Sigma detection rules, expert-reviewed

Malicious XCSSET Payload Drop to Temp and Hidden Home Paths

This rule detects creation of the specific staging artifacts used by XCSSET v4.0 including the tmp p.app bundle the tmp r file and the hidden tr file in the user home directory. These fixed drop paths hold the malware components and persistence loaders. Detecting these file writes provides a strong campaign-specific indicator of an XCSSET infection.

Malicious Systemd Service Masquerading as Sd-Pam Helper

This rule detects creation of a systemd unit file named sd-pam.service, a name TuxBot v3 borrows from the legitimate PAM session helper which is a binary and never ships as a service. The botnet installs this always-restart unit for resilient persistence on Linux and IoT hosts. Detecting the bogus service file exposes systemd persistence hiding behind a trusted system name.

Malicious VVS Discord Stealer Script Drop via injection-obf.js (via file_event)

This rule detects the injection-obf.js payload being written into a Discord application directory, the client-injection component of the Pyarmor-obfuscated VVS Discord stealer. The dropped script hooks the Discord client to harvest tokens and DPAPI-protected credentials for webhook exfiltration.

Suspicious Modification of PAM Authentication Module

This rule detects writes to the pam_unix.so authentication module under the security library directory. Telecom-focused intruders replace pam_unix.so with a backdoored version to harvest credentials and enable covert authentication. Modification of this PAM module outside package updates signals an authentication backdoor.

Malicious Mimikatz Credential Dump Log File Creation (via file_event)

This rule detects creation of the KB0722.log file in the Windows temp directory, the hardcoded output log that Mimikatz wrote when Jumpy Pisces dumped LSASS credentials during their Play ransomware intrusion. This fixed log path indicates credential theft from process memory.

Malicious POOLRAT Backdoor Log File Creation (via file_event)

This rule detects creation of the file /tmp/xweb_log.md, the hardcoded error-log artifact written by the POOLRAT Linux backdoor deployed by Gleaming Pisces. This fixed path is unique to the implant and indicates the backdoor is running on the host.

Malicious ManagementMailboxPicker Webshell Written by Diplomatic Specter

This rule detects the creation of the ManagementMailboxPicker.aspx webshell used by the Operation Diplomatic Specter campaign to maintain access to compromised Exchange and web servers. The webshell provides persistent remote command execution and staging for mailbox theft. Detecting its file creation exposes server-side persistence and hands-on access by the espionage actor.

Malicious Glupteba UEFI Bootkit EfiGuard Driver Drop to ESP (via file_event)

This rule detects the creation of the EfiGuardDxe.efi driver, a component the Glupteba bootkit writes to the EFI System Partition to disable driver signature enforcement and PatchGuard. Persisting below the operating system through a UEFI bootkit gives Glupteba stealthy survival across reinstalls, so any drop of this driver signals a serious firmware level compromise.

Malicious MOVEit human2 Webshell File Creation via file_event

This rule detects creation of the human2.aspx web shell dropped into the MOVEit Transfer wwwroot after exploitation of the CVE-2023-34362 SQL injection chain. This artifact gives the attacker web-accessible command and data-theft capability on the MOVEit host and its presence is a reliable sign of active exploitation.

Malicious ThrottleStop Vulnerable Driver Load for Defense Evasion

This rule detects loading of the ThrottleStop.sys driver, a signed but vulnerable component abused to disable or blind endpoint defenses from kernel space. The Gentlemen ransomware brings this driver to terminate security products before encryption. Detecting the driver load surfaces bring-your-own-vulnerable-driver activity used to impair defenses.

Malicious WinRing0 Vulnerable Driver Load for Coin Mining

This rule detects loading of the WinRing0x64.sys driver, a known vulnerable component abused to gain kernel level hardware access. The Vidar and XMRig campaign brings this driver to enable coin mining and to tamper with defenses. Detecting the driver load surfaces bring-your-own-vulnerable-driver activity tied to resource hijacking.

Malicious DNS Query to Autonomous AI Attack C2 Proxy Domain

This rule detects a DNS lookup for the code.newcli.com domain used as an attacker proxy in the Chinese-speaking autonomous AI attack campaign. The domain fronts the actor command-and-control and AI-CLI proxy infrastructure. Detecting the query provides a high-confidence indicator of a host reaching the campaign infrastructure.

Malicious Axios Supply Chain C2 Beacon Domain (via dns_query)

This rule detects DNS lookups for sfrclak.com, the command and control domain contacted with a POST beacon roughly every 60 seconds by the payload deployed in the Axios supply chain attack. Resolution of this hardcoded C2 domain indicates an active beaconing implant on the host.

Suspicious DNS C2 to Microsoft Typosquat Domain

This rule detects DNS queries for the updatemicfosoft typosquatting domain used as a DNS C2 channel. The Project AK47 toolset linked to the SharePoint attacks tunnels commands over DNS to update.updatemicfosoft using an XOR key. Any resolution of this Microsoft lookalike domain indicates DNS-based command and control.

Malicious AzureHound Cloud Reconnaissance via User Agent (via azure)

This rule detects sign-ins and Graph API activity carrying the azurehound user-agent string, indicating use of the AzureHound collector to enumerate users, groups, roles, and service principals. Threat actors run AzureHound to map Azure and Entra ID attack paths before privilege escalation. Detecting the tool user-agent exposes cloud discovery activity at its source identity.