Sigma detection rules, expert-reviewed

Suspicious Symbolic Link Evaluation Enabled via fsutil by RansomHub Ransomware

This rule detects fsutil enabling remote-to-local and remote-to-remote symbolic link evaluation, a configuration change RansomHub uses to reach and encrypt files across redirected paths. Enabling these symlink behaviors is uncommon in normal administration.

Suspicious Volume Shadow Copy Deletion via PowerShell WMI by Akira Ransomware

This rule detects PowerShell deleting Volume Shadow Copies through the Win32_ShadowCopy WMI class, an inhibit-recovery step used by Akira ransomware before encryption. Removing shadow copies prevents victims from restoring files without paying.

Malicious Anubis Ransomware Cloudflare Tunnel via cloudflared (via process_creation)

This rule detects execution of the cloudflared client establishing an outbound Cloudflare Tunnel. Operators behind the Anubis ransomware campaign dropped cloudflared to Windows and NAS hosts and ran it with tunnel and token arguments to create a persistent encrypted command and control channel that bypasses inbound firewall controls.

FunkSec Ransomware Encryption Artifacts via funksec Extension and Markdown Ransom Note (via file_event)

This rule detects the on-disk artifacts of FunkSec ransomware, namely files renamed with the funksec extension and the dropped README markdown ransom note. Adversaries append a unique extension and write a ransom note during mass encryption, so these artifacts confirm active data-encryption for impact.

DragonForce Ransomware Volume Shadow Copy Deletion via WMIC ShadowCopy Where Delete (via process_creation)

This rule detects abuse of WMIC to enumerate and delete a specific volume shadow copy by ID, the inhibit-recovery behavior DragonForce ransomware performs through cmd.exe before file encryption. Adversaries delete shadow copies so victims cannot restore encrypted files, making early detection critical for interrupting the intrusion before data becomes unrecoverable.

Untrusted Makop Ransomware Vulnerable Driver hlpdrv Drop for EDR Kill (via file_event)

This rule detects the Makop intrusion set dropping the hlpdrv vulnerable driver used to terminate endpoint protection at the kernel level before encryption. Adversaries deploy this abusable driver to disable defenses through bring-your-own-vulnerable-driver. Appearance of this specific driver filename on disk indicates staging for defense evasion.

INC Ransomware Ransom Note INC-README Written to Disk (via file_event)

This rule detects the INC ransomware dropping its INC-README ransom note across directories during encryption in the ransomware-as-a-service operation tracked by Acronis. Adversaries write the note to every touched folder alongside appending the .INC extension to encrypted files. The fixed note filename is a strong post-impact detection anchor.

Malicious DEVMAN Ransomware Encrypted File and Note Artifacts

This rule detects files encrypted by DEVMAN ransomware, identified by the .DEVMAN extension and the deterministically renamed ransom note e47qfsnz2trbkhnt.devman. DEVMAN is a DragonForce variant that encrypts its own note, producing this fixed filename.

Malicious Akira Ransomware Encrypted File Extension via File Event

This rule detects files being renamed with the .akira extension appended during encryption by Akira ransomware. Mass creation of .akira files indicates active encryption of the host.

Malicious BitLocker Abuse for Ransomware via PowerShell (via ps_script)

This rule detects PowerShell that enables BitLocker while removing the key protectors which the ShrinkLocker ransomware does to encrypt drives and lock out the legitimate owner without leaving a recovery key.

Malicious WeaXor Ransomware Encryption Artifacts on Disk (via file_event)

This rule detects file system artifacts left by WeaXor ransomware, namely files renamed with the wex extension and the dropped RECOVERY INFO note. It indicates active encryption on the host.

Malicious Akira Ransomware Execution via Encryption Command-Line Parameters

This rule detects process execution using the distinctive encryption command-line parameters of the Akira ransomware encryptor, matching intrusions where a renamed akira.exe is run against mounted network shares. The switches control encryption scope and percentage across targeted paths and shares. Detecting these parameters catches the encryptor even when the binary is renamed to evade name-based controls.

Malicious Windows Defender Disabling via DC.exe Defender Control by Elpaco Ransomware

This rule detects execution of the Defender Control utility (DC.exe) with a disable switch to turn off Windows Defender. This behavior is used by the Elpaco ransomware, a Mimic variant, to blind endpoint protection before encryption. Disabling defenses removes the primary barrier to file encryption and lateral movement, making early detection critical.

Malicious DeadLock Ransomware Encrypted File Extension Creation (via file_event)

This rule detects creation of files carrying the .dlock extension appended by the DeadLock ransomware encryptor as reported by Group-IB. Adversaries rename encrypted files with this extension during impact, so these writes indicate active DeadLock encryption on the host.

Malicious DeadBolt Ransomware Note and Encrypted File Artifacts

This rule detects the creation of the DeadBolt ransom note or files bearing the .deadbolt extension which mark encrypted data on compromised QNAP network attached storage devices. The note and extension appear as the ransomware finishes encrypting shares. It is important because their presence confirms an active DeadBolt impact event requiring immediate response.