Sigma detection rules, expert-reviewed

Malicious FakeBat Distribution Domain Lookup (via dns_query)

This rule detects DNS resolution of doggygangers[.]com, the FakeBat fake-browser-update landing and statistics domain that redirects victims to a malicious MSIX installer. Contact with this host indicates exposure to the drive-by distribution chain delivering Payk RunPE and LummaC2. It marks the delivery stage of the campaign.

Suspicious Tycoon PhaaS Panel Domain Lookup (via dns_query)

This rule detects DNS resolution of ailinux.ru, the TycoonGroup Phishing-as-a-Service control panel domain associated with voicemail-themed credential phishing. Contact with this host indicates interaction with the AiTM phishing backend used to steal session cookies valid for up to a year. It surfaces credential and MFA theft infrastructure.

Malicious Fenix Botnet C2 Communication via QuantumService Domain (via dns_query)

This rule detects DNS resolution of the quantumservice.lat command-and-control infrastructure used by the Fenix botnet in LATAM campaigns impersonating the Mexican Government. The NarniaRAT and Rust-based BotnetFenix payloads beacon to app.quantumservice.lat to register infected hosts. Detecting this lookup surfaces post-exploitation C2 activity aimed at LATAM banking credential theft.

Suspicious OAuth Device Code Sign-In to Authentication Broker via Tycoon 2FA

This rule detects a successful device code authentication against the Microsoft Authentication Broker application. Tycoon 2FA operators adopted OAuth device code phishing to trick users into authorizing attacker-controlled sessions and mint long-lived tokens for non-interactive Exchange and Graph access. Device code grants to the broker app are rare in normal use and indicate token theft.

Suspicious OfficeHome Sign-In With Axios User Agent via Tycoon 2FA Proxy

This rule detects a successful Entra sign-in to the OfficeHome application originating from an axios HTTP client user agent. This pattern is characteristic of the Tycoon 2FA adversary-in-the-middle platform replaying stolen session tokens through automated proxy infrastructure rather than a real browser. A scripted axios agent authenticating interactively indicates session hijacking following a phishing capture.

Possible Token Manipulation via NewCredentials Logon Type 9

This rule detects Windows Security event 4624 with logon type 9 NewCredentials, the telemetry produced by access token manipulation methods such as runas netonly and MakeToken described by Elastic. This logon type creates a process whose network identity differs from the local user which adversaries leverage for pass-the-hash style lateral movement. Reviewing the account process and target of these logons helps separate benign administrative use from abuse.

Possible Local Group Membership Enumeration via Security Event 4798

This rule detects Windows Security event 4798 recording enumeration of a user local group membership, generated by the net user Beacon Object File used during Cobalt Strike post-exploitation reconnaissance. Attackers enumerate account and group membership to plan privilege escalation and lateral movement. A high volume or unusual source of these events can indicate automated discovery activity.

Malicious wp2shell WordPress Exploitation via Batch Endpoint User Agent

This rule detects POST requests to the wp-json batch endpoint carrying a wp2shell or CVE-2026-63030 user agent which is the exploitation traffic of the pre-auth WordPress RCE. The bespoke user-agent strings identify the attacker tooling driving the plugin drop. Seeing this endpoint and marker together confirms active exploitation attempts.

Suspicious ffuf Fuzzing Requests Against Web Server

This rule detects web requests carrying the ffuf fuzzer user agent or its FUZZ placeholder marker as covered in Elastic research on detecting web server probing in Traefik. These requests represent active directory and parameter brute forcing used to enumerate hidden endpoints before exploitation.

Suspicious WordPress Path Probing Against Non WordPress Web Server

This rule detects requests to common WordPress administrative and plugin paths that indicate automated content discovery and probing as described in Elastic research on detecting web server fuzzing in Traefik. A burst of such requests against a server that does not host WordPress signals reconnaissance for exploitable endpoints.

Suspicious TOLLBOOTH Webshell URI Access

This rule detects HTTP requests to the /mywebdll endpoint exposed by the TOLLBOOTH IIS webshell. The operator authenticates to this path to issue commands through the malicious native module, making requests to this fixed URI a reliable compromise indicator.

Suspicious Kerberoasting via RC4 Service Ticket Request for MSSQLSvc SPN (via security)

This rule detects Kerberos service ticket (TGS) requests using weak RC4 encryption for MSSQLSvc service principal names, a strong indicator of Kerberoasting activity used to extract crackable service account credential material. Observed in Elastic Security Labs GOAD live malware lab telemetry where adversaries request RC4 tickets to perform offline password cracking of privileged service accounts.

Malicious TELEPUZ Service Persistence via CipherAllocator Registry Key

This rule detects creation of the CipherAllocator service registry key which TELEPUZ registers for privileged persistence after loading its DLL payload. Naming a malicious service to resemble a legitimate cryptographic component helps it hide among system services. This fixed service name is a high-confidence indicator of the MaaS foothold.

Suspicious SCMBanker Autostart Persistence via Run Key VBScript

This rule detects a Run or RunOnce autostart entry pointing at a run.vbs script which SCMBanker establishes for persistence after initial compromise. The banking-fraud toolkit relaunches its VBScript loader at logon to survive reboots. A user-hive autostart referencing a loose VBScript is a reliable persistence signal.

Malicious Run Key Persistence Pointing to Renamed PowerShell via Axios Compromise

This rule detects a CurrentVersion Run key value whose data references the renamed wt.exe interpreter or a script staged in ProgramData or TEMP as used by the Axios supply chain RAT for persistence. Attackers register the masqueraded PowerShell to re establish the implant at logon, ensuring durable access to the compromised host.