Sigma detection rules, expert-reviewed

Suspicious Windows Event Log Clearing via Dire Wolf Ransomware (via process_creation)

This rule detects use of wevtutil to clear Windows event logs, an indicator removal step performed by Dire Wolf ransomware across the Application, System, Security and Setup logs.

Malicious Nova Ransomware Note and Encrypted File Extension via File Event

This rule detects creation of the Nova ransomware note README_NOVA.me alongside files bearing the .xgWLckNV extension appended during encryption. These artifacts are dropped as Nova encrypts a host and demands ransom.

Malicious BlackByte Ransomware Host Marker via Control Panel Registry

This rule detects the international control panel values s1159 and s2359 being set to BLACKBYTE, a distinctive host-marking artifact created by BlackByte ransomware. BlackByte writes this value to tag infected systems.

Malicious Cicada3301 Ransomware Locker Execution via Command Line Key (via process_creation)

This rule detects execution of the Cicada3301 ransomware locker binary with its command-line decryption key argument, which the Repellent Scorpius affiliate launched remotely through PsExec to encrypt hosts. Passing the encryption key on the command line is characteristic of this Rust-based locker and indicates active ransomware deployment.

Malicious Akira Ransomware Encryptor Command Line Flags

This rule detects execution of a binary using the stopvm and vmonly flags characteristic of the Akira Rust ransomware encryptor targeting ESXi. These flags instruct the tool to shut down and encrypt only virtual machines. Detecting the flag combination exposes the ransomware payload at runtime.

RedCurl QWCrypt Ransomware Execution with Hyper-V Targeting Flags

This rule detects the QWCrypt ransomware binary launched with its distinctive command line flags that target Hyper-V virtual machines while excluding gateway hosts and disabling shadow copies during encryption.

Suspicious DeadLock Ransomware C2 Proxy Request to prrq.php Endpoint (via proxy)

This rule detects HTTP requests to the /prrq.php proxy endpoint used by DeadLock ransomware to reach C2 proxy servers whose addresses are rotated through Polygon smart contracts per Group-IB. Adversaries route control and ransom-negotiation traffic through these proxy PHP endpoints, so requests to this path signal DeadLock C2 activity.

Suspicious Vulnerable Driver Load for BYOVD Abuse by DragonForce Ransomware (via driver_load)

This rule detects loading of the TrueSight.sys or RentDrv.sys vulnerable drivers that DragonForce abuses in a bring-your-own-vulnerable-driver technique to call ZwTerminateProcess and disable endpoint protection. Attackers exploit these signed drivers to kill security agents from kernel space. Flagging their load exposes tampering with defensive tooling.

Lynx ransomware execution flagged by Windows command-line flags

Flags Windows processes whose command lines include "--mode fast" and "--noprint" associated with Lynx ransomware execution.

Malicious NTDS Database Dump via NTDSUtil in BlackSuit Ransomware

This rule detects ntdsutil being used to create an installation from media (IFM) copy of the Active Directory database, a credential-access technique observed in BlackSuit ransomware intrusions. Dumping NTDS.dit gives operators every domain hash for offline cracking and full domain compromise, making this a critical detection.

Suspicious Password-Protected Archive Extraction of Everything64.dll by Elpaco Ransomware

This rule detects 7-Zip command-line extraction of a password-protected archive that deploys the Everything64.dll component. Elpaco ransomware, a Mimic variant, abuses the legitimate Everything search library for fast file enumeration prior to encryption. Password-protected extraction of this specific payload indicates staging of ransomware tooling on the host.

Malicious Chaos Ransomware Ransom Note and Encrypted Extension (via file_event)

This rule detects Chaos C++ ransomware writing the ransom note READ_IT.txt into the AppData folder and appending the .chaos extension to encrypted files. Creation of these artifacts indicates active encryption by the locker. The malware also drops debug logs under the temp folder.

Malicious Ransomware Encryptor Execution with Password Gate (via process_creation)

This rule detects a binary launched with password and no-admin arguments characteristic of the Qilin ransomware encryptor. Operators executed the encryptor with a long password and a no-admin flag to skip UAC prompts during mass encryption.

Suspicious Run Key Persistence via Masqueraded svhostss Value by Elpaco Ransomware

This rule detects creation of a Run key value named svhostss which masquerades as the legitimate Windows svchost process. Elpaco ransomware, a Mimic variant, uses this autorun entry to persist across reboots. The deceptive naming combined with an autorun context indicates persistence for a ransomware payload.

Malicious Akira Ransomware Encryption Execution (via process_creation)

This rule detects the Akira ransomware encryptor invoked with its characteristic path and share targeting switches. These combined command-line flags drive selective encryption across local and network locations. Detection here indicates active encryption and imminent impact on the environment.