Sigma detection rules, expert-reviewed

Suspicious Security Software Uninstallation via WMIC Product Call Uninstall (Chaos Ransomware)

This rule detects use of WMIC to silently uninstall installed software via the product call uninstall method. The Chaos ransomware group leverages this to remove multi-factor authentication agents and security tooling prior to encryption. Programmatic uninstallation of defensive software is an impair-defenses technique that precedes impact.

Suspicious OpenSSH Reverse Tunnel Over HTTPS Port (Chaos Ransomware)

This rule detects use of the OpenSSH client to establish a reverse tunnel with the -R option forwarding traffic over port 443. The Chaos ransomware group abuses OpenSSH reverse tunneling to blend remote access and command-and-control into HTTPS traffic. Reverse tunnels over common web ports are used to evade network monitoring and maintain covert access.

Malicious Remote Encryptor Execution via WMIC Process Call Create (Chaos Ransomware)

This rule detects the Chaos ransomware group using WMIC to remotely spawn its encryptor binary with campaign-specific arguments such as lkey, encrypt_step and work_mode. Remote process creation over WMI is used to deploy the encryptor across the network. This behavior indicates active ransomware deployment combined with lateral movement.

Malicious Scheduled Task Creation TaskSystem via Interlock Ransomware

This rule detects creation of a scheduled task named TaskSystem that runs in the SYSTEM context which Interlock ransomware operators use to establish persistence and execute payloads with elevated privileges. The fixed task name combined with SYSTEM execution distinguishes this from routine administrative task creation.

Suspicious CyberLock Ransomware Encrypted File Creation

This rule detects creation of files bearing the .cyberlock extension, the marker appended by the ransomware distributed through fake AI-tool installers. Appearance of this extension indicates active encryption of user data on the host and imminent extortion.

Phobos 8Base Ransomware Encrypted File Extension Created

This rule detects files being renamed with the .8base extension appended by Phobos ransomware operated by the 8Base group. Phobos appends an extension containing a victim ID and contact email ending in .8base to each encrypted file. A wave of these file events signals active ransomware encryption on the host.

Rhysida Ransomware Encrypted File Extension Created

This rule detects files being renamed with the .rhysida extension appended by Rhysida ransomware during encryption. Rhysida uses ChaCha20 to encrypt victim files and marks each with this extension. A burst of such file events indicates active mass encryption on the host.

Rhysida Ransomware Note CriticalBreachDetected.pdf Created

This rule detects the creation of a file named CriticalBreachDetected.pdf, the fixed ransom note dropped by Rhysida ransomware. Rhysida writes this note across affected directories after encrypting files. Detecting the note filename provides a high-confidence indicator that Rhysida encryption has already occurred on the host.

Possible Akira Ransomware VM Shutdown via vim-cmd

This rule detects use of vim-cmd to power off virtual machines on an ESXi host, a step the Akira Rust ransomware performs before encrypting VM files. The encryptor enumerates guests with getallvms and forces them off to release locked disks. Detecting it can stop the attack before mass encryption begins.

Possible Ransomware Pre-Encryption VM Termination via esxcli

This rule detects use of esxcli to force kill running virtual machines, a step ransomware performs on ESXi hosts to unlock VM disk files before encryption. Multiple studied families run vm process kill with type force to stop guests prior to mass encryption. Detecting it can interrupt the attack before data is locked.

Possible Akira Ransomware Note or Encrypted Extension Creation

This rule detects creation of files with the akiranew extension or the akiranew.txt ransom note produced by the Akira Rust ransomware variant. Both artifacts appear only after files have been encrypted on the host. Detecting them confirms an active Akira encryption event for rapid isolation.

Possible Ransomware Note or Encrypted File Extension Creation

This rule detects creation of ransom note files or files renamed with encrypted extensions used by the ransomware families compared in this research. The specific note names and extensions appear only after data has been encrypted on the victim host. Detecting them confirms an active encryption event so responders can isolate the machine.

Suspicious Windows Defender Real-Time Protection Disabled via Policy Registry by Cephalus Ransomware

This rule detects registry changes under the Windows Defender Real-Time Protection policy key that disable on-access and real-time scanning, a defense evasion step used by Cephalus ransomware. Turning off these protections lets the encryptor run without interference.

Suspicious AutoAdminLogon Enabled via Winlogon Registry by RansomHub Ransomware

This rule detects the Winlogon AutoAdminLogon value being enabled, configuring automatic logon of an account without credentials. RansomHub sets this value to maintain access and ensure its payload runs after reboot.

Suspicious PowerShell Hidden Web Download via Invoke-WebRequest by CatB Ransomware

This rule detects a hidden PowerShell or cmd invocation combining Invoke-WebRequest with DownloadData to retrieve a payload, matching the ingress tool transfer behavior emulated for CatB ransomware. Running the download in a hidden window is a common defense evasion tactic for staging follow-on malware.