Sigma detection rules, expert-reviewed

Suspicious AWS Console AiTM Phishing Kit API Endpoints

This rule detects requests to the AWS console phishing kit API endpoints that relay login attempts using its distinctive input_24 parameter. The adversary-in-the-middle kit proxies AWS console authentication through check, login, and auth routes to capture credentials in real time. Traffic to these kit endpoints carrying the input_24 field indicates victims interacting with the AWS console phishing infrastructure.

Suspicious Firewall Rule Opening Backdoor Port 49683 via Process Creation

This rule detects a netsh advfirewall command that adds a rule for local port 49683. ToddyCat opens this specific port to expose its passive UDP backdoor (aspnet.exe) for command-and-control, so a firewall rule referencing it indicates attacker setup.

Suspicious Service Creation Masquerading as FortiGateUpdate (via process_creation)

This rule detects sc.exe creating a service named FortiGateUpdate whose binary path launches svchost with a service grouping switch. This behavior was observed in Cyber Partisans activity that masqueraded a DNSCat2 tunneling service as a Fortinet update to blend into industrial environments. Detecting the masqueraded service creation exposes the persistence stage of the intrusion.

ClickFix macOS Payload Retrieval via curl Insecure Flags Piped to Shell (via process_creation)

This rule detects the macOS ClickFix chain where curl downloads a payload with insecure combined flags and pipes it directly into a shell for execution. Adversaries leverage the kfsSL flag bundle to silently bypass TLS validation and follow redirects before running the fetched script, making the curl-piped-to-shell pattern a high-confidence execution indicator.

Obfuscated Firewall Configuration Enumerated - Command (via process_creation)

This rule detects extract current Windows firewall configuration to prepare an attack.

Suspicious AWS IAM User Creation Using Support Impersonation Name

This rule detects the creation of an AWS IAM user named aws_support which the TeamTNT Doppelganger campaign creates and grants administrative permissions to in order to establish a persistent privileged foothold disguised as a legitimate AWS support account.

Suspicious Hidden Local Account Creation Via Net User

This rule detects creation of a local account whose name ends with a dollar sign using net user with the add flag. DragonRank created a hidden admins$ local account to maintain access on compromised web servers. Appending a trailing dollar sign hides the account from casual net user enumeration making this a stealthy persistence and account-manipulation move.

Possible Citrix NetScaler Webshell Deployment under VPN Theme Directory (CVE-2023-3519) (via webserver)

This rule detects requests to PHP files located under the NetScaler VPN theme directory. This maps to post-exploitation of CVE-2023-3519 where attackers write a PHP webshell to /var/vpn/theme after the buffer overflow. Access to a PHP resource in this static theme path indicates a deployed webshell used for persistent remote command execution.

Suspicious VMware and Cortex Binaries Executing From User-Writable Paths

This rule detects processes named after legitimate VMware guest tools or the Palo Alto Cortex updater running from AppData, Temp, or other user-writable directories. Actors in the Africa financial-sector campaign renamed their PoshC2 tooling to vmtoolsd.exe, vm3dservice.exe and CortexUpdater.exe to blend in. Trusted binary names executing from non-standard paths indicate masquerading.

Suspicious IAM CreateLoginProfile For Root User via AWS AssumeRoot Abuse

This rule detects an IAM CreateLoginProfile event that establishes console access for the root user which follows abuse of STS AssumeRoot to plant durable access in a member account. Adversaries create a root login profile to convert temporary root credentials into persistent account takeover.

Possible Metabase Pre-Auth RCE via H2 JDBC Injection on Setup Validate (CVE-2023-38646) (via webserver)

This rule detects requests to the Metabase setup validate endpoint carrying an H2 JDBC connection string with a trace level directive referencing the application jar. This maps to CVE-2023-38646 where a leaked setup token allows unauthenticated H2 injection to write and execute code. An attacker uses this chain to achieve remote code execution before authentication.

Malicious Defender Real-Time Monitoring Disable via Registry

This rule detects the DisableRealtimeMonitoring registry value being enabled to turn off Microsoft Defender real-time scanning. This was observed during Cephalus ransomware deployment alongside service stops and exclusions. Disabling real-time monitoring removes on-access detection so the encryptor can run freely.

Suspicious propsys.dll Sideload via ComputerDefaults UAC Bypass (via image_load)

This rule detects ComputerDefaults.exe loading propsys.dll from outside the Windows system directories, the DLL sideload and UAC bypass the 8220 Gang chains to elevate and continue its cryptomining deployment. The auto-elevating ComputerDefaults binary is abused to load an attacker propsys.dll placed in a writable path. Detecting this non-system load surfaces the UAC bypass and sideloading step.

Malicious Obsidian Spawning Command Interpreter via Shell Commands Plugin

This rule detects the Obsidian note taking application spawning PowerShell, cmd or a shell as abused by the PhantomPulse RAT delivery chain through the Shell Commands plugin in Elastic research. A document editor launching a command interpreter is anomalous and indicates weaponized vault content executing attacker code.

Suspicious Mshta Execution Of Remote HTA

This rule detects mshta.exe executing an HTA hosted at a remote http or https URL. In the WithSecure Initial Access Lab 2 the Koadic stager is delivered as a remote HTA run directly by mshta. Attackers use mshta to fetch and run remote HTML applications as a proxy execution and download technique.