Potential Maze Ransomware Activity
Detects specific process characteristics associated with Maze ransomware droppers. This includes a temporary file being executed as a child process of WINWORD.exe, and the execution of wmic.exe to delete shadow copies, which is a common tactic for ransomware to inhibit system recovery.
Sigma
