Sigma detection rules, expert-reviewed

Malicious Volume Shadow Copy Deletion via Vssadmin or WMIC (via process_creation)

This rule detects deletion of Volume Shadow Copies through vssadmin or wmic. Ransomware removes shadow copies so that victims cannot roll back encrypted files from local snapshots, maximizing pressure to pay. Programmatic shadow copy deletion is a well-established impact behavior seen immediately before or during encryption.

Malicious Credential Dumping via Mimikatz Sekurlsa Command (via process_creation)

This rule detects Mimikatz module commands on the command line regardless of the executable name, catching renamed copies of the tool. The sekurlsa and lsadump modules extract plaintext credentials, hashes and tickets from LSASS memory and the SAM. These module strings are highly specific to credential theft and rarely appear in legitimate activity.

Suspicious Service Termination via Net Stop Before Ransomware (via process_creation)

This rule detects net.exe being used to stop database, backup or security services, a staging step commonly seen before file encryption. Ransomware operators halt these services so that data files are unlocked and defensive tooling is silenced ahead of the payload. Targeted service shutdown of backup and security software is a high-value pre-encryption indicator.

Malicious MSDT Command Line Invoking Follina Payload (via process_creation)

This rule detects the Microsoft Support Diagnostic Tool running with the diagnostic parameters and script markers used by Follina exploitation. CVE-2022-30190 passes an IT_BrowseForFile payload through the PCWDiagnostic package so that MSDT executes embedded PowerShell. MSDT command lines carrying these markers indicate an active exploit rather than genuine troubleshooting.

Malicious MSDT Execution Spawned by Office Application via Follina (via process_creation)

This rule detects a Microsoft Office application spawning the Microsoft Support Diagnostic Tool. CVE-2022-30190 (Follina) abuses a remote Office template and the ms-msdt MSProtocol URI to launch MSDT and run attacker code even when macros are disabled. An Office parent invoking msdt.exe is a reliable signal of exploitation attempting code execution.

Suspicious Zone.Identifier Mark-of-the-Web Removal (via process_creation)

This rule detects command lines that strip the Zone.Identifier alternate data stream from downloaded files, either by deleting the stream directly or via the PowerShell Unblock-File cmdlet. Emotet removes the Mark-of-the-Web so that dropped payloads run without SmartScreen or Protected View warnings. Clearing web-origin marks on freshly downloaded content is a defense-evasion behavior worth investigating.

Malicious Office Application Spawning PowerShell with Encoded Command

This rule detects a Microsoft Office application such as winword.exe or excel.exe spawning cmd.exe or powershell.exe with an EncodedCommand argument, a hallmark of malicious document execution delivering an obfuscated payload. Office productivity apps do not normally launch encoded PowerShell. This parent-child chain indicates user-driven macro or exploit execution leading to code execution.

Malicious SolarWinds BusinessLayerHost Spawning Command Interpreter

This rule detects SolarWinds.BusinessLayerHost.exe spawning a command interpreter such as cmd.exe or powershell.exe, anomalous child process behavior consistent with the SUNBURST backdoor executing operator commands. The legitimate Orion component does not normally launch shells, so this parent-child relationship is a strong supply-chain compromise indicator. It reflects post-exploitation activity from a trojanized signed binary.

Malicious Volume Shadow Copy Deletion via vssadmin

This rule detects deletion of volume shadow copies via vssadmin, an inhibit-recovery technique used by Snatch and many other ransomware families to prevent victims from restoring encrypted files. Legitimate administrative shadow copy deletion exists but is uncommon on endpoints. Combined with other ransomware indicators this behavior is high fidelity.

Malicious Reboot to Safe Mode via bcdedit SafeBoot Configuration

This rule detects use of bcdedit to set the boot configuration to safeboot minimal, a technique used by Snatch ransomware to reboot the host into Safe Mode where endpoint protection does not load before running encryption. Legitimate use of bcdedit safeboot outside of troubleshooting is rare. This behavior indicates an attempt to disable defenses ahead of impact.

Malicious rundll32 vbscript mshtml RunHTMLApplication Execution

This rule detects rundll32.exe invoking the vbscript protocol handler with mshtml RunHTMLApplication to execute inline script, a living-off-the-land technique used by the Sibot malware to run RegRead logic and retrieve its second stage. This LOLBin invocation has no legitimate use and bypasses application controls. Its presence indicates in-memory script execution and defense evasion.

Suspicious Self-Deletion of Dropper via Command Line

This rule detects a command shell chaining a short delay with deletion of the just-executed binary, a self-removal technique used by the Ryuk dropper to erase traces after payload deployment. Adversaries combine ping or timeout with del to allow the parent to exit before the file is removed. This anti-forensic pattern is rarely produced by legitimate software.

Malicious UAC Bypass via explorer.exe NOUACCHECK Argument

This rule detects execution of explorer.exe with the undocumented /NOUACCHECK argument, which spawns a child process that inherits elevated integrity from its parent while bypassing User Account Control checks. This technique was observed in Rapture ransomware intrusions to escalate privileges before payload execution. The argument has no legitimate interactive use and strongly indicates a UAC bypass attempt.

Suspicious WMIC Remote Process Creation for Lateral Movement

This rule detects use of wmic with the /node switch to spawn processes on remote hosts, a lateral movement technique observed in Quantum ransomware intrusions alongside PsExec and C$ share abuse. Adversaries leverage WMI process call create to run payloads remotely without dropping additional tooling. Legitimate administrative WMI usage exists, so context and target frequency should be reviewed.

Malicious Quantum Ransomware ttsel Payload Execution via Command Line

This rule detects execution of the ttsel.exe payload used during Quantum ransomware intrusions to stage tooling on compromised hosts. The named binary is a meaningful constant tied to this campaign chain that follows IcedID access. Its execution indicates hands-on-keyboard activity progressing toward ransomware deployment.