Sigma detection rules, expert-reviewed

Malicious Event Log Tampering via wevtutil Channel Disable by FunkSec Ransomware (via process_creation)

This rule detects use of wevtutil to disable the Security and Application event log channels, a defense-evasion action performed by FunkSec ransomware to blind logging before encryption. Adversaries turn off event channels so their tampering, service termination and encryption activity is not recorded for responders.

Malicious Akira Ransomware Encryptor Execution (via process_creation)

This rule detects execution of the Akira ransomware encryptor invoked with its characteristic path, share and encryption-percentage arguments. Operators launched akira.exe and locker.exe with the -n, -p and -s flags to encrypt local drives and network shares.

Suspicious LocalAccountTokenFilterPolicy Enabled via Registry by BlackByte Ransomware

This rule detects the LocalAccountTokenFilterPolicy registry value being set to one, which disables remote UAC filtering and grants full administrative access for local accounts over the network. BlackByte ransomware sets this value to ease lateral movement.

Malicious Ransomware Self-Deletion via Ping Loopback and Del

This rule detects a command line that pings the unusual loopback address 127.0.0.7 and then deletes a file, a self-removal and timing-delay technique used by Mamona ransomware after encryption. The non-standard loopback octet combined with a delete command is a strong anti-forensic indicator.

Suspicious Windows Firewall Disabled via netsh by BlackByte Ransomware

This rule detects netsh disabling all Windows Firewall profiles, a defense evasion action used by BlackByte ransomware to remove network restrictions before spreading. Turning off all firewall profiles is rarely legitimate on managed endpoints.

Malicious Windows Defender Service Disable via sc.exe by Nova Ransomware

This rule detects sc.exe being used to disable the WinDefend service by setting its start type to disabled, a defense evasion step performed by Nova ransomware before encryption. Disabling the Defender service removes real-time protection from the host.

Malicious Shadow Copy Deletion and Recovery Tampering by BabLock Ransomware

This rule detects deletion of volume shadow copies and disabling of Windows recovery, hallmarks of BabLock ransomware pre-encryption activity. The operators run vssadmin Delete Shadows and bcdedit recoveryenabled No to prevent victims restoring their data. This inhibits recovery and maximizes the impact of the encryption stage.

Malicious File Encryption via Kraken Ransomware Encryptor Binary

This rule detects execution of the Kraken ransomware encryptor with its characteristic key, path, timeout and directory command-line switches. The binary encrypts victim files and appends the .zpsc extension while dropping a ransom note. Detecting the encryptor invocation provides a late-stage indicator of active ransomware deployment.

Malicious Ransomware Ransom Note README-RECOVER File Creation

This rule detects creation of README-RECOVER ransom note text files, the note naming convention dropped during the Qilin ransomware encryption stage. These notes appear across directories once mass file encryption completes. Their creation is a definitive indicator that ransomware impact has already occurred and requires immediate response.

Malicious Eldorado Ransomware Ransom Note Creation

This rule detects the creation of the HOW_RETURN_YOUR_DATA.TXT ransom note dropped by Eldorado ransomware across encrypted directories. The note appears once encryption completes and delivers the extortion demand. It matters because its widespread creation confirms an active Eldorado impact event on the host or shares.

Malicious Interlock Ransomware Ransom Note File Creation

This rule detects creation of ransom note files named README that Interlock ransomware writes across encrypted directories using the distinctive filename bang README bang txt. The unique note filename indicates active ransomware deployment and data encryption on the host.

Windows: BlueSky ransomware-related file and share access events

Alerts on Windows file/share access involving .bluesky and "DECRYPT FILES BLUESKY" artifact naming tied to BlueSky activity.

Windows: Rorschach execution indicator via critical command-line pattern

Windows process creation events with certain system utilities and a "11111111" command-line marker are flagged as ransomware execution activity.

Windows Registry Ransom Note Keyword Changes in LegalNoticeCaption/Text

Alerts on registry changes to Windows legal notice caption/text containing ransomware-style keywords.

Antivirus ransomware signature match (Babuk, Lockbit, Ryuk, WannaCry)

Flags antivirus ransomware detections when the alert signature contains known ransomware family name strings.