Sigma detection rules, expert-reviewed

Suspicious __init__.py Drop in Public Directory by Slow Pisces (via file_event)

This rule detects creation of an __init__.py file inside the user Public directory, the drop location used by Slow Pisces to stage its RN Loader Python payload during fake coding-challenge lures. Planting a Python package init file in this path enables execution of the malicious loader when the developer runs the challenge code.

Malicious Mimikatz Credential Dump Log File Creation (via file_event)

This rule detects creation of the KB0722.log file in the Windows temp directory, the hardcoded output log that Mimikatz wrote when Jumpy Pisces dumped LSASS credentials during their Play ransomware intrusion. This fixed log path indicates credential theft from process memory.

Malicious POOLRAT Backdoor Log File Creation (via file_event)

This rule detects creation of the file /tmp/xweb_log.md, the hardcoded error-log artifact written by the POOLRAT Linux backdoor deployed by Gleaming Pisces. This fixed path is unique to the implant and indicates the backdoor is running on the host.

Malicious ManagementMailboxPicker Webshell Written by Diplomatic Specter

This rule detects the creation of the ManagementMailboxPicker.aspx webshell used by the Operation Diplomatic Specter campaign to maintain access to compromised Exchange and web servers. The webshell provides persistent remote command execution and staging for mailbox theft. Detecting its file creation exposes server-side persistence and hands-on access by the espionage actor.

Malicious Glupteba UEFI Bootkit EfiGuard Driver Drop to ESP (via file_event)

This rule detects the creation of the EfiGuardDxe.efi driver, a component the Glupteba bootkit writes to the EFI System Partition to disable driver signature enforcement and PatchGuard. Persisting below the operating system through a UEFI bootkit gives Glupteba stealthy survival across reinstalls, so any drop of this driver signals a serious firmware level compromise.

Suspicious BeaverTail Payload Drop of store.node and Hidden Loaders

This rule detects creation of the BeaverTail dropped artifacts store.node and hidden .pyp or .npl loaders in the user profile, matching the North Korean job-hunter campaigns reported by Unit 42. These filenames staged in the profile root and dotted directories are markers of the BeaverTail infostealer and InvisibleFerret chain which precedes credential theft.

Malicious MOVEit human2 Webshell File Creation via file_event

This rule detects creation of the human2.aspx web shell dropped into the MOVEit Transfer wwwroot after exploitation of the CVE-2023-34362 SQL injection chain. This artifact gives the attacker web-accessible command and data-theft capability on the MOVEit host and its presence is a reliable sign of active exploitation.

Malicious ThrottleStop Vulnerable Driver Load for Defense Evasion

This rule detects loading of the ThrottleStop.sys driver, a signed but vulnerable component abused to disable or blind endpoint defenses from kernel space. The Gentlemen ransomware brings this driver to terminate security products before encryption. Detecting the driver load surfaces bring-your-own-vulnerable-driver activity used to impair defenses.

Malicious WinRing0 Vulnerable Driver Load for Coin Mining

This rule detects loading of the WinRing0x64.sys driver, a known vulnerable component abused to gain kernel level hardware access. The Vidar and XMRig campaign brings this driver to enable coin mining and to tamper with defenses. Detecting the driver load surfaces bring-your-own-vulnerable-driver activity tied to resource hijacking.

Malicious DNS Query to Autonomous AI Attack C2 Proxy Domain

This rule detects a DNS lookup for the code.newcli.com domain used as an attacker proxy in the Chinese-speaking autonomous AI attack campaign. The domain fronts the actor command-and-control and AI-CLI proxy infrastructure. Detecting the query provides a high-confidence indicator of a host reaching the campaign infrastructure.

Malicious Axios Supply Chain C2 Beacon Domain (via dns_query)

This rule detects DNS lookups for sfrclak.com, the command and control domain contacted with a POST beacon roughly every 60 seconds by the payload deployed in the Axios supply chain attack. Resolution of this hardcoded C2 domain indicates an active beaconing implant on the host.

Suspicious Cloudflare Quick Tunnel Used for Covert Access (via dns_query)

This rule detects DNS resolution of trycloudflare.com quick tunnel subdomains used in the TeamPCP supply chain attack to expose internal services and route command and control through Cloudflare infrastructure. Ephemeral tunnel domains provide attacker-controlled ingress that bypasses perimeter controls, so such lookups from servers warrant investigation.

Suspicious DNS C2 to Microsoft Typosquat Domain

This rule detects DNS queries for the updatemicfosoft typosquatting domain used as a DNS C2 channel. The Project AK47 toolset linked to the SharePoint attacks tunnels commands over DNS to update.updatemicfosoft using an XOR key. Any resolution of this Microsoft lookalike domain indicates DNS-based command and control.

Possible DarkCloud Geo-IP Lookup to showip.net

This rule detects DNS queries for showip.net, a public IP-geolocation service. The DarkCloud stealer resolves this domain to learn the external IP of a compromised host during reconnaissance. Endpoint processes querying external geo-IP services can indicate malware profiling a victim before data theft.

Suspicious DNS Queries to Secshow Open Resolver Scanning Infrastructure

This rule detects DNS queries associated with the secshow campaign that abuses open resolvers with crafted FQDNs encoding hex IP addresses, timestamps and amplification test markers. The activity maps and probes network infrastructure through DNS while blending into ordinary resolution traffic. Detecting these lookups exposes reconnaissance and DNS tunneling behavior tied to the secshow operation.