Sigma detection rules, expert-reviewed

Possible JanelaRAT C2 Beacon via Structured HTTP Query (via proxy)

This rule detects outbound HTTP requests carrying the structured beacon query parameters VS, PL and AN that JanelaRAT appends when checking in to its command-and-control server. This behavior is associated with the JanelaRAT financial trojan operating over daily-rotating dynamic DNS infrastructure in Latin America. Identifying the fixed parameter layout reveals active C2 communication independent of the rotating domain.

Suspicious CanesSpy WhatsApp Mod C2 Beacon to AllRequest Endpoint (via proxy)

This rule detects HTTP POST requests to the /api/v1/AllRequest endpoint used by the CanesSpy trojanized WhatsApp modification for command-and-control. The spyware polls this path roughly every 60 seconds to receive orders and exfiltrate device identifiers, so traffic to this structured URI indicates an infected client beaconing to its C2.

Suspicious PowerShell WebClient UploadString Network Beacon

This rule detects PowerShell using a Net.WebClient object with the UploadString method to send data to a remote server. The GoPix banking trojan used LNK-launched PowerShell to POST victim data and receive tasking via WebClient UploadString as documented by Kaspersky. The uploading variant of WebClient is uncommon in benign scripting and indicates outbound command-and-control or data exfiltration.

Suspicious Cobalt Strike DNS Beacon Default Subdomain Query Linked to Cozy Bear

This rule detects DNS queries whose labels match Cobalt Strike DNS Beacon default staging and callback prefixes such as post.1, aaa.stage, and baa.stage, a command-and-control pattern tied to Cozy Bear operations. These default beacon subdomains are distinctive constants left in unmodified Cobalt Strike profiles, so queries containing them are a strong indicator of DNS-based C2.

Suspicious AstarionRAT HTTP Beacon Cookie Values

This rule detects outbound HTTP requests carrying the distinctive cookie tokens AFUAK, BLA or HFK used by the AstarionRAT command and control beacon observed in the analyzed intrusion. These structured cookie values are protocol-specific constants of the RAT rather than incidental strings, making them reliable network indicators. Traffic bearing these cookies signals an active RAT check-in and should be investigated as a compromise.

Suspicious HTTP Beacon with Java Agent User-Agent (via proxy)

This rule detects outbound HTTP requests carrying the anomalous Java/Agent User-Agent string associated with the Group-IB XMRig covert Linux PAM abuse campaign command and control channel. The value mimics a legitimate Java runtime User-Agent but is malformed and specific to the tooling. Flagging this string helps surface miner command and control or payload retrieval traffic on the network.

Suspicious AdaptixC2 Beacon Status Request by JadeProx TriBack Loader (via proxy)

This rule detects HTTP POST requests to the AdaptixC2 status endpoint used by the JadeProx TriBack loader for command-and-control beaconing, distinguished by the X-Beacon-Id header on the api/v1/status path. The framework tags each implant with a beacon id in that header. Detecting the endpoint and beacon header exposes AdaptixC2 command-and-control traffic.

Possible Cobalt Strike Beacon via Default Malleable Profile URIs

This rule detects HTTP requests to the /dpixel and /submit.php URIs which correspond to default Cobalt Strike Malleable C2 profile paths observed in the ColunmTK APT41 intrusions. The GET and POST traffic carries encoded beacon check-ins and task results. Detecting these paths surfaces command and control that operators forgot to customize.

Possible Lazarus C2 Beacon to Uncommon Port 1224 Loader Endpoints

This rule detects HTTP requests to the loader endpoints /pdown and /client on the non-standard port 1224 which are the command and control URIs used by the Lazarus Contagious Interview Python backdoors. The endpoints deliver downloaders and receive collected data. Detecting them exposes active C2 communication from a compromised host.

Malicious D3f@ck Loader C2 via Java User-Agent Ready Beacon (via proxy)

This rule detects D3F@ck loader command-and-control traffic identified by the hardcoded Java/1.8.0_101 user-agent combined with an event=ready status parameter in the request URI. This loader reports staged status values such as ready, downloaded and finished to its C2. The fixed Java user-agent from a non-Java host is a strong indicator of the loader beacon.

Suspicious DotNet Utility MSBuild RegAsm RegSvcs Network Beacon Indicating Hollowing

This rule detects MSBuild.exe, RegAsm.exe or RegSvcs.exe making an external network connection, the process hollowing targets used by Blind Eagle to run Remcos and njRAT with command and control over dynamic DNS. These .NET utilities have no reason to beacon outbound, so an external connection reveals injected remote access malware.

Malicious NANOREMOTE C2 Beacon by User-Agent

This rule detects outbound HTTP traffic carrying the NanoRemote User-Agent string used by the NANOREMOTE backdoor when beaconing to its command-and-control server. The hardcoded agent value combined with the /api/client request path is a distinctive fingerprint of this implant.

Malicious C2 Domain Beacon To Akamaitechnologies Masquerade via DPRK Python Intrusion

This rule detects DNS resolution of the akamaitechnologies.online domain which is a masquerade command and control host used by DPRK actors in their Python-based intrusions against secured networks. The domain mimics a legitimate content delivery provider to blend beaconing traffic and evade network monitoring.

Malicious WmRAT C2 Beacon via excerorderslist Endpoint (via proxy)

This rule detects WmRAT command-and-control beacons to the excerorderslistoncbook PHP endpoint carrying the vrocean parameter with a Base64-encoded victim identifier. This URI and parameter pairing is unique to the Bitter APT PTCL campaign infrastructure. Traffic matching both is a high-confidence C2 indicator.

Possible C2 Beacon to Dynamic DNS Provider via DNS Query

This rule detects DNS resolution of dynamic-DNS domains under ddns.net, serveirc.com, and hopto.org, the fast-flux infrastructure MuddyWater used for MuddyC2Go beacons. Adversaries favor dynamic DNS to rotate C2 endpoints cheaply, so resolutions to these providers from server or non-consumer hosts merit correlation with process activity.