Sigma detection rules, expert-reviewed

Malicious Firewall Disable via netsh by Key Group Ransomware

This rule detects netsh disabling the Windows firewall for all profiles, a defense-evasion action performed by Key Group ransomware to weaken host protections before impact. Turning off the firewall across all profiles is rarely legitimate on production endpoints and precedes further malicious activity.

Suspicious Remote Process Creation via WMIC by Mallox

This rule detects WMIC being used with process call create, a lateral and local execution technique Mallox operators use to launch payloads through WMI. This command form is rare in normal administration and is a common ransomware execution primitive.

Suspicious Head Mare srvhost.exe Masquerading as System Service Host

This rule detects execution of srvhost.exe, a filename Head Mare uses to masquerade its Sliver implant and helper binaries as the legitimate Windows svchost service host. Because no genuine Windows component is named srvhost.exe, its execution is a reliable indicator of the group's tooling.

Suspicious PowerShell Download from Public Content Hosting via BlindEagle

This rule detects PowerShell referencing public content-hosting services such as Pastebin, GitHub raw, and Discord CDN, which BlindEagle abuses to stage and retrieve its next-stage RAT payloads. Combining the PowerShell interpreter with these delivery domains distinguishes malicious retrieval from ordinary browsing and merits review.

Suspicious Tusk Loader Execution from AppData AD_Security Directory

This rule detects process execution from the AppData Roaming AD_Security directory used by the Tusk infostealer campaign to stage its HijackLoader components and configuration. Executables running from this attacker-created path indicate active infostealer deployment.

Malicious Tusk Persistence via FJ_load Scheduled Task

This rule detects creation of a scheduled task named FJ_load that runs madHcCtrl.exe at user logon, the persistence mechanism of the Tusk infostealer campaign. The task keeps the loader resident across reboots, so detecting its creation catches the campaign at the persistence stage.

Malicious EastWind Persistence via schtasks DRMserver Task

This rule detects creation of a scheduled task named DRMserver that launches WinDRMs.exe at system start with SYSTEM privileges. This behavior is used by the EastWind campaign deploying CloudSorcerer and related implants against Russian government organizations. Establishing a boot-persistent SYSTEM task lets the attacker maintain durable, high-privilege footholds which makes early detection important.

Suspicious ngrok Tunnel Setup via Authtoken or Service Install (via process_creation)

This rule detects ngrok being configured with an authtoken or installed as a persistent service which attackers leveraging trusted relationships use to establish durable covert tunnels into the victim network.

Malicious RDP Tunneling via ngrok (via process_creation)

This rule detects ngrok being used to forward TCP port 3389 which attackers abusing trusted relationships employ to tunnel Remote Desktop through the perimeter and access internal hosts from the internet.

Suspicious Script Execution of Disk.vbs from Templates Directory (via process_creation)

This rule detects wscript or cscript running Disk.vbs from the ProgramData Windows Templates directory which is the staging location and entry script used by the ShrinkLocker ransomware to orchestrate BitLocker-based encryption.

Malicious DLL Sideloading via Renamed Signed Binary PlayVideoFull (via process_creation)

This rule detects execution of PlayVideoFull.exe which is a renamed copy of the legitimate WdSyncservice.exe used by the Sys01 stealer to sideload the malicious WDSync.dll payload while masquerading as a benign media component.

Suspicious Shadow Copy Creation via WMIC (via process_creation)

This rule detects use of wmic to invoke shadowcopy call create which ToddyCat performs to snapshot the volume and then archive the Chrome shadow copy for offline browser credential and data theft.

Malicious SSH Reverse Tunnel with Hidden Key Path (via process_creation)

This rule detects ssh.exe establishing a reverse port-forward tunnel while referencing key files staged under C:\Windows\AppReadiness which ToddyCat uses to build covert traffic-tunneling channels into victim infrastructure for data extraction.

Suspicious Remote Service Execution via PsExec (via process_creation)

This rule detects PsExec being used to execute commands on remote hosts which LockBit builder-based ransomware leverages through its psexec_netspread option to propagate the payload across the domain before mass encryption.

Malicious Geacon Payload Download to Temp via Trojanized Editor (via process_creation)

This rule detects a command line downloading a payload to /tmp/updater from the transferusee C2 infrastructure used by trojanized text editor apps targeting Chinese users to deliver the Geacon backdoor which grants remote control and must be triaged as active compromise.