Sigma detection rules, expert-reviewed

Malicious Phishing Data Exfiltration to SheetBest API by GitBait Campaign (via proxy)

This rule detects HTTP POST requests to the api.sheetbest.com sheets endpoint used by the GitBait phishing campaign to exfiltrate stolen banking credentials from GitHub Pages lures. The campaign abuses the SheetBest Google Sheets API as a low-cost data drop for harvested victim data. Detecting these calls surfaces active credential exfiltration.

Malicious GTFire Phishing Credential Exfiltration to All-in-1.php Backend (via proxy)

This rule detects credential-harvesting requests to the GTFire phishing backend script All-in-1.php carrying the user and pass parameters used to capture victim logins, as documented by Group-IB. Adversaries transmit stolen credentials to this fixed backend URI over HTTP, so requests matching the path and parameter structure indicate active credential theft.

Possible GoldFactory GoldPickaxe Mobile Trojan C2 API Calls

This rule detects requests to the GoldFactory API paths such as savevideo2 savesms getfrpconfig and getBPackageUrl which the GoldPickaxe and GoldDigger mobile trojans use for command and control. These endpoints exfiltrate victim facial video, SMS messages and fetch reverse proxy configuration. Detecting them exposes devices harvesting biometric and financial data for the operators.

Possible Godfather Android Banking Trojan C2 Endpoints

This rule detects HTTP requests to the fafa.php sender_new.php and mp4_recorder.php endpoints which are the command and control and data collection URIs of the Godfather Android banking trojan. These paths deliver injection targets and receive stolen credentials, SMS and screen recordings. Detecting them on the network surfaces infected devices communicating with Godfather infrastructure.

Possible Telegram Bot API Command and Control Traffic

This rule detects requests to the Telegram Bot API sendDocument and getUpdates methods which the Dark Pink APT uses to exfiltrate stolen files and receive commands through api.telegram.org. Routing C2 over a trusted messaging service blends malicious traffic with legitimate flows. It matters because it can reveal data theft hidden inside allowed cloud services.

Possible Cobalt Strike Beacon via Default Malleable Profile URIs

This rule detects HTTP requests to the /dpixel and /submit.php URIs which correspond to default Cobalt Strike Malleable C2 profile paths observed in the ColunmTK APT41 intrusions. The GET and POST traffic carries encoded beacon check-ins and task results. Detecting these paths surfaces command and control that operators forgot to customize.

Possible Lazarus C2 Beacon to Uncommon Port 1224 Loader Endpoints

This rule detects HTTP requests to the loader endpoints /pdown and /client on the non-standard port 1224 which are the command and control URIs used by the Lazarus Contagious Interview Python backdoors. The endpoints deliver downloaders and receive collected data. Detecting them exposes active C2 communication from a compromised host.

Windows: Detect Defendnot HackTool Process Execution

Alerts on Windows process executions referencing Defendnot, including its URL and known IMPHASH values.

Uncommon Child Process Spawned by XBootMgrSleep.exe (Windows Performance Toolkit)

Alerts when XBootMgrSleep.exe launches an unexpected child process on Windows, indicating potential delayed execution abuse.

Malicious Tampering of Linux Authentication Log var log secure (via process_creation)

This rule detects commands that delete, truncate, or shred the Linux authentication log at /var/log/secure. In the Group-IB XMRig covert Linux PAM abuse campaign the attacker tampers with /var/log/secure to erase evidence of unauthorized su and login activity. Clearing this log to hide tracks is a high confidence indicator of active anti-forensics.

Malicious XMRig Cryptominer Execution via Custom Command-Line Flags (via process_creation)

This rule detects a Linux process launched with the distinctive custom flag combination used by the covert XMRig cryptominer variant reported by Group-IB. The campaign runs a fileless self-unlinking miner binary to hijack host resources for cryptomining. Detecting the mining flag combination early exposes resource-hijacking activity that is otherwise hidden behind a benign or deleted process image.

Suspicious ftp.exe Script Execution via -s Flag by JadeProx TriBack Loader (via process_creation)

This rule detects the Windows ftp.exe client executing a script file through the -s flag, a living-off-the-land technique the JadeProx TriBack loader uses to run attacker-supplied commands from script.dat. Abusing ftp.exe as a script runner evades controls focused on interpreters. Detecting this invocation exposes JadeProx staging activity.

Suspicious osascript Fake Password Prompt by ClickLock macOS Stealer (via process_creation)

This rule detects osascript displaying a dialog that requests a password with a hidden answer field, the social-engineering prompt ClickLock macOS stealer uses to trick victims into surrendering their account credentials. The fake dialog mimics a legitimate system password request. Detecting this AppleScript pattern exposes active credential phishing on macOS.

Suspicious PowerShell Copy-Item Into ProgramData Logs by MuddyWater (via process_creation)

This rule detects PowerShell using Copy-Item to stage files into the C:\ProgramData\Logs directory, a technique MuddyWater uses to place malware components in a shared writable location. The unusual staging path combined with scripted copying points to malware setup rather than routine administration. Detecting it exposes early MuddyWater tooling deployment.

Suspicious Scheduled Task Creation for rclone Exfiltration by The Gentlemen RaaS (via process_creation)

This rule detects schtasks creating a task that references rclone, matching The Gentlemen ransomware operators who register a SafeSync scheduled task to run rclone.ps1 for automated data exfiltration. The task provides persistence and hands-off staging of stolen data to attacker cloud storage. Detecting it exposes exfiltration setup before bulk data leaves the network.