Sigma detection rules, expert-reviewed

Suspicious BlackSuit Ransomware Note and Encrypted File Artifacts via File Event

This rule detects creation of the readme.blacksuit.txt ransom note or files renamed with the .blacksuit extension, the on-disk artifacts left by BlackSuit ransomware during encryption. Their appearance across a host or share indicates an in-progress or completed encryption event.

Possible C2 Beacon to Dynamic DNS Provider via DNS Query

This rule detects DNS resolution of dynamic-DNS domains under ddns.net, serveirc.com, and hopto.org, the fast-flux infrastructure MuddyWater used for MuddyC2Go beacons. Adversaries favor dynamic DNS to rotate C2 endpoints cheaply, so resolutions to these providers from server or non-consumer hosts merit correlation with process activity.

Suspicious Salesforce Bulk Query by External App with Python-urllib Agent

This rule detects an external Salesforce application issuing bulk record queries using a Python-urllib user agent, the data theft pattern of the Klue supply chain attack. The actor drove QueryMore bulk reads against the query API from an external application client using a scripted urllib agent rather than a browser. Bulk querying of Salesforce objects by an external app with a scripting user agent indicates automated data exfiltration.

Suspicious Salesforce OAuth Refresh Token Use by Klue Battlecards App

This rule detects Salesforce API activity authenticated through an OAuth refresh token attributed to the Klue Battlecards connected application, the abused integration in this supply chain attack. The compromised app reused refresh tokens to authenticate as an external application and pull data without interactive login. Refresh token driven access from this connected app should be scrutinized for unauthorized data access.

Malicious axios NPM Supply Chain Persistence via MicrosoftUpdate Run Key

This rule detects creation of a Run key value named MicrosoftUpdate under the Windows CurrentVersion Run path, a persistence mechanism dropped by the trojanized axios npm packages through their postinstall setup.js script. The masquerading value name mimics a legitimate Microsoft update task while pointing to attacker second-stage code that beacons to sfrclak.com. Detecting this key is important because it establishes reboot-persistent execution of supply-chain malware on developer hosts.

Malicious Registry Run Key Persistence Masquerading as MicrosoftUpdate

This rule detects creation of a HKCU Run value named MicrosoftUpdate, a masquerading persistence name planted by the compromised axios npm package RAT. The malware writes this autorun entry to relaunch a dropped script at logon while posing as a legitimate Microsoft component. A user-hive Run key using this Microsoft-lookalike name is a strong persistence indicator for this supply chain RAT.

Suspicious AWS AiTM Phishing Kit Endpoint Access via Proxy

This rule detects web requests carrying the input_24 parameter to the /api endpoints used by the AWS adversary-in-the-middle phishing kit, which relays victim credentials and MFA responses to the legitimate AWS console. The kit exposes paths such as /api/check, /api/login and /api/auth alongside MFA relay branches for email, sms and gauth. Detecting these accesses is important because they indicate users interacting with a live credential-and-session-stealing phishing site.

Malicious NPM Backdoor C2 Beacon to Injective Telemetry Endpoint via Proxy

This rule detects HTTP POST requests to the Injective testnet gRPC-web telemetry host abused as command-and-control by the trojanized @injectivelabs/sdk-ts npm package. The backdoor base64-encodes wallet mnemonics and private keys derived in PrivateKey.ts and exfiltrates them in the request payload. Detecting this outbound beacon is critical because it represents active theft of cryptocurrency credentials from developer and CI environments.

Suspicious AWS Console Phishing MFA Relay Endpoints

This rule detects requests to the MFA relay endpoints of the AWS console phishing kit that intercept second-factor codes delivered by email, SMS, or authenticator app. The kit prompts victims for their one-time codes and forwards them so the operator can complete authentication in real time. Traffic to these email, sms, and gauth relay paths on a login-lookalike host indicates active MFA interception.

Suspicious C2 Beacon with Legacy MSIE User Agent

This rule detects outbound HTTP traffic to the axios RAT command and control host over a non-standard port using a hardcoded legacy Internet Explorer user agent. The implant beacons to sfrclak.com on port 8000 with an obsolete MSIE client string that rarely appears from modern endpoints. The combination of this destination and the archaic user agent identifies the RAT check-in channel.

Suspicious 1Phish Kit Cookies and Telemetry Beacon

This rule detects the 1Phish kit fingerprint cookies validated_user_1pass and hideclick ignore alongside its base64 clid telemetry parameter. These constants are set by the phishing kit to track victim progress and evade automated crawlers. Requests carrying these kit-specific cookies or the clid telemetry marker identify pages served by the 1Phish infrastructure.

Suspicious 1Phish Kit Session API Harvesting Credentials and OTP

This rule detects requests to the 1Phish kit session API paths that collect credentials, one-time passcodes, and recovery codes from victims. The kit exposes structured api session endpoints keyed by session id to stage each stolen factor as the phishing flow progresses. Traffic to these session credential, otp, and recovery routes indicates an active 1Phish deployment harvesting authentication material.

Suspicious Infostealer C2 Heartbeat to bot heartbeat Endpoint

This rule detects outbound POST requests to a bot heartbeat command and control endpoint used by the macOS infostealer to check in with its operator. The implant beacons to a heartbeat path to receive tasking and confirm the victim is live. Regular POST traffic to this endpoint indicates an active infostealer implant maintaining C2.

Suspicious AiTM Session Cookie Exfiltration to log_cookie Endpoint

This rule detects web requests to a log_cookie collection endpoint carrying stolen session identifiers such as idx, JSESSIONID, and sid, the harvesting path used by the AiTM phishing kit. The reverse proxy captures live authenticated cookies from M365 and Okta victims and ships them to attacker infrastructure for session hijacking. Traffic to this endpoint with session token parameters indicates successful token theft.

Suspicious Data Exfiltration to Telegram or Discord Web Service

This rule detects outbound requests to the Telegram bot API or a Discord webhook endpoint which the MUT-8694 campaign uses to exfiltrate stolen host information and credentials from infected Windows machines to attacker controlled channels.