Sigma detection rules, expert-reviewed

Suspicious Port Forwarding via Netsh PortProxy Linked to Chinese APT Techniques

This rule detects netsh configuring an interface portproxy rule, a traffic-relay technique used in trending Chinese APT operations to pivot through compromised hosts. Attackers add portproxy forwarding to tunnel access to internal systems, so netsh portproxy additions are a meaningful internal proxy and pivot indicator.

Suspicious WerFault Masquerade Executing From Non-System Path Linked to Turla Snake

This rule detects a process named WerFault.exe running from a directory other than System32 or SysWOW64, a masquerading technique used by Turla Snake malware which hides in the WinSxS tree. The legitimate Windows Error Reporting binary only runs from system directories, so a WerFault image outside them is a high-confidence indicator of this masquerade and service abuse.

Suspicious Impacket WMIExec Command Execution Pattern Linked to Salt Typhoon

This rule detects the command shell being spawned with the quiet-mode output-redirection pattern that Impacket wmiexec uses to capture results over an admin share, a remote-execution technique used by Salt Typhoon. The tool runs cmd with /Q /c and redirects output to a file on ADMIN$, so this distinctive command structure is a strong indicator of Impacket-based lateral movement.

Suspicious File Download via CertUtil Linked to Salt Typhoon

This rule detects certutil.exe used with URL cache or decode switches to retrieve or stage remote content, an ingress tool transfer technique used by Salt Typhoon. Attackers abuse this signed LOLBin to pull payloads while evading download controls, so certutil download and decode invocations are a well-known malicious tradecraft signal.

Malicious EDRKillShifter Defense Evasion Tool Execution Linked to RansomHub

This rule detects execution of the EDRKillShifter loader by image name, a bring-your-own-vulnerable-driver utility used by RansomHub affiliates to disable endpoint protection. The tool loads a signed but vulnerable driver to terminate security agents from kernel space, so any execution is a critical pre-ransomware defense-evasion event.

Suspicious Cloud Exfiltration via Rclone Linked to INC Ransomware

This rule detects rclone invoked with copy or sync arguments toward a remote target, an exfiltration technique used by INC ransomware operators. Attackers use rclone to push stolen data to cloud storage before encryption, so command-line rclone transfers on servers and workstations are a strong exfiltration indicator.

Suspicious Selective Archiving via 7-Zip Linked to INC Ransomware Exfiltration

This rule detects 7-Zip archiving that explicitly excludes executable, video, and virtual-disk file types, a staging pattern seen in INC ransomware data theft. Operators exclude bulky non-document files to keep exfiltration archives small and focused on sensitive documents, so exclusion switches on 7-Zip are a targeted collection signal.

Suspicious Executable Launched From AppData Roaming Linked to GootLoader

This rule detects processes executing directly from the user AppData Roaming directory, a location GootLoader uses to stage and run its payloads. Legitimate installers occasionally run from AppData, so this pattern is heuristic, but user-writable execution paths are a common malware staging behavior warranting review.

Suspicious Batch Script Execution From Temp via Command Interpreter Linked to GootLoader

This rule detects the Windows command interpreter launching a .bat file located in a Temp directory, an execution pattern used by GootLoader scheduled-task persistence. GootLoader registers a task that runs command.exe against a batch file dropped in Temp to relaunch its loader, so command-interpreted batch files from Temp are a strong indicator of this loader.

Suspicious BrightMetricAgent Remote Tool Execution Associated With Volt Typhoon

This rule detects execution of brightmetricagent.exe, a remote support agent binary abused during Volt Typhoon intrusions for persistent access. Because this specific agent is uncommon in most enterprise fleets and was used as attacker tooling, its presence on endpoints should be verified against sanctioned software inventories.

Suspicious Misspelled WMIC Binary Execution Associated With Volt Typhoon

This rule detects execution of a binary named wminc.exe, a misspelled masquerade of the legitimate wmic.exe tied to Volt Typhoon living-off-the-land tradecraft. The deliberately mistyped name is an anomalous constant that legitimate software does not produce, so any execution is highly suspicious and worth immediate triage.

Suspicious Data Exfiltration via WinSCP Command Line in BlackSuit Ransomware

This rule detects WinSCP driven from the command line with an embedded session and scripted transfer commands, an exfiltration behavior used by BlackSuit ransomware operators. Attackers script WinSCP to push stolen data to attacker-controlled SFTP servers before encryption, so scripted WinSCP sessions on servers are a strong exfiltration signal.

Suspicious Remote Process Creation via WMIC in BlackSuit Ransomware

This rule detects wmic.exe invoking process creation against a remote node, a lateral-movement technique used by BlackSuit ransomware affiliates. Attackers abuse WMI to spawn payloads on other hosts without dropping remote services, so remote wmic process calls warrant investigation.

Malicious Volume Shadow Copy Deletion via BlackSuit Ransomware

This rule detects deletion of volume shadow copies through vssadmin, wmic, or PowerShell as seen in BlackSuit ransomware operations. Adversaries remove shadow copies to inhibit system recovery immediately before file encryption, so this activity is a strong indicator of imminent ransomware impact.

Malicious Boot Configuration Tampering to Disable Recovery via BlackSuit Ransomware

This rule detects bcdedit being used to delete recovery settings or force safe boot, an inhibit-system-recovery behavior observed in BlackSuit ransomware intrusions. Operators run this before encryption to prevent victims from booting into recovery and to weaken protections, making it a high-value pre-encryption signal.