Sigma detection rules, expert-reviewed

Suspicious macOS SSH Loopback Connection for TCC Bypass

This rule detects an SSH client connecting to the local loopback address on macOS. It maps to a technique where an attacker uses ssh to localhost so the spawned session inherits full disk access granted to the SSH daemon, bypassing the TCC privacy prompt. Detecting loopback SSH can surface abuse of remote services for privacy control evasion.

Suspicious GAM OAuth Token Enumeration via Process Creation

This rule detects use of the GAM command line tool to print or delete OAuth tokens across a Google Workspace tenant, activity observed both during attacker reconnaissance of consented apps and legitimate administrative cleanup. Because token enumeration reveals which third-party apps hold access, unexpected GAM token operations outside change windows can indicate an attacker mapping or pruning OAuth grants.

Suspicious Sneaky 2FA Phishing Kit License Check via API Key Endpoint (via proxy)

This rule detects HTTP requests to the sneakylog license verification endpoint used by the Sneaky 2FA Phishing-as-a-Service platform. Each deployed phishing kit calls the api key path on the operator infrastructure to validate its license before serving the AiTM page. Observing this callback identifies hosts interacting with the Sneaky 2FA kit infrastructure.

Suspicious Python or uv Execution Spawned by AI CLI Assistant

This rule detects the python or uv interpreter launched as a child of an AI command line assistant such as the Claude or Gemini CLI which reflects adversaries directing these agents to run local code during hands on abuse. Because AI CLI tools can execute arbitrary commands on behalf of a user they can be steered into running attacker supplied scripts. Detecting unexpected interpreter children of AI assistants supports hunting for this emerging abuse.

Suspicious AWS SSO Account Role Enumeration via ListAccountRoles (via cloudtrail)

This rule detects the AWS SSO ListAccountRoles call, the reconnaissance step Red Canary noted adversaries performing after obtaining a cached SSO access token to enumerate assignable roles. A burst of ListAccountRoles from an unfamiliar source can indicate an actor mapping available roles before assuming credentials.

Suspicious PIKABOT Command and Control Connection on Non-Standard Ports via Network Connection

This rule detects outbound connections to the uncommon high ports 2967 2223 and 5938 that PIKABOT uses for its HTTPS command and control while spoofing an Outlook user agent. These ports are atypical for normal web traffic so outbound sessions to them warrant review though some remote access software may reuse similar ranges.

Suspicious Outbound Connection to InvisibleFerret C2 Ports 1224 and 1245

This rule detects outbound TCP connections to the uncommon ports 1224 and 1245 used by the InvisibleFerret and BeaverTail command and control servers in the North Korean job-hunter campaigns per Unit 42. These fixed high ports carry the actor heartbeat and tasking traffic which is rare for legitimate applications and flags an infected host.

Suspicious HTTP POST to Local AI Malware Exfil Endpoint (via proxy)

This rule detects HTTP POST requests to the /crypto-data endpoint used by AI-assisted malware to transmit collected cryptocurrency and victim data. The specific exfiltration path combined with the POST method reflects the malware sending stolen data to its collection service.

Possible Stolen AWS Credential Validation via STS GetCallerIdentity

This rule detects AWS STS GetCallerIdentity calls which the Hugging Face breach actor issued to validate stolen cloud credentials after harvesting secrets from a compromised AI agent environment. Identity self-checks are a common first move once keys are obtained. Because legitimate automation also calls this API, baseline expected principals and alert on unfamiliar or first-seen callers.

Suspicious Exposed Ollama API Service Connection

This rule detects network connections to the default Ollama LLM service port, exposure that attackers abuse to hijack local AI inference in the evolved LLMjacking campaign. An internet-reachable Ollama endpoint allows unauthenticated model access and resource theft. Connections from untrusted sources to this port warrant review of the exposed service.

Possible Andariel Keylogger Output Archive Staged in Temp (via file_event)

This rule detects creation of the password-protected keylog archive and its embedded log file staged in the Temp directory by a keylogger attributed to the North Korean group Andariel. Adversaries write captured keystrokes and clipboard data to a compressed archive on disk before exfiltration, so these named artifacts indicate active credential capture.

Possible Access-Code Validation Beacon to Malware Delivery C2 (via proxy)

This rule detects HTTP requests to an /api/submit endpoint carrying a code parameter, the access-code validation call made by a DocuSign-themed loader before it retrieves its second stage in a Vidar delivery chain analyzed by Joe Sandbox. Adversaries gate payload delivery behind server-side code validation to evade sandboxes and analysts, so this submit-with-code request pattern surfaces the loader contacting its delivery infrastructure.

Possible n8n Campaign Datto RMM Relay Contact via centrastage.net

This rule detects DNS resolution of centrastage.net infrastructure associated with Datto RMM, which the n8n webhook campaign abuses as a remote management relay to control victim hosts. Because the domain also serves legitimate Datto RMM deployments, contact from an environment that does not sanction Datto is the meaningful signal. Correlate with unexpected RMM installers to confirm abuse.

Suspicious Go HTTP Client User Agent via Proxy

This rule detects outbound web requests carrying the default Go HTTP client user agent, which Peach Sandstorm used from Azure infrastructure during password spray attacks against target tenants. The user agent is a weak but useful signal that can highlight automated credential-guessing traffic when correlated with failed authentication.

Suspicious Oversized Numeric X-Forwarded-For Header Targeting Ivanti Connect Secure (via proxy)

This rule detects the network signature of Ivanti Connect Secure CVE-2025-22457 where an extremely long X-Forwarded-For header consisting only of digits and periods is used to overflow a stack buffer in the web process. Legitimate proxy chains do not produce headers of this length.