Sigma detection rules, expert-reviewed

Suspicious Internet Scanning for Docker and Kubelet Ports via masscan

This rule detects the masscan tool being run against the Docker API and kubelet ports which threat actors use to discover exposed container orchestration services across the internet before deploying cryptomining payloads.

Suspicious Cron Reboot Persistence Pointing to Hidden User Directory on Linux

This rule detects a crontab entry using the reboot schedule to launch a binary from a hidden path under a user local bin directory which the opportunistic Log4j campaign uses to persist its componist implant across system restarts.

Malicious Encrypted Reverse Shell via Netcat and GPG on Linux

This rule detects a command pipeline that reads from a netcat listener decrypts the traffic with gpg and pipes it into a shell which the opportunistic Log4j campaign uses to run an encrypted reverse shell that evades network content inspection.

Malicious DLL Execution With Non Standard Extension via rundll32

This rule detects rundll32.exe loading a library renamed with a .db extension which the DPRK aligned Stressed Pungsan npm campaign uses to masquerade its downloaded payload package.db and execute an exported function while evading extension based detection.

Malicious Systemd Service Persistence via ExecStartPost Hidden Path on Linux

This rule detects modification of a systemd unit that adds an ExecStartPost directive pointing to a payload under /var/tmp which the chkstart tool from the exposed Docker API campaign uses to inject a malicious loader into legitimate services for persistence.

Suspicious Shell History Disabling via HISTFILE Redirection on Linux

This rule detects a command line that redirects the shell history file to /dev/null which the ar.sh script from the exposed Docker API campaign runs alongside flushing the firewall to prevent command logging and hinder incident response on compromised systems.

Suspicious File Download to Shared Memory Directory on Linux

This rule detects curl or wget writing a payload into the /dev/shm shared memory directory on Linux which the TeamTNT Doppelganger campaign uses to stage the gsocket backdoor in memory and evade disk based detection on compromised Docker hosts.

Possible AiTM Phishing Sign-On Evaluation Denied by Okta FastPass

This rule detects Okta sign-on policy evaluations that are challenged or denied where the network reputation flags a phishing or proxy origin, matching FastPass anti-phishing rejections. In this campaign an adversary-in-the-middle proxy relayed authentication and Okta FastPass declined the phishing attempt during policy evaluation. Clusters of such denials indicate active AiTM targeting of user credentials and session tokens.

Suspicious GCP Service Account Impersonation via GenerateAccessToken

This rule detects use of the IAM Credentials GenerateAccessToken method, which mints short-lived access tokens for a service account through impersonation. Adversaries granted serviceAccountTokenCreator invoke this call, often via gcloud with impersonate-service-account, to act with the target service account permissions. It is important because impersonation lets an attacker operate under a more privileged identity while obscuring their originating principal.

Malicious GCP Service Account Backdoor via serviceAccountTokenCreator Grant

This rule detects a google.iam.admin.v1.SetIAMPolicy admin activity event that grants the roles/iam.serviceAccountTokenCreator role, allowing a principal to mint access tokens for a targeted service account. Adversaries use this binding to backdoor a service account and later impersonate it through GenerateAccessToken, keeping durable privileged access. This matters because the grant converts any controlled identity into a lasting path to the service account privileges.

Suspicious Cross-Project Compute Snapshot Creation via GCP Audit

This rule detects v1.compute.snapshots.insert operations that carry CrossEntityControlAuditMetadata, indicating a snapshot created across project boundaries. Adversaries copy a disk snapshot into an attacker-controlled project to exfiltrate its contents outside the victim environment. Cross-project snapshot movement is a strong indicator of cloud data theft rather than routine backup activity.

Malicious axios NPM Supply Chain C2 Domain Resolution

This rule detects DNS resolution of sfrclak.com, the command-and-control domain contacted by the trojanized axios and plain-crypto-js npm packages after their postinstall scripts execute. The malware sends base64-encoded JSON beacons over HTTP to this host roughly every 60 seconds to fetch second-stage per-OS payloads. Detecting the lookup is important because it surfaces build and developer machines compromised through the npm supply chain.

Suspicious DNS Exfiltration to azurestaticprovider Backdoor Domain

This rule detects DNS queries carrying the structured bt.node.js label suffix to the azurestaticprovider backdoor domain used by the trojanized node-ipc package. The backdoor encodes stolen developer credentials into subdomains resolved through the actor name server for covert exfiltration. DNS lookups matching this domain or the encoded node.js suffix indicate active credential theft over DNS.

Suspicious Azure Network Security Group Rule Opening Inbound Access to the Internet

This rule detects a Microsoft.Network/networkSecurityGroups/securityRules/write operation that creates an allow inbound rule with an unrestricted source, exposing resources to the entire Internet. Adversaries modify NSG rules to open management ports or services for later remote access after gaining cloud control-plane permissions. This is important because Internet-exposed inbound rules sharply increase attack surface and often precede lateral movement or data access.

Suspicious Azure AD MFA Fatigue Repeated Push Denials

This rule detects Entra ID sign-in events with result code 500121, which records that a multifactor authentication request was denied by the user. A burst of these denials for a single userPrincipalName indicates an MFA fatigue or push-bombing attack where an adversary holding valid credentials repeatedly prompts the victim hoping for an accidental approval. This is important because sustained denials often precede a coerced approval and account takeover.