Sigma detection rules, expert-reviewed

Possible Yellowfin BI JWT Forgery via refresh-tokens Endpoint

This rule detects HTTP requests to the Yellowfin BI /api/refresh-tokens endpoint associated with forged JWT abuse. Assetnote used hardcoded signing keys to mint tokens against this API before triggering JNDI-injection remote code execution, so anomalous access here can indicate exploitation.

Suspicious Run Key Persistence Masquerading as Edge Updater

This rule detects a Run key named EdgeUpdater whose value points into the user AppData directory. The Blitz malware creates this entry to masquerade as a legitimate Microsoft Edge updater while referencing a payload in a user-writable location. The mismatch between a trusted name and an untrusted path indicates masquerading persistence.

Malicious Storm-0558 Forged Token Sign-In from MSA Consumer Tenant (via azure signinlogs)

This rule detects Entra ID sign-ins whose home tenant is the Microsoft consumer MSA tenant 9188040d-6c67-4c5b-b112-36a304b66dad, the issuer Storm-0558 impersonated with a stolen MSA signing key to forge OpenID v2.0 tokens against Exchange Online and other organizational resources. Tokens minted for enterprise access from this consumer issuer indicate forged-credential authentication and should be treated as identity compromise.

Suspicious PowerShell Locating and Running MSBuild Project (via process_creation)

This rule detects a PowerShell one-liner that recursively searches for msbuild.exe and downloads a project file into ProgramData for execution. This ClickFix style command was observed in the PHALT#BLYX campaign.

Malicious COM Object Hijack Pointing to IconCache DLL

This rule detects a COM object InProcServer32 registration whose default value references an iconcache prefixed DLL in the Explorer directory. Operation ForumTroll established persistence via a COM hijack under HKCR CLSID InProcServer32 pointing at its payload DLL as documented by Kaspersky. This combination of a COM handler mapped to a masquerading DLL path indicates stealthy persistence and defense evasion.

TAG-144 Dynamic DNS C2 Resolution via Structured DuckDNS Subdomain (via dns_query)

This rule detects DNS resolution of TAG-144 command-and-control hosts using the campaign envio dynamic-DNS naming scheme on duckdns.org, matching the structured envio prefix with a short numeric suffix. Adversaries leverage dynamic DNS to rotate resilient C2 endpoints, making the specific subdomain pattern a useful command-and-control indicator.

Malicious Bad Apples Data Exfiltration via snmptrap OID

This rule detects snmptrap sending data to the attacker-specific enterprise OID 1.3.6.1.4.1.99999, matching the Bad Apples abuse of native macOS SNMP tooling to smuggle collected data out over an alternate protocol. Encoding stolen information inside SNMP trap fields evades controls focused on HTTP and DNS exfiltration. Use of this fabricated OID with snmptrap indicates covert exfiltration.

Suspicious WScript Executing VBScript from Masqueraded File Extension

This rule detects wscript.exe running a VBScript engine against files with non-script extensions such as drv, regtrans-ms or ntuser.dat, an execution and masquerading technique used by Shuckworm to hide its GammaSteel loader.

Obfuscated ELF Magic-Byte Restoration via dd conv notrunc in Sindoor Dropper Chain (via process_creation)

This rule detects use of dd with conv=notrunc to overwrite the first bytes of a file, the ELF magic-byte restoration trick used by the Sindoor Dropper to reassemble a runnable Linux payload from a header-stripped file. Adversaries leverage this to defeat static detection of the staged binary, making detection useful for catching the deobfuscation step of the infection chain.

Suspicious systemd User Service Persistence miasma-monitor (via file_event)

This rule detects creation of a miasma-monitor systemd user service unit used by the M-Red-Team AsyncAPI compromise for persistence. Writing a user-level systemd service lets an attacker relaunch a monitoring implant on login without root. The specific unit name combined with the user systemd path is a strong persistence signal.

Masquerading Firewall Allow Rule Masquerading as Windows Defender Update Service via Netsh (via process_creation)

This rule detects netsh adding an advfirewall rule named to impersonate a Windows Defender update service, a defense-evasion step in the Salat Stealer chain that whitelists its own network traffic. Adversaries leverage a benign-looking firewall rule name to allow C2 and exfiltration traffic while blending into legitimate configuration, so this behavior warrants review alongside surrounding activity.

Web Server Worker Process Spawning Command Interpreter

This rule detects the IIS worker process w3wp.exe spawning command shells or administrative utilities, behavior consistent with the China Chopper web shell used in Operation Soft Cell against telecommunications providers. A web server worker launching cmd, wmic or PowerShell strongly indicates web shell command execution.

Malicious Akira Ransomware Encryption Execution (via process_creation)

This rule detects the Akira ransomware encryptor invoked with its characteristic path and share targeting switches. These combined command-line flags drive selective encryption across local and network locations. Detection here indicates active encryption and imminent impact on the environment.

Malicious PowerShell AMSI Bypass via AmsiInitFailed Command Line

This rule detects the amsiInitFailed AMSI-bypass string in a PowerShell command line, a defense-evasion technique used after Citrix Bleed exploitation to disable script scanning before running the LockBit toolkit. Setting amsiInitFailed forces AMSI to skip inspection. Detecting the string exposes an active attempt to blind endpoint script scanning.

Malicious Tunneling Tool Execution on Linux Host (via process_creation)

This rule detects execution of known network tunneling and proxy utilities used to pivot and exfiltrate from compromised Linux and container hosts. Observed in the Elastic Security Labs TeamPCP scenario where gost, frps, chisel, and socat establish covert channels for command and control and lateral movement.