Sigma detection rules, expert-reviewed

Suspicious DNS Queries to Secshow Open Resolver Scanning Infrastructure

This rule detects DNS queries associated with the secshow campaign that abuses open resolvers with crafted FQDNs encoding hex IP addresses, timestamps and amplification test markers. The activity maps and probes network infrastructure through DNS while blending into ordinary resolution traffic. Detecting these lookups exposes reconnaissance and DNS tunneling behavior tied to the secshow operation.

Suspicious DNS Queries to Simitor Tracking Tunnel Infrastructure

This rule detects DNS queries to the trk.simitor wildcard infrastructure used in a DNS tunneling campaign that encodes tracking and victim data into MD5-hashed subdomains resolving through a CNAME chain. The abuse of DNS as a covert channel lets operators exfiltrate identifiers and beacon without conventional network egress. Detecting these lookups exposes tracking-oriented DNS tunneling activity.

Possible Rogue Device Registration in Entra ID (via azure)

This rule detects Entra ID device registration and join events that adversaries abuse to plant attacker-controlled devices for Primary Refresh Token acquisition. Unit 42 observed this technique with ROADtools during nation-state cloud intrusions to establish durable identity-based access.

Suspicious ROADtools User Agent Against Microsoft Graph (via azure)

This rule detects Entra ID sign-ins and Graph activity carrying the roadtools or generic python-requests user agent, indicating use of the ROADtools and roadtx offensive tooling. Nation-state actors use these tools to register rogue devices, acquire Primary Refresh Tokens, and enumerate directory objects.

Suspicious Azure AD Authentication Method Registration for Account Takeover (via azure)

This rule detects registration or update of a security info authentication method in Azure AD Entra ID, the account-takeover step used by the Payroll Pirates after help-desk social engineering. Attackers add an attacker-controlled email or MFA device as an authentication method on service and employee accounts to seize persistent access and alter direct-deposit details.

Malicious AzureHound Cloud Reconnaissance via User Agent (via azure)

This rule detects sign-ins and Graph API activity carrying the azurehound user-agent string, indicating use of the AzureHound collector to enumerate users, groups, roles, and service principals. Threat actors run AzureHound to map Azure and Entra ID attack paths before privilege escalation. Detecting the tool user-agent exposes cloud discovery activity at its source identity.

Suspicious New MFA Authenticator Registration via Azure AD (via azure)

This rule detects registration of new security information such as a Microsoft Authenticator app on an Azure AD identity, a persistence and MFA-bypass step used in the Jingle Thief campaign. The actors register a rogue authenticator to maintain access to compromised accounts. Detecting this registration surfaces attacker enrollment of unauthorized MFA methods after account takeover.

Suspicious VM Run Command Execution in Azure

This rule detects invocation of Azure Virtual Machine run commands that execute operator supplied scripts on a VM through the management plane. Adversaries with valid Azure credentials abuse runCommands to gain code execution on workloads without network-level access as covered in Unit 42 cloud VM attack path research. Detecting these operations exposes control-plane driven execution on virtual machines.

Suspicious CloudTrail Logging Tampering for Defense Evasion (via aws)

This rule detects AWS CloudTrail API calls that stop, delete, or reconfigure trails, including KMS key swaps and redirection to attacker-controlled S3 buckets. Adversaries perform these actions to blind logging and evade detection during cloud intrusions.

Suspicious Cross-Agent Memory Retrieval via Bedrock AgentCore (via aws)

This rule detects Bedrock AgentCore memory retrieval operations that, under the Agent God Mode exploitation of overly permissive IAM, allow one agent to read another agent's stored memory. Cross-agent memory access can expose sensitive conversation and data context, so these calls on shared or wildcard-scoped resources indicate potential data theft.

Suspicious SES Email Identity and Receipt Rule Abuse (via cloudtrail)

This rule detects creation of SES email identities and receipt rules, which JavaGhost abuses to weaponize a victim AWS account for outbound phishing and inbound mail capture. Standing up sending identities and receipt rules turns the compromised account into attacker-controlled email infrastructure.

Malicious IAM Group Creation for SES Abuse by JavaGhost (via cloudtrail)

This rule detects creation of the IAM group AWSSESSendingGroupDoNotRename, a persistence artifact JavaGhost creates to grant SES email-sending permissions for phishing. The deceptively official group name is used to authorize continued abuse of Simple Email Service from the victim account.

Malicious JavaGhost Security Group Creation (via cloudtrail)

This rule detects creation of EC2 security groups named Java_Ghost or bearing the description We Are There But Not Visible, calling cards left by the JavaGhost actor in compromised AWS environments. These empty security groups act as a signature the group plants during its cloud phishing operations.

Malicious S3 Bucket Deletion During Bling Libra Extortion

This rule detects deletion of S3 buckets through the DeleteBucket API, a destructive action the Bling Libra group behind ShinyHunters took after stealing data to pressure victims during extortion. Removing buckets destroys data availability and leaves a ransom note in a newly created bucket. Detecting this exposes destructive impact on cloud storage during an extortion event.

Windows Registry Modification in Security Center AV Provider Keys (ProductEXE/DisplayName/ReportingExe)

Alerts on registry modifications under Security Center AV Provider keys that update antivirus product fields like ProductEXE and DisplayName.