Sigma detection rules, expert-reviewed

Malicious SOCKS Proxy Tunnel via Earthworm Rssocks by UAT-8837

This rule detects execution of the Earthworm tunneling tool in rssocks reverse SOCKS mode connecting outbound. UAT-8837 uses Earthworm renamed as v.ico or verr.ico to tunnel traffic into victim networks. Reverse SOCKS proxies give an actor interactive access to internal systems while evading perimeter controls.

Malicious Group Policy Preferences Credential Hunting via Findstr by UAT-8837

This rule detects use of findstr to recursively search policy files for the cpassword attribute. UAT-8837 harvests Group Policy Preferences passwords which can be decrypted with a publicly known AES key. Locating cpassword values yields reusable domain credentials for privilege escalation and lateral movement.

Malicious Disabling of Microsoft Defender Real-Time Protection via SystemSettingsAdminFlows by DeadLock Ransomware

This rule detects use of SystemSettingsAdminFlows to toggle Microsoft Defender real-time protection. The DeadLock ransomware loader invokes this living-off-the-land binary to disable endpoint protection before deploying its payload. Turning off real-time protection blinds the defender to subsequent malicious activity.

Malicious Mass Hyper-V Virtual Machine Shutdown via PowerShell by Kraken Ransomware

This rule detects PowerShell forcibly stopping Hyper-V virtual machines by piping Get-VM into Stop-VM with the force and turnoff switches. This technique is used by the Kraken ransomware group to shut down virtualized workloads before encryption. Terminating running virtual machines unlocks their files for encryption and maximizes operational impact.

Suspicious Shadow Copy Deletion via Vssadmin by Kraken Ransomware

This rule detects deletion of Volume Shadow Copies using vssadmin with the delete shadows and all flags. This behavior is associated with the Kraken ransomware group which inhibits system recovery prior to encryption. Removing shadow copies prevents victims from restoring files without paying the ransom.

Suspicious Ransomware Fan-Out Deployment via PsExec Spread (Qilin)

This rule detects execution of a deployment tool with a spread argument used by the Qilin group to push its ransomware encryptor across hosts. Automated fan-out deployment over remote channels is a lateral-movement and impact accelerant. The spread flag distinguishes mass deployment from routine remote administration.

Suspicious npm Postinstall Node Execution From Fixtures Path (BeaverTail OtterCookie)

This rule detects node.exe executing a script from a test fixtures eval path, the malicious npm postinstall chain used by the BeaverTail and OtterCookie malware families delivered through compromised packages. This lures developers into running staged JavaScript modules such as index.js and file15.js. Node execution from fixture directories during package installation indicates a supply-chain compromise.

Suspicious Impacket smbexec Command Execution Pattern

This rule detects the Impacket smbexec execution pattern where a command interpreter runs with the quiet and command flags, echoes a command, and redirects output to a share path ending in __output. This service-based semi-interactive shell is used for lateral movement during these ransomware attacks. The __output redirection artifact is a reliable smbexec indicator.

Suspicious Archiving of Registry Hives via WinRAR (UAT-8099)

This rule detects use of WinRAR to compress the SAM and SYSTEM registry hives for exfiltration. UAT-8099 archives these hives to extract credentials offline from compromised IIS servers. Archiving registry hives is a collection step supporting credential access and later exfiltration.

Malicious Volume Shadow Copy Deletion via vssadmin or WMIC

This rule detects deletion of volume shadow copies via vssadmin Delete Shadows or wmic shadowcopy delete. Ransomware families in this report remove shadow copies to prevent victims from restoring encrypted files. Shadow copy deletion is a hallmark inhibit-recovery step performed during ransomware execution.

Malicious JuicyPotato Privilege Escalation Execution (UAT-7237)

This rule detects execution of the JuicyPotato privilege-escalation tool identified by its characteristic target, CLSID and program arguments. UAT-7237 uses a JuicyPotato variant to abuse token impersonation and escalate to SYSTEM on web hosting servers. Presence of these arguments together indicates active local privilege escalation.

Suspicious Script Host Execution of Decoy-Named JavaScript Dropper (PS1Bot)

This rule detects the Windows Script Host executing a JavaScript file named to impersonate a document, such as FULL DOCUMENT.js, delivered inside a decoy ZIP archive. PS1Bot uses this dropper to write and run obfuscated VBScript that stages further PowerShell payloads. Script host execution of document-themed .js files indicates malicious delivery.

Suspicious SharePoint Worker Process Spawning Command Interpreter via ToolShell

This rule detects the IIS worker process w3wp.exe spawning a command interpreter such as cmd.exe or PowerShell on a SharePoint server. This behavior is associated with ToolShell exploitation of SharePoint (CVE-2025-53770) leading to remote code execution and webshell deployment. Command interpreter execution under the SharePoint worker process indicates active exploitation and hands-on-keyboard activity.

Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell

This rule detects wscript.exe or cscript.exe executing a .js file and spawning PowerShell with an encoded command. The Emmenhtal loader used in this MaaS operation against Ukrainian entities runs JavaScript such as Work.js via WScript.Shell to launch encoded PowerShell that fetches the Amadey payload, so this script-to-encoded-PowerShell chain is the core delivery behavior.

Suspicious Rclone Exfiltration Masquerading as wininit.exe

This rule detects a process named wininit.exe running with Rclone-style cloud transfer arguments such as copy with remote configuration flags. Talos IR observed the Rclone exfiltration binary renamed to wininit.exe to blend with a legitimate system process while bulk-copying victim data to attacker cloud storage, so this Image and command-line mismatch flags staged exfiltration.