Sigma detection rules, expert-reviewed

Suspicious AWS STS AssumeRoot Privilege Escalation To Member Account Root

This rule detects a CloudTrail STS AssumeRoot API call which grants short lived root credentials for a member account and is a powerful privilege escalation path in AWS organizations. Adversaries with a compromised IAM principal invoke AssumeRoot to obtain root level access over a member account and expand control.

Suspicious EC2 Snapshot Attribute Modification for External Sharing via CloudTrail

This rule detects the ModifySnapshotAttribute CloudTrail event which attackers use to share an EBS snapshot with an external AWS account for data exfiltration as highlighted in this Elastic analysis. Sharing snapshots outside the organization is a low volume administrative action that when unexpected indicates exfiltration of volume data.

Possible SAP NetWeaver CVE-2025-31324 Webshell Upload via metadatauploader Endpoint (via webserver)

This rule detects POST requests to the SAP NetWeaver metadatauploader endpoint abused in CVE-2025-31324 for unauthenticated webshell upload. China-nexus actors dropped JSP webshells through this development server path. Requests to this endpoint from untrusted sources warrant investigation.

Malicious WmRAT Persistence via vcswin Run Key (via registry_set)

This rule detects a Run key value pointing to vcswin.exe, the persistence executable Bitter APT dropped in ProgramData to relaunch WmRAT at logon. The autostart entry references an attacker-staged binary rather than a legitimate application. A Run value pointing to vcswin.exe is a strong persistence indicator.

Malicious PlugX Persistence via LMIGuardian Update Run Key (via registry_set)

This rule detects creation of a Run key named LMIGuardian Update, the autostart persistence mechanism Mustang Panda used to relaunch the side-loaded PlugX loader at logon. The value name masquerades as a legitimate LogMeIn updater. A Run entry with this exact name is a strong persistence indicator.

Malicious WmRAT C2 Beacon via excerorderslist Endpoint (via proxy)

This rule detects WmRAT command-and-control beacons to the excerorderslistoncbook PHP endpoint carrying the vrocean parameter with a Base64-encoded victim identifier. This URI and parameter pairing is unique to the Bitter APT PTCL campaign infrastructure. Traffic matching both is a high-confidence C2 indicator.

Malicious DarkGate C2 Communication via Synapse User-Agent (via proxy)

This rule detects outbound HTTP traffic carrying the distinctive DarkGate command-and-control User-Agent string. DarkGate beacons identify themselves with a hardcoded Synapse user agent not used by legitimate browsers. Presence of this exact string is a high-confidence C2 indicator.

Suspicious APT29 Zulip C2 Communication via curl User-Agent (via proxy)

This rule detects requests to the Zulip chat messages API using a curl User-Agent, the abuse of a legitimate collaboration service for command-and-control in the APT29 German Embassy campaign. The actor posted to the api v1 messages endpoint via curl to blend with normal SaaS traffic. Because Zulip is legitimate, the curl agent and messages path together narrow the match.

Suspicious curl Download Spawned by Excel via IQY Attachment (via process_creation)

This rule detects Excel spawning a command shell that runs curl, the initial execution chain triggered by the malicious IQY attachment in the Bitter APT PTCL campaign. Office applications launching curl through cmd to fetch remote payloads is not legitimate document behavior. This parent-child chain indicates weaponized document execution.

Suspicious FRP Proxy Download via wget to Temporary Directory (via process_creation)

This rule detects wget fetching the FRP fast reverse proxy binary into a temporary directory after Ivanti EPMM exploitation for tunneling and SOCKS proxying. Attackers staged frpc under hidden /tmp paths to establish covert network access. Downloading frpc to /tmp is a strong lateral movement and C2 indicator.

Suspicious Ivanti EPMM Database Dump via mysqldump with .mifpp Credentials (via process_creation)

This rule detects mysqldump invoked with the hardcoded Ivanti EPMM .mifpp credentials file to dump the mifs database after exploitation. Attackers abused these embedded MySQL credentials to exfiltrate LDAP and configuration data. Use of this defaults-extra-file with mysqldump indicates credential and data theft.

Suspicious Remote Payload Staging via curl Piped to Shell (via process_creation)

This rule detects curl silently fetching a remote script and piping it directly into a shell, the staging technique used to deploy the SNOWLIGHT loader after SAP NetWeaver exploitation. Downloading and executing remote content in a single pipeline bypasses on-disk inspection. This pattern is a common Linux post-exploitation loader behavior.

Suspicious Reverse Shell via bash to dev tcp (via process_creation)

This rule detects a bash interactive reverse shell using the /dev/tcp pseudo-device, executed post-exploitation of SAP NetWeaver to reach attacker infrastructure. This construct redirects an interactive shell over a raw TCP socket. Legitimate administrators almost never spawn shells this way.

Suspicious WMI Query Against Windows Defender Namespace via wmic (via process_creation)

This rule detects wmic querying the Windows Defender WMI namespace, used by Sandworm to inspect and manipulate antivirus exclusions during the KMS campaign. Direct wmic access to the Defender namespace is uncommon in normal operations. It often precedes tampering with protection settings.

Suspicious curl Execution over TOR SOCKS5 Proxy (via process_creation)

This rule detects curl.exe routing traffic through a local SOCKS5 proxy on the default TOR port, a command-and-control technique used by Sandworm to reach onion infrastructure. Legitimate enterprise software rarely tunnels curl over 127.0.0.1:9050. This strongly suggests covert C2 over TOR.