Sigma detection rules, expert-reviewed

Malicious PubLoad C2 Beacon Spoofing Microsoft Host (via proxy)

This rule detects PubLoad C2 traffic that spoofs the Host header as www.asia.microsoft.com while requesting the URI path v6-winsp1-wuredir, a pattern used by Stately Taurus to disguise beacons as Windows Update traffic. The mismatch between a Microsoft-looking Host and the non-Microsoft destination reveals the covert command-and-control channel.

Suspicious OWA Proxy User-Agent Indicating Mailbox Access

This rule detects the anomalous Outlook Web Access proxy User-Agent Client=OWA;Action=ViaProxy tied to attacker mailbox access. This behavior matches a phishing campaign against European organizations where compromised accounts were used to reach mailboxes through OWA proxying. This distinctive User-Agent signals post-compromise mailbox interaction and potential email collection.

Malicious BeaverTail C2 Download Path Request (via proxy)

This rule detects web requests to the /pdown and /client download paths used by the BeaverTail and InvisibleFerret malware in the DPRK Contagious Interview campaign, typically served over port 1224. These fixed retrieval paths indicate a lured victim fetching second-stage payloads from actor infrastructure.

Malicious Splinter Post-Exploitation Implant C2 URI Pattern (via proxy)

This rule detects web requests to the fixed HTTP command-and-control endpoints used by the Splinter post-exploitation red-team implant, including its heartbeat, task-event, and file-transfer paths. These structured URI patterns are unique to the tool and indicate an active implant beaconing to its controller.

Suspicious Cobalt Strike Download Profile POST to pkg Path

This rule detects HTTP traffic matching a public Cobalt Strike Malleable C2 profile that fetches staged content over download URIs and returns tasking through POST requests to pkg paths. The pairing of these request shapes reflects beacon staging and result submission channels. Detecting this profile behavior exposes Cobalt Strike command and control masquerading as ordinary web downloads.

Suspicious Cobalt Strike OCSP Malleable C2 Profile Traffic

This rule detects HTTP traffic matching the public Cobalt Strike OCSP Malleable C2 profile where beacon check-ins and tasking ride on ocsp URIs while spoofing the Microsoft-CryptoAPI user agent. Attackers reuse this profile to disguise command and control as legitimate certificate validation traffic. Detecting the combination of the crafted ocsp path and the CryptoAPI agent exposes beaconing that mimics benign OCSP requests.

Suspicious FalseFont Backdoor C2 Command Endpoint Requests (via proxy)

This rule detects HTTP requests to the Core Command Init endpoint structure that the FalseFont backdoor uses to retrieve operator commands from its server. This distinctive URI layout maps to the backdoor tasking channel, so matching traffic indicates an active FalseFont command and control session.

Suspicious Payload Download from Transfer.sh After ScreenConnect Exploitation (via proxy)

This rule detects outbound HTTP requests to the transfer.sh file sharing service, an abused staging host from which ScreenConnect exploitation actors retrieve malicious installers and second stage tooling. Enterprise endpoints rarely fetch payloads from transfer.sh, so traffic to this service following suspected exploitation is a useful ingress tool transfer indicator.

Suspicious Mispadu Infostealer C2 Beacon URL Pattern (via proxy)

This rule detects HTTP requests to a Mispadu command and control endpoint that combines the it.php resource with the campaign specific f=2 and w= query parameters. Mispadu uses this structured beacon to exfiltrate stolen data and receive tasking, so matching traffic indicates an active infostealer infection.

Suspicious Spoofed Microsoft Host Header C2 by Stately Taurus

This rule detects outbound HTTP requests carrying a spoofed Host header of wcpstatic.microsoft.com toward destinations that are not Microsoft infrastructure, matching the command and control masquerading used by Stately Taurus per Unit 42. The actor forges a trusted Microsoft hostname to blend beacons with legitimate traffic which conceals its espionage channel.

Malicious Kazuar Backdoor C2 via Hardcoded HTTP Cookie by Pensive Ursa

This rule detects outbound HTTP traffic carrying the hardcoded Cookie value used by the upgraded Kazuar .NET backdoor attributed to Pensive Ursa (Turla). The backdoor beacons with a static cookie GUID that identifies its command and control channel which makes it a high fidelity indicator of an active Turla implant.

Malicious TCC AppleEvents Reset via Tccutil

This rule detects the tccutil command resetting the AppleEvents privacy permissions, which clears prior automation consent so the malware can re-prompt or re-establish control of other applications. XCSSET v4.0 resets AppleEvents to enable its AppleScript-driven automation. Detecting this reset surfaces manipulation of the macOS privacy framework for defense evasion.

Malicious AI CLI Anti-Attribution and Permission Bypass Flags

This rule detects invocation of an AI coding CLI with flags that suppress attribution headers or bypass the human approval gate such as the skip-permissions switch or the yolo approval mode. The Chinese-speaking actor sets these options to let an AI model run offensive actions autonomously and anonymously. Detecting these flags reveals adversarial abuse of agentic tooling to remove human oversight.

Suspicious Python HTTP Server Staging for Payload Delivery

This rule detects launch of the built-in Python HTTP server module used to host files for delivery over the network. In the Chinese-speaking autonomous AI attack campaign the actor runs python3 http.server on port 8888 from a worker home directory to stage tooling onto victims. Detecting this ad-hoc server exposes an ingress transfer channel operated from a compromised host.

Suspicious Shell Profile Persistence Injection with Downloader

This rule detects a command that appends content to a user shell profile such as bashrc profile or zshrc while also invoking a downloader like curl or wget. TuxBot v3 injects its loader into these startup files so the bot re-launches on every interactive login. Detecting the profile append with a fetch command reveals shell initialization persistence used by the botnet.