Sigma detection rules, expert-reviewed

Suspicious VBScript Payload Stored in CurrentVersion Registry Value (via registry_set)

This rule detects registry values written under HKCU or HKLM CurrentVersion that contain VBScript execution keywords such as Execute, vbscript or Shell.Application. Actors including Nobelium stash script payloads in non-Run CurrentVersion values to hide fileless persistence outside the commonly scrutinized Run subkeys.

Suspicious Browser Extension Force-Install via Registry (via registry_set)

This rule detects registry writes to the browser ExtensionInstallForcelist policy that silently force-install an extension into Chrome or Edge. PrivateLoader pushes unwanted extensions this way so the browser loads attacker code without user consent. Programmatic force-install entries are a stealthy persistence and monetization mechanism worth reviewing.

Suspicious UAC Bypass via control.exe App Paths or Shell Open Command Hijack

This rule detects registry modifications that hijack the control.exe App Paths key or an AppX shell open command handler, techniques used to bypass User Account Control by redirecting an auto-elevated process to attacker-controlled code. Adversaries plant these keys so a trusted elevated binary launches their payload without a UAC prompt. Such registry writes outside of software installation are highly suspicious.

Malicious Snatch Ransomware SuperBackupMan SafeBoot Service Registration

This rule detects registration of the SuperBackupMan service or its SafeBoot Minimal registry key used by Snatch ransomware to force encryption while booted into Safe Mode where security tooling is inactive. The service name is a meaningful campaign constant tied to this defense-evasion technique. Its creation strongly indicates Snatch pre-encryption staging.

Malicious Sibot Malware Registry Persistence Value

This rule detects creation of the sibot value under the CurrentVersion registry hive, the persistence mechanism used by the Sibot malware to survive reboots. The value name is a meaningful campaign constant that does not correspond to legitimate software. Its presence indicates an established Sibot foothold.

Suspicious Run Key Persistence in CurrentVersion (via registry_set)

This rule detects creation or modification of ASEP Run key values under HKLM or HKCU CurrentVersion that point to executables in user-writable or temporary directories. DragonForce establishes autostart persistence via Run keys so its loader relaunches on logon, maintaining foothold through reboots.

Malicious UAC Bypass via COMAutoApprovalList Registry Modification (via registry_set)

This rule detects modification of the COMAutoApprovalList registry key used to auto-elevate COM objects and bypass User Account Control. Medusa ransomware abuses this key to silently elevate privileges via a trusted COM interface, avoiding the UAC prompt before deploying its payload.

Suspicious UAC Bypass via COMAutoApprovalList Registry Modification (via registry_set)

This rule detects modification of the COMAutoApprovalList registry key used to auto-elevate COM objects without a UAC prompt. LockBit tampers with this key to bypass User Account Control and run with elevated privileges, so changes here indicate a privilege escalation and defense-evasion attempt.

Suspicious Run Key Persistence Referencing Script Files Linked to FIN7

This rule detects a new Run or RunOnce autorun value that points to a VBScript file, an ASEP persistence technique used by FIN7. Adversaries add script-based autoruns under CurrentVersion Run keys so their loader re-executes at logon, so autorun values referencing .vbs or .vba files are a meaningful persistence signal.

Suspicious Sysinternals EULA Acceptance Registry Write Linked to INC Ransomware

This rule detects the EulaAccepted registry value being written under a Sysinternals product key, indicating first-run command-line use of a Sysinternals tool as seen in INC ransomware intrusions. Because operators use PsExec and similar tools with the -accepteula flag, an unexpected EULA write on a server can reveal attacker tool staging, though administrators also trigger it legitimately.

Malicious Microsoft Defender Tampering via Registry Values

This rule detects modification of Microsoft Defender protection registry values such as TamperProtection DisableBehaviorMonitoring and DisableOnAccessProtection which infostealers set to blind endpoint defenses before harvesting credentials. Turning off these real time protections is a strong defense evasion indicator that precedes credential theft.

Malicious Windows Defender DisableAntiSpyware Registry Modification

This rule detects the DisableAntiSpyware registry value being set to disable Microsoft Defender which Black Basta operators use to blind endpoint protection before deploying ransomware. Disabling Defender through this policy value is a strong defense evasion indicator that precedes further malicious activity.

Malicious Shadow Copy Deletion via WMI PowerShell

This rule detects PowerShell querying Win32_Shadowcopy through WMI and deleting the returned shadow copies, an alternative recovery-inhibition technique that avoids the vssadmin binary. It is associated with REvil ransomware-as-a-service affiliate operations seeking to destroy backups prior to encryption. Detecting the WMI-based variant closes a common evasion gap around shadow copy deletion.

Suspicious Active Directory Enumeration via AdsiSearcher

This rule detects PowerShell use of the AdsiSearcher type accelerator to query Active Directory, an enumeration step performed by the actors exploiting CVE-2026-1731. Directory searches map users and groups to plan privilege escalation and lateral movement. AdsiSearcher usage in scripts is uncommon outside of dedicated administrative tooling.

Malicious CACTUS Ransomware Deployment via TotalExec Script (via ps_script)

This rule detects PowerShell content referencing the TotalExec deployment script combined with PsExec, the automation CACTUS uses to push ransomware across hosts. TotalExec wraps PsExec to remotely execute the encryptor on many machines at once, enabling network-wide impact.