Sigma detection rules, expert-reviewed

Malicious Fseventsd Masquerade in Users Shared Directory via File Event

This rule detects creation of a hidden fseventsd named file inside the Users Shared directory which the macOS pirate ship campaign drops to masquerade its payload as a legitimate filesystem events daemon artifact. The genuine fseventsd store does not live in Users Shared so this file placement is a defense evasion masquerade.

Suspicious EAGERBEE Configuration File Created in Public User Directory via File Event

This rule detects creation of an iconcache.mui file in the public user directory which the REF5961 EAGERBEE backdoor uses as its configuration store. The masqueraded cache filename in a world-writable directory is a defense evasion technique to hide malware configuration in plain sight.

Malicious ABYSSWORKER EDR-Killer Driver Load via smuol.sys

This rule detects the load of the smuol.sys kernel driver associated with the ABYSSWORKER EDR-killer. The driver masquerades as a legitimate CrowdStrike component and exposes IOCTL handlers used to terminate or blind endpoint security products. Loading this driver indicates an attacker attempting to disable defenses to enable further intrusion activity.

Suspicious DNS Query for Tor Onion Domain

This rule detects DNS queries for .onion top-level domains, which correspond to Tor hidden services. Malware uses .onion command-and-control and exfiltration endpoints to anonymize traffic, and standard DNS resolution of .onion names is unusual on enterprise networks, indicating a Tor proxy or DNS-tunneling C2 channel.

Possible DNS Tunneling via Excessively Long Query Name

This rule detects DNS queries with abnormally long names exceeding one hundred characters, a covert exfiltration signal described by Elastic for detecting DNS tunneling. Attackers encode stolen data into the subdomain labels of DNS requests to smuggle it past network controls over an allowed protocol. Sustained long query names to a single domain are a strong indicator of tunneling and merit investigation.

Malicious C2 Domain Beacon To Akamaitechnologies Masquerade via DPRK Python Intrusion

This rule detects DNS resolution of the akamaitechnologies.online domain which is a masquerade command and control host used by DPRK actors in their Python-based intrusions against secured networks. The domain mimics a legitimate content delivery provider to blend beaconing traffic and evade network monitoring.

Suspicious Data Exfiltration Channel to Telegram or Discord via dns_query

This rule detects DNS queries to Telegram and Discord API endpoints from processes that are not standard messaging or browser clients, a command-and-control and exfiltration pattern used by STEALC and other information stealers. Attackers abuse these popular platforms to blend malicious traffic with legitimate service usage. Resolution of these domains by unexpected processes warrants investigation.

Suspicious Legacy AAD Graph Enumeration With Scripting User Agent

This rule detects enumeration of users groups and service principals through the legacy Azure AD Graph API versions 1.5 and 1.6 from scripting user agents such as python aiohttp curl and Go-http-client as described in Elastic research on AAD Graph activity logs. Programmatic access to the deprecated Graph endpoint frequently reflects tenant reconnaissance rather than sanctioned application traffic.

Suspicious OAuth Sign-In Using Visual Studio Code Client and Auth Broker

This rule detects Entra ID non-interactive sign-ins where the Visual Studio Code first-party application requests a token through the Microsoft Authentication Broker resource, the exact combination abused in an OAuth phishing campaign. Attackers lure victims into authorizing this trusted client to mint refresh tokens and register rogue devices for persistent access to Microsoft Graph.

Suspicious IAM Persistence and Privilege Escalation Actions

This rule detects AWS IAM API calls commonly chained for persistence and privilege escalation, such as creating access keys, attaching policies, updating assume-role trust policies, or passing a role. Elastic highlights these actions as high-value signals when performed by unexpected principals during account compromise.

Suspicious AWS Virtual MFA Device Creation

This rule detects the CreateVirtualMFADevice API call in AWS CloudTrail, used by the DPRK cryptocurrency-heist actors to register attacker-controlled MFA devices for persistent access to compromised identities. Unexpected MFA device creation may indicate account takeover and persistence via multi-factor manipulation and should be correlated with the acting principal.

Suspicious S3 Lifecycle Policy Set for Rapid Object Deletion

This rule detects an S3 PutBucketLifecycle call that configures a short object expiration, a destructive and coercive step in the AWS S3 SSE-C ransom scenario emulated by Elastic. Attackers set an aggressive deletion timer to pressure victims and permanently remove data if the ransom is unpaid. Lifecycle changes outside of approved data management workflows should be reviewed.

Suspicious AWS STS AssumeRoot Privilege Escalation To Member Account Root

This rule detects a CloudTrail STS AssumeRoot API call which grants short lived root credentials for a member account and is a powerful privilege escalation path in AWS organizations. Adversaries with a compromised IAM principal invoke AssumeRoot to obtain root level access over a member account and expand control.

Suspicious EC2 Snapshot Attribute Modification for External Sharing via CloudTrail

This rule detects the ModifySnapshotAttribute CloudTrail event which attackers use to share an EBS snapshot with an external AWS account for data exfiltration as highlighted in this Elastic analysis. Sharing snapshots outside the organization is a low volume administrative action that when unexpected indicates exfiltration of volume data.

Possible SAP NetWeaver CVE-2025-31324 Webshell Upload via metadatauploader Endpoint (via webserver)

This rule detects POST requests to the SAP NetWeaver metadatauploader endpoint abused in CVE-2025-31324 for unauthenticated webshell upload. China-nexus actors dropped JSP webshells through this development server path. Requests to this endpoint from untrusted sources warrant investigation.