Sigma detection rules, expert-reviewed

Malicious CACTUS Ransomware Deployment via TotalExec Script (via ps_script)

This rule detects PowerShell content referencing the TotalExec deployment script combined with PsExec, the automation CACTUS uses to push ransomware across hosts. TotalExec wraps PsExec to remotely execute the encryptor on many machines at once, enabling network-wide impact.

Malicious Shadow Copy Deletion via WMI PowerShell (via ps_script)

This rule detects PowerShell that queries the Win32_Shadowcopy WMI class and then deletes the returned instances. Ransomware uses this WMI approach to remove Volume Shadow Copies without invoking vssadmin, evading command-line detections focused on that utility. Scripted shadow copy destruction through WMI is a clear recovery-inhibition behavior.

Malicious Windows Defender Tampering via Set-MpPreference (via ps_script)

This rule detects PowerShell Set-MpPreference usage that disables Microsoft Defender protections or adds broad exclusions. DragonForce operators run these cmdlets to blind endpoint protection before staging and encryption, clearing the way for tooling to execute undetected.

Suspicious PowerShell Remote File Download Cmdlets (via ps_script)

This rule detects PowerShell script blocks that invoke remote download primitives such as Invoke-WebRequest, Start-BitsTransfer or the WebClient DownloadFile method. The BadPilot campaign uses these cmdlets to retrieve additional payloads, so their presence in script telemetry points to ingress tool transfer during intrusion.

Malicious Bumblebee Loader User-Agent In Web Traffic

This rule detects the hardcoded User-Agent string Bumblebee Loader in outbound web traffic, the beacon signature of the Bumblebee loader as it contacts its command-and-control server. Bumblebee stages Cobalt Strike and hands off access to ransomware affiliates. The self-identifying User-Agent uniquely marks infected hosts checking in.

Suspicious FvncBot Device Registration Request Over HTTP

This rule detects HTTP POST requests to the FvncBot registration endpoint /api/v1/devices/register, the unencrypted enrollment call the Android banking trojan makes on first check-in. The request carries device metadata as cleartext JSON before the operator issues WebSocket control commands. The fixed URI path identifies the trojan family independent of the C2 host in use.

Possible Discord Webhook C2 or Data Exfiltration

This rule detects outbound requests to Discord webhook endpoints which threat actors repurpose as command and control channels and as a destination for exfiltrated data. Because webhooks blend into normal Discord traffic they provide a low cost covert channel for stealing information and receiving operator instructions.

Suspicious Bulk Kubernetes Secret Dump via Kubectl

This rule detects kubectl retrieving secrets across all namespaces in a serialized output format, a bulk-collection pattern used to exfiltrate cluster credentials. It is associated with software supply chain attacks that leverage compromised developer tooling to dump Kubernetes secrets. Detecting mass secret reads flags credential harvesting from cluster control planes.

Suspicious Bun Runtime Spawned by Node During npm Lifecycle

This rule detects the Node.js process launching the Bun JavaScript runtime, a chain observed when malicious npm packages execute payloads through Bun during install or lifecycle events. It is associated with software supply chain attacks that weaponize trusted developer workflows to run code on build and developer hosts. Detecting this uncommon parent-child pair surfaces post-install package execution abuse.

Malicious Volume Shadow Copy Deletion via Vssadmin

This rule detects vssadmin being invoked to delete all volume shadow copies quietly, a recovery-inhibition step performed before file encryption. It is associated with REvil ransomware-as-a-service affiliate operations that wipe backups to prevent victims from restoring encrypted data. Catching this activity provides an early signal that ransomware deployment is imminent.

Malicious Chisel Reverse Tunnel Execution for Protocol Tunneling

This rule detects execution of the Chisel tunneling tool either by binary name or by a client command establishing a reverse tunnel, the protocol tunneling method used by Scattered Spider for covert connectivity and persistence. Chisel builds an encrypted tunnel that lets adversaries pivot through the network and evade egress controls. The tool has no legitimate enterprise use in most environments.

Malicious AnyDesk Silent Unattended Installation via Command Line

This rule detects an AnyDesk command line that combines an unattended install flag with a silent and start-with-Windows option, the scripted RMM deployment pattern used by Scattered Spider to plant remote access after help-desk social engineering. A single command carrying install, silent and auto-start flags indicates automated rather than user-initiated setup. This behavior enables covert remote control and persistence.

Malicious MeshCentral Agent Installation With Campaign Naming

This rule detects execution of MeshCentral remote-management agents using the azure-ops and v2 naming observed in ShinyHunters intrusions following the PeopleSoft zero-day exploitation. These specific agent file names are meaningful campaign constants used to blend the remote-access tool into cloud-looking traffic. Their execution indicates attacker-controlled remote management for persistence and lateral movement.

Malicious Child Process Spawned From n8n Node Process

This rule detects a Node.js process running n8n spawning shell, discovery or downloader child processes such as sh, whoami, wget or curl, the exploitation behavior of the Zerobot botnet abusing the CVE-2025-68613 expression sandbox escape. The n8n workflow engine should not launch system commands, so these child spawns indicate remote code execution with n8n process privileges. This pattern reflects active post-exploitation on the host.

Malicious Volume Shadow Copy Deletion for Recovery Inhibition

This rule detects deletion of volume shadow copies through vssadmin, wmic or PowerShell, the recovery-inhibition step used by the Handala group and many destructive operations before encryption or wiping. Removing shadow copies prevents victims from restoring affected files. Administrative shadow copy deletion on endpoints is uncommon and warrants review alongside other impact indicators.