Sigma detection rules, expert-reviewed

Suspicious FinCounter DNS Tunneling Query via dns_query

This rule detects DNS queries whose leftmost label begins with the counter prefix used by the FinCounter DNS tunneling toolkit. Unit 42 catalogued this fixed prefix as a distinctive encoding marker of FinCounter command-and-control over DNS, so repeated queries of this shape from a host suggest a covert DNS tunnel.

Malicious DNS Query To ClickFix Infostealer C2 Domain

This rule detects DNS resolution of apposx.com, the fake Cloudflare verification and staging domain used in the ClickFix infostealer campaign. The domain fronts the social-engineering lure that leads macOS users to install the Odyssey and ACR stealers. Alerting on the hardcoded C2 domain surfaces hosts that reached the delivery infrastructure regardless of the payload used.

Suspicious Exploitation Callback to Dnslog Service (via dns_query)

This rule detects DNS lookups for the dnslog.store out of band interaction service, which attackers query to confirm successful exploitation and command injection during mass vulnerability scanning. Enterprise hosts have no legitimate reason to resolve this canary domain, so such queries indicate reconnaissance or validated exploitation of an internet facing device.

Malicious Project CAV3RN DNS Configuration Recovery via cloudlanecdn.com (via dns_query)

This rule detects DNS queries to encoded subdomains of cloudlanecdn.com, a channel used by the Project CAV3RN espionage framework to recover configuration data from DNS AAAA records. The encoded label structure and attacker-controlled domain indicate covert command-and-control and data-encoding activity that should not appear in normal traffic.

Malicious dnscat2 DNS Tunneling C2 Traffic

This rule detects DNS queries containing the dnscat marker string used by the dnscat2 tunneling tool. It maps to command-and-control and data exfiltration over DNS where an operator encodes traffic in oversized MX and TXT lookups to evade network controls. Detecting the dnscat pattern surfaces DNS-based C2 beaconing.

Malicious DNS Query To FvncBot Android Banking Trojan C2

This rule detects DNS resolution of naleymilva.it.com, the command-and-control domain of the FvncBot Android banking trojan targeting Poland. Infected devices resolve this domain to register and receive operator commands over HTTP and WebSocket. Alerting on the hardcoded C2 domain identifies devices beaconing to the trojan infrastructure.

Malicious PeerBlight Command and Control Beacon to qtss.cc Domain

This rule detects DNS resolution of the qtss.cc domain, the ZinFoq command and control infrastructure contacted by the PeerBlight Linux backdoor for beaconing. Resolution of this domain indicates an infected host reaching out to attacker-controlled C2. The domain is a known PeerBlight indicator and has no legitimate business use.

Suspicious DNS-over-HTTPS C2 via Wildcard DNS Services

This rule detects DNS resolution of sslip.io and nip.io wildcard DNS domains that encode an IP address in the hostname, matching BRICKSTORM DNS-over-HTTPS command-and-control on appliances and hypervisors. Espionage operators use these services to dynamically map beacon traffic to attacker infrastructure while blending with legitimate DNS.

Cisco Network Device 802.1X (dot1x) Disabled via port-control Force-Authorized

Alerts on Cisco configuration changes that disable 802.1X on a port (force-authorized or no dot1x port-control).

FortiGate SSL VPN Settings Edited

Flags FortiGate VPN SSL settings being edited, which may indicate changes to SSL VPN access or authentication configuration.

FortiGate User Group Modified via Edit Event

Alerts on FortiGate user group edits that can change access permissions, including VPN-related group membership.

FortiGate: Addition of VPN SSL Web Portal via Event Logs

Detects FortiGate configuration events where a VPN SSL web portal is added.

FortiGate: Local User Added via CLI Event

Alerts on FortiGate events where a new local user is added under user.local.

FortiGate: Alert on Added Firewall Policy via Event Log

Flags FortiGate events where a firewall policy is added (action Add on firewall.policy).

FortiGate Firewall Address Object Added (event action Add)

Alerts when a FortiGate firewall address object is added via configuration change events.