Sigma detection rules, expert-reviewed

Malicious JADEPUFFER Python Beacon via Cron

This rule detects inline Python one-liners using urllib to contact a beacon endpoint, the scheduled command-and-control mechanism of the JADEPUFFER agentic ransomware for automated database extortion. The actor installs a cron entry that periodically calls back to its beacon path. This pattern indicates scheduled ransomware C2 activity.

Suspicious Interlock Backdoor C2 Beacon to init1234 Endpoint (via proxy)

This rule detects HTTP POST requests to the init1234 endpoint used by the Interlock PowerShell backdoor for command and control. The Interlock ransomware operators register their compromised hosts by beaconing to this fixed URI. The specific init1234 path combined with the POST method reveals active backdoor communication.

Suspicious HATVIBE C2 Beacon via HTTP PUT to PHP Endpoints (via proxy)

This rule detects HTTP PUT requests to the setup.php local.php and upset.php endpoints used by the HATVIBE backdoor for command and control. The Double-Tap campaign associated with APT28 relies on these specific PHP URIs combined with the uncommon PUT method to exfiltrate data and receive commands. The unusual method plus fixed endpoint set distinguishes this beacon from normal web traffic.

Malicious AddInProcess32 Network Beacon on PureRAT C2 Ports

This rule detects the .NET AddInProcess32.exe host process establishing outbound connections to TCP ports 56001 through 56003. Attackers reflectively load the PureRAT payload into AddInProcess32.exe to blend malicious traffic with a signed Microsoft binary. Outbound traffic from this process to the fixed high port range is a strong indicator of PureRAT command and control.

Possible Lampion C2 Beacon With dados Parameter

This rule detects outbound HTTP GET requests carrying a dados URL parameter used by the Lampion malware for command-and-control tasking and data transfer. The malware appends stolen or beacon data to this parameter when contacting its infrastructure. Monitoring this structured request pattern helps surface active Lampion C2 traffic.

Malicious PubLoad C2 Beacon Spoofing Microsoft Host (via proxy)

This rule detects PubLoad C2 traffic that spoofs the Host header as www.asia.microsoft.com while requesting the URI path v6-winsp1-wuredir, a pattern used by Stately Taurus to disguise beacons as Windows Update traffic. The mismatch between a Microsoft-looking Host and the non-Microsoft destination reveals the covert command-and-control channel.

Suspicious Mispadu Infostealer C2 Beacon URL Pattern (via proxy)

This rule detects HTTP requests to a Mispadu command and control endpoint that combines the it.php resource with the campaign specific f=2 and w= query parameters. Mispadu uses this structured beacon to exfiltrate stolen data and receive tasking, so matching traffic indicates an active infostealer infection.

Malicious Axios Supply Chain C2 Beacon Domain (via dns_query)

This rule detects DNS lookups for sfrclak.com, the command and control domain contacted with a POST beacon roughly every 60 seconds by the payload deployed in the Axios supply chain attack. Resolution of this hardcoded C2 domain indicates an active beaconing implant on the host.

Possible Spectre Ops C2 Beacon via nico and yfat Query Parameters via proxy

This rule detects Spectre Ops stealer command and control traffic that posts to a PHP endpoint carrying the distinctive nico and yfat query parameters. These custom parameter names carry stolen data and bot identifiers to the panel. The parameter pairing uniquely fingerprints the exfiltration channel independent of the C2 host or the nonstandard port.

Possible ZharkBot C2 Beacon via socket Endpoint with Bot Parameters via proxy

This rule detects ZharkBot command and control beacons that request a /socket/ endpoint with the structured query parameters id, bld, os, mn and us reporting bot, build and host details. This fixed parameter layout encodes victim registration data to the panel. Matching the endpoint and its parameter set fingerprints the bot check-in regardless of the C2 domain in use.

Possible Cobalt Strike Beacon URI Pattern via Web C2

This rule detects outbound HTTP requests to Cobalt Strike malleable profile URIs observed in Blister post-exploitation traffic, including the /safebrowsing/ and /rest/2/meetings beacon paths often paired with Fastly domain fronting. These structured C2 URIs indicate beaconing to an attacker-controlled team server masquerading as benign web services.

Possible Proxyware SDK Beacon With Telemetry Parameters

This rule detects HTTP requests carrying the proxyware SDK telemetry parameter string with n set to tlaunch alongside tag and key parameters used by PacketSDK and related residential proxy clients. This pattern indicates a device is reporting in as a monetized proxy node.

Suspicious UNC1549 Azure C2 Beacon to News Notifications URI Pattern (via proxy)

This rule detects HTTP requests to Azure-hosted command-and-control paths matching a /news/notifications/ prefix followed by a numeric identifier. UNC1549 tunneled MINIBIKE traffic through Azure cloud infrastructure using this structured URI scheme to blend with legitimate cloud services. The consistent notifications URI layout is a usable network fingerprint for the campaign.

Possible Residential Proxyware Beacon to PacketSDK Infrastructure

This rule detects DNS lookups for proxyware SDK command infrastructure such as packetsdk and hexsdk and castarsdk domains used by residential proxy networks. Such beacons indicate a host has been enrolled as a proxy exit node without authorization.

Malicious AdaptixC2 Beacon via X-Beacon-Id Header and Default User Agent (via proxy)

This rule detects HTTP traffic carrying the AdaptixC2 specific X-Beacon-Id header or the framework default Firefox 20.0 user agent string. AdaptixC2 is a post-exploitation command-and-control framework used for beaconing and tunneling. Detecting either the custom header or the anachronistic user agent exposes agent check-ins to an AdaptixC2 listener.