. Because the legitimate library lives only in system directories, execution from other paths is a strong compromise signal.

Malicious ESXi Virtual Machine Termination and Snapshot Removal

This rule detects ESXi command-line activity that force-kills running virtual machines or removes all snapshots, the hypervisor sabotage Qilin ransomware performed via esxcli and vim-cmd before encryption. Mass termination of VMs and snapshot deletion inhibits recovery and is characteristic of ransomware targeting virtualized infrastructure.

Malicious Veeam Credential Theft via PowerShell (via ps_script)

This rule detects a PowerShell script that decrypts stored Veeam Backup and Replication credentials using the ProtectedData Unprotect method against the Veeam database. Fog ransomware operators ran a Veeam-Get-Creds script to harvest backup infrastructure credentials.

Obfuscated Base64-Decoded Payload Piped to a Shell (via process_creation)

This rule detects a base64 decode operation piped directly into bash, sh or eval, a one-liner adversaries use to reconstruct and immediately run an obfuscated payload on Linux. Base64 deobfuscation into a shell is a defense-evasion and execution technique in the Red Canary Threat Detection Report. Detecting the decode-and-execute chain surfaces hidden command execution as it runs.

Suspicious Fog Ransomware File Artifacts (via file_event)

This rule detects creation of the Fog ransomware DbgLog.sys operational log or files bearing the .fog and .flocked encrypted extensions. These artifacts are dropped during Fog ransomware encryption on compromised hosts.

SwimSnake Driver Execution Persistence via Session Manager PlatformExecute (via registry_set)

This rule detects writes to the Session Manager PlatformExecute registry value, an unusual boot-time execution key the fake FinalShell SwimSnake campaign abuses to trigger a released driver (BEB.exe) for security-software tampering. Adversaries plant execution entries under Session Manager to run code very early and outside common autostart monitoring, making early detection critical for catching driver-based defense evasion before shellcode injection into explorer.exe.

FireWood Backdoor Persistence Files in Hidden kde-root Directory (via file_event)

This rule detects creation of the FireWood backdoor working files inside a hidden .kde-root directory, where the Linux implant stores its loader and PID artifacts under either a system library path or a user home directory. The masquerade as KDE runtime files combined with the hidden directory reflects the backdoor establishing itself on the host.

Suspicious Scheduled Task Creation for Efimer Controller (via process_creation)

This rule detects schtasks.exe registering a task that references controller.xml the scheduled-task definition used by the Efimer Trojan for persistence. Efimer establishes a recurring task to keep its clipboard clipper and Tor-based command channel running. A task built from an XML file named controller in user-writable space is an indicator of this infection.