Sigma detection rules, expert-reviewed

DragonForce Ransomware File Association Registration for Encrypted Extension (via registry_set)

This rule detects registration of a DefaultIcon association for the .dragonforce_encrypted file extension, an impact behavior DragonForce ransomware performs so all encrypted files display an attacker-supplied icon dropped under the public profile. Registering an icon for a novel encrypted extension is a strong post-encryption indicator, making detection useful for scoping ransomware impact across a host.

Malicious DragonForce Ransomware Encrypted File Extension (via file_event)

This rule detects creation of files bearing the .dragonforce_encrypted extension written by the DragonForce ransomware payload during mass file encryption. Presence of this extension confirms active data-encryption impact on the host. Rapid detection enables containment before encryption spreads across shares.

Suspicious Fog Ransomware File Artifacts (via file_event)

This rule detects creation of the Fog ransomware DbgLog.sys operational log or files bearing the .fog and .flocked encrypted extensions. These artifacts are dropped during Fog ransomware encryption on compromised hosts.

Malicious regsvcs LOLBin Loading Ransomware DLL from UNC Path

This rule detects the regsvcs.exe living-off-the-land binary being used to load and install a DLL from a UNC network path, matching SafePay ransomware deployment via regsvcs proxy execution. Attackers abuse regsvcs to run their encryptor DLL while bypassing application controls. Loading a DLL over UNC through regsvcs is not a legitimate developer workflow.

Malicious Lynx Ransomware Encrypted File Extension Creation (via file_event)

This rule detects creation of files carrying the .LYNX extension appended by the Lynx ransomware encryptor as reported by Group-IB. Adversaries rename encrypted files with this extension during impact, so a burst of these writes indicates active ransomware encryption on the host.

Malicious Shadow Copy and Backup Deletion for Ransomware Recovery Inhibition

This rule detects deletion of volume shadow copies and backup catalogs through vssadmin wmic and wbadmin which Phobos ransomware runs before encryption to prevent victims from restoring their files. Inhibiting system recovery is a common precursor to file encryption and warrants immediate response.

Suspicious Event Log Clearing via wevtutil During Ransomware Activity

This rule detects wevtutil clearing Windows event logs which ransomware operators perform to destroy evidence of intrusion and lateral movement. Clearing logs immediately before or after encryption impairs incident response and timeline reconstruction.

Malicious Cactus Ransomware Ransom Note Creation (via file_event)

This rule detects creation of Cactus ransomware ransom notes, which embed the fixed C.A.c_T.U-S-R.e-a_D.m-e marker between randomized prefixes and postfixes in the note filename. Adversaries leverage mass note deployment during the encryption stage, making detection of this distinctive embedded string a reliable late-stage indicator of a Cactus impact event.

Suspicious Windows Defender Tamper Protection Disabled via Registry by Nova Ransomware

This rule detects the Windows Defender TamperProtection value being set to zero under the Defender Features key, disabling tamper protection so security tooling can be altered. Nova ransomware performs this change as part of multi-layered Defender evasion.

Malicious SQL Server Spawning Command Interpreter via Mallox Ransomware

This rule detects the MS SQL Server process sqlservr.exe spawning a command interpreter such as cmd, PowerShell, or sqlps, the initial code-execution step in Mallox ransomware intrusions following database compromise. A database engine launching shells almost always reflects abuse of SQL for command execution and should be treated as an active intrusion.

JanaWare Ransomware Ransom Note _ONEMLI_NOT_ Written to Disk (via file_event)

This rule detects the JanaWare ransomware writing its _ONEMLI_NOT_ ransom note across folders as it completes encryption in attacks against Turkish organizations. Adversaries drop this hardcoded Turkish-language note filename in every encrypted directory. The fixed prefix is a reliable post-impact detection anchor.

Malicious Ransomware Extension Class Registration for ELPACO-team by Elpaco Ransomware

This rule detects registration of the .ELPACO-team file extension class under HKLM Classes. Elpaco ransomware, a Mimic variant, registers its own encrypted-file extension to associate the ransom note handler after encryption. Presence of this class key indicates ransomware has executed and modified file associations on the host.

Malicious Mamona Ransomware Note and Encrypted File Extension

This rule detects creation of the Mamona ransomware note README.HAes.txt or files bearing the .HAes encrypted extension. These artifacts are written recursively across directories once Mamona completes its offline encryption.

Suspicious Silent AnyDesk Installation for Remote Access by DeadLock Ransomware

This rule detects silent unattended installation of AnyDesk configured to start with Windows. The DeadLock ransomware operators deploy AnyDesk as a covert remote access tool for persistence and hands-on control. Silent installation with automatic startup indicates the tool is being planted rather than installed by a user.

Malicious Volume Shadow Copy Deletion via vssadmin by Medusa Ransomware

This rule detects use of vssadmin to delete all volume shadow copies quietly, matching the inhibit-recovery step performed by Medusa ransomware before encryption per Unit 42. Ransomware wipes shadow copies to prevent victims from restoring files which is a strong pre-encryption indicator of an active ransomware attack.