Sigma rule: Grixba Malware Reconnaissance Activity

Rule

Title

Grixba Malware Reconnaissance Activity

Status

experimental

Level

high

Author

yxinmiracle, Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-11-26

File

rules-emerging-threats/2025/Malware/Grixba/proc_creation_win_malware_grixba_recon.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects execution of the Grixba reconnaissance tool based on suspicious command-line parameter combinations.
This tool is used by the Play ransomware group for network enumeration, data gathering, and event log clearing.

Log source

product

windows

category

process_creation

Detection

selection_mode_flag:
    CommandLine|contains:
        - '-m '
        - '-mode '
        - '-m:'
        - '-mode:'
selection_input_flag:
    CommandLine|contains:
        - '-i '
        - '-input '
        - '-i:'
        - '-input:'
selection_scan_value:
    CommandLine|contains:
        - 'scan '
        - 'scanall '
selection_input_options:
    CommandLine|contains:
        - ':f '
        - ':r '
        - ':s '
        - ' f '
        - ' r '
        - ' s '
condition: all of selection_*

False positives (as the rule lists them)

• Legitimate tools that use similar command-line argument structures (e.g., a tool with '--mode scan' and '--input file.txt') could trigger this rule. However, the specific combinations are indicative of reconnaissance or defense evasion.

Tags

• attack.reconnaissance
• attack.t1595.001
• attack.discovery
• attack.t1046
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1046
• T1595.001

References

• https://fieldeffect.com/blog/grixba-play-ransomware-impersonates-sentinelone
• https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2025/Malware/Grixba/proc_creation_win_malware_grixba_recon.yml