Sigma detection rules, expert-reviewed

Malicious GS-Netcat Command and Control via Global Socket Relay Network (via dns_query)

This rule detects DNS resolution of the Global Socket Relay Network domain used by the GS-Netcat backdoor. In Operation Highland the Velvet Ant actor deployed GS-Netcat configured to reach single character subdomains of the relay network for reverse shell access. Resolution of this domain on servers is not expected in enterprise environments.

Suspicious DNS Query to Dynamic DNS and Tunneling Providers Abused by RATs

This rule detects DNS queries to dynamic DNS and tunneling provider domains frequently abused by commodity remote access trojans such as XWorm AsyncRAT DCRat and njRAT for command and control. These providers let adversaries map attacker infrastructure to disposable hostnames and tunnel traffic past network controls. Detecting lookups to these domains surfaces potential RAT beaconing that warrants investigation.

Suspicious Outbound Connection to TuxBot Botnet C2 Ports

This rule detects an outbound network connection to destination port 1999 or 31337, the fixed command-and-control ports used by the TuxBot v3 IoT botnet framework. These ports carry the botnet magic-byte protocol that tasks infected devices. Detecting connections to them surfaces likely bot check-in traffic worth investigating.

Suspicious MQTT Command and Control Connection by WikiLoader

This rule detects outbound network connections to MQTT broker ports used by a unique WikiLoader variant for command and control after a spoofed GlobalProtect infection. Repurposing the MQTT messaging protocol provides a resilient channel that many defenses do not inspect. Detecting connections on these ports from endpoints exposes potential WikiLoader beaconing.

Malicious DNS Query to Autonomous AI Attack C2 Proxy Domain

This rule detects a DNS lookup for the code.newcli.com domain used as an attacker proxy in the Chinese-speaking autonomous AI attack campaign. The domain fronts the actor command-and-control and AI-CLI proxy infrastructure. Detecting the query provides a high-confidence indicator of a host reaching the campaign infrastructure.

Suspicious DNS Queries to Secshow Open Resolver Scanning Infrastructure

This rule detects DNS queries associated with the secshow campaign that abuses open resolvers with crafted FQDNs encoding hex IP addresses, timestamps and amplification test markers. The activity maps and probes network infrastructure through DNS while blending into ordinary resolution traffic. Detecting these lookups exposes reconnaissance and DNS tunneling behavior tied to the secshow operation.

Suspicious DNS Queries to Simitor Tracking Tunnel Infrastructure

This rule detects DNS queries to the trk.simitor wildcard infrastructure used in a DNS tunneling campaign that encodes tracking and victim data into MD5-hashed subdomains resolving through a CNAME chain. The abuse of DNS as a covert channel lets operators exfiltrate identifiers and beacon without conventional network egress. Detecting these lookups exposes tracking-oriented DNS tunneling activity.

Malicious SharkBot Android Banking Trojan C2 via DGA Domain Suffix

This rule detects DNS resolution of domains containing the unique SharkBot domain generation algorithm suffix used to locate command and control infrastructure as documented by NCC Group. The trojan falls back to algorithmically generated domains sharing a hardcoded token making that constant a high confidence indicator of infection.

Suspicious DNS Query To Interactsh OAST Domain

This rule detects DNS lookups to *.oast.fun, an out-of-band application security testing domain used by the actors exploiting CVE-2026-1731 to confirm blind command injection. A callback to an OAST domain from a server indicates the host executed attacker-controlled code during exploitation. Production systems have no legitimate reason to resolve these interaction domains.

Possible Out-of-Band OAST Callback Domain Resolution via DNS

This rule detects DNS resolution of well-known out-of-band application security testing and interaction callback domains such as oast.fun, oast.pro, interact.sh, and burpcollaborator.net. These domains are used by exploitation tooling, including scanners for the BeyondTrust CVE-2026-1731 remote code execution flaw, to confirm blind vulnerabilities through out-of-band interaction. Resolution of these domains from server or internal hosts frequently signals active exploitation or reconnaissance against internet-facing services.

Suspicious DNS Query to Interactsh OAST Callback Domains

This rule detects DNS resolutions for Interactsh out-of-band application security testing domains such as oast.pro, oast.site, oast.me, oast.online, oast.fun and oast.live. These domains receive automated Nuclei and Interactsh scanning callbacks used to confirm blind vulnerabilities, so queries from production hosts indicate the host is being probed or has been compromised in a mass-exploitation campaign.

Suspicious DNS Exfiltration to azurestaticprovider Backdoor Domain

This rule detects DNS queries carrying the structured bt.node.js label suffix to the azurestaticprovider backdoor domain used by the trojanized node-ipc package. The backdoor encodes stolen developer credentials into subdomains resolved through the actor name server for covert exfiltration. DNS lookups matching this domain or the encoded node.js suffix indicate active credential theft over DNS.

Suspicious Credential Exfiltration to webhook.site (via dns_query)

This rule detects DNS resolution of webhook.site, the request-catcher service abused by the Shai-Hulud npm worm to exfiltrate stolen .npmrc, cloud and SSH tokens. Enterprise hosts rarely need this testing service, so a lookup from a build or developer machine is a strong exfiltration signal.

Suspicious Outbound Connection to InvisibleFerret C2 Ports 1224 and 1245

This rule detects outbound TCP connections to the uncommon ports 1224 and 1245 used by the InvisibleFerret and BeaverTail command and control servers in the North Korean job-hunter campaigns per Unit 42. These fixed high ports carry the actor heartbeat and tasking traffic which is rare for legitimate applications and flags an infected host.

Malicious Mini Shai-Hulud TanStack C2 git-tanstack and getsession (via dns_query)

This rule detects DNS lookups for the git-tanstack.com payload host and getsession.org session channels used by the Mini Shai-Hulud TanStack npm compromise to fetch its Bun payload and exfiltrate stolen tokens. A resolution indicates the preinstall dropper has executed on a developer or CI host.