Sigma detection rules, expert-reviewed

Suspicious AWS Secrets Manager Secret Value Retrieval (via cloudtrail)

This rule detects retrieval of stored secret values from AWS Secrets Manager, a credential access action Muddled Libra performs to harvest embedded keys and passwords for deeper compromise. Because applications legitimately call this API, the event is best correlated with unusual principals or volumes rather than treated as malicious on its own.

Possible Pass-the-Hash NTLM Network Logon (via security)

This rule detects network logons using the NTLM authentication package in Event ID 4624 with logon type 3, the pattern left behind by pass-the-hash lateral movement. Attackers reuse stolen NTLM hashes to authenticate to remote hosts without knowing the plaintext password. Hash reuse enables lateral movement and access to additional systems while blending with normal NTLM traffic.

Possible FluBot C2 Polling via Known Malware URI Paths

This rule detects HTTP requests to the short polling endpoints used by the FluBot Android banking malware to reach its command-and-control server. Repeated beaconing to these fixed URI paths indicates an infected device polling for tasks and reporting stolen data.

Possible Driver Enumeration via Driverquery for Rootkit Discovery

This rule detects execution of the driverquery utility used to enumerate installed kernel drivers. NCC Group observed this discovery step around deployment of the malicious netfilter driver. While the tool is legitimate its use in interactive attacker sessions can indicate reconnaissance for driver based persistence.

Suspicious Firefox Enterprise Root Certificate Trust Enabled

This rule detects the Firefox preference security.enterprise_roots.enabled being set to true, forcing Firefox to trust certificates from the Windows root store. Microsoft observed Secret Blizzard enabling this so their rogue root certificate would be trusted by Firefox for AiTM interception. Because Firefox normally maintains its own trust store, this change extends the attacker root into the browser and enables traffic decryption.

Suspicious Peach Sandstorm Remote Access via AnyDesk Tooling (via process_creation)

This rule detects execution of the AnyDesk remote access utility. Peach Sandstorm deployed AnyDesk alongside custom tunneling to maintain hands-on-keyboard access to compromised high-value targets.

Suspicious Bulk Mail and File Collection via MSGraph Application Access (via m365)

This rule detects application-context access to mailbox items through the Microsoft Graph API by a non-owner identity, the exfiltration behavior Silk Typhoon uses after adding credentials to compromised service principals to steal email and files from targeted tenants. Adversaries prefer app-based MSGraph access to harvest data at scale while evading per-user controls, so bulk MailItemsAccessed events under an application identity indicate cloud data theft.

Suspicious Anonymous Sharing Link Creation in SharePoint or OneDrive via M365 Audit

This rule detects creation of anonymous or secure sharing links in SharePoint and OneDrive, an abuse pattern in which attackers host phishing lures on trusted file services and share them broadly to steal identities. Adversary-in-the-middle campaigns use restricted-access links to evade automated scanning while harvesting session cookies from victims.

Suspicious UNC1549 Azure C2 Beacon to News Notifications URI Pattern (via proxy)

This rule detects HTTP requests to Azure-hosted command-and-control paths matching a /news/notifications/ prefix followed by a numeric identifier. UNC1549 tunneled MINIBIKE traffic through Azure cloud infrastructure using this structured URI scheme to blend with legitimate cloud services. The consistent notifications URI layout is a usable network fingerprint for the campaign.

Suspicious Exchange Deletion of MFA Notification Emails

This rule detects Exchange SoftDelete and HardDelete operations that ShinyHunters actors use to remove multi factor authentication change notifications from a victim mailbox. Attackers purge these alerts to hide account takeover and MFA tampering from the legitimate user.

Suspicious Network Packet Capture via netsh trace

This rule detects netsh starting a trace capture session, used by The Gentlemen operators to sniff network traffic during the intrusion. Ad-hoc packet capture on servers is uncommon outside of active troubleshooting. This can reveal credential or reconnaissance activity and warrants review.

Suspicious ping Loopback Delay Chained With Payload Execution

This rule detects ping.exe issuing a high count of echo requests to localhost which malware uses as a sleep timer to evade sandbox analysis. Lumma Stealer distribution chains use a ping delay to loopback before launching subsequent stages. The large repeat count against localhost is uncommon in legitimate automation.

Suspicious W32TIME Named Pipe Activity Linked to RPC Privilege Escalation (via pipe_created)

This rule detects creation of the W32TIME named pipe, an observable associated with the PhantomRPC Windows RPC privilege escalation technique that coerces service actions to run at high privilege. The pipe activity accompanies impersonation of a privileged token through the Terminal Services RPC interface. Detecting this pipe alongside unexpected service triggers can surface RPC based escalation attempts.

Suspicious UUID Named Pipe Created Consistent with Mythic SMB Agent

This rule detects the creation of named pipes whose name is a bare UUID which matches the SMB peer to peer profile used by Mythic agents as described by Kaspersky. Mythic uses UUID formatted named pipes to relay tasking between implants over SMB. This pattern can indicate command and control tunneling although some legitimate software also uses GUID named pipes.

Possible Victim Geolocation Lookup via ip-api.com

This rule detects DNS queries to ip-api.com which returns geolocation for the host public IP. The Grandoreiro banking trojan queried this service to geolocate victims and select targets, though the service is also used by some legitimate software so context is required.