Sigma detection rules, expert-reviewed

Malicious NPM Backdoor C2 Beacon to Injective Telemetry Endpoint via Proxy

This rule detects HTTP POST requests to the Injective testnet gRPC-web telemetry host abused as command-and-control by the trojanized @injectivelabs/sdk-ts npm package. The backdoor base64-encodes wallet mnemonics and private keys derived in PrivateKey.ts and exfiltrates them in the request payload. Detecting this outbound beacon is critical because it represents active theft of cryptocurrency credentials from developer and CI environments.

Suspicious C2 Beacon with Legacy MSIE User Agent

This rule detects outbound HTTP traffic to the axios RAT command and control host over a non-standard port using a hardcoded legacy Internet Explorer user agent. The implant beacons to sfrclak.com on port 8000 with an obsolete MSIE client string that rarely appears from modern endpoints. The combination of this destination and the archaic user agent identifies the RAT check-in channel.

Suspicious 1Phish Kit Cookies and Telemetry Beacon

This rule detects the 1Phish kit fingerprint cookies validated_user_1pass and hideclick ignore alongside its base64 clid telemetry parameter. These constants are set by the phishing kit to track victim progress and evade automated crawlers. Requests carrying these kit-specific cookies or the clid telemetry marker identify pages served by the 1Phish infrastructure.

Malicious HarborWatch RAT Command and Control Beacon by User Agent (via proxy)

This rule detects outbound HTTP requests carrying the HarborWatchAgent user agent string used by the custom monitoring RAT delivered through a fake Amazon ClickFix lure. This hardcoded agent value is specific to the malware and should not appear in normal traffic.

Suspicious UAT-10608 Credential Harvesting C2 Beacon via HTTP

This rule detects outbound HTTP requests carrying the UAT-10608 command-and-control beacon layout where the URI encodes the victim host, the harvesting phase and a campaign identifier as h, l and id parameters. This structured query pattern is used by the credential harvesting operation to report progress and exfiltrate results over HTTP. Matching traffic indicates an actively beaconing compromised host.

Possible PS1Bot C2 Beacon With Drive Serial URI Pattern (via proxy)

This rule detects HTTP GET requests whose URI query contains the PS1Bot command-and-control marker k=result used to exfiltrate results keyed by the victim drive serial number. This structured URI pattern identifies PS1Bot beaconing to its command-and-control server. Detection of this traffic reveals active command-and-control and data exfiltration.

Suspicious WarmCookie C2 Beacon With Fixed Firefox User-Agent

This rule detects web traffic carrying the hardcoded Firefox 115.0 User-Agent string used by WarmCookie. WarmCookie beaconed to its command-and-control servers with a fixed Mozilla Firefox 115.0 User-Agent regardless of the host browser. A single static outdated User-Agent applied to all C2 requests is an application-layer protocol indicator that stands out from real browser diversity.

PATCHCORD Beacon C2 Tasking via api.jsp clientId Poll (via proxy)

This rule detects the PATCHCORD implant polling its command channel with the hardcoded Beacon user-agent and the api.jsp clientId tasking URI observed in the Afghan telecom intrusion set. Adversaries use this fixed user-agent and endpoint to fetch operator commands over HTTP. The distinctive agent string and URI make this beacon reliably separable from normal web traffic.

SilentMare Loader C2 Beacon via Custom GatewayClient User-Agent (via proxy)

This rule detects outbound HTTP requests carrying the hardcoded GatewayClient and Metrics User-Agent strings used by the SilentMare and HollowMare trojan families distributed through Google Search ads. These custom agents identify updater check-ins that pull AES-encrypted .NET payloads from attacker infrastructure, making them a reliable network fingerprint for the loader stage.

Possible C2 Beacon with Fixed Authorization URI Parameter via proxy

This rule detects outbound web requests to index.php carrying the fixed authorization=1 query parameter used by the DGA based command-and-control of the pirated-media miner campaign. The constant URI structure across randomized domains is a reliable protocol fingerprint. Catching the beacon URI reveals active C2 traffic that domain blocklists miss.

Possible Cryptomining Beacon to c3pool Mining Domain

This rule detects DNS lookups for the c3pool mining pool domain used by the cryptominer dropped after SSTI exploitation in this research. Enterprise systems have no reason to resolve public mining pool infrastructure. Detecting the query surfaces resource hijacking following the web compromise.

Suspicious Typosquatted Apple User-Agent Beaconing from Ivanti Implant (via proxy)

This rule detects HTTP requests bearing a typosquatted Apple user-agent string that substitutes look-alike characters for the letter l. Implants deployed against Ivanti Connect Secure used App1e and AppIe user-agents during their dormancy and beaconing. A user-agent forging the Apple brand with homoglyphs is a distinctive command-and-control fingerprint.

Malicious Cobalt Strike Malleable C2 URI Beacon via Proxy

This rule detects HTTP requests to the Cobalt Strike malleable profile URI /1/events/com.amazon.csm.csa.prod observed in the Nitrogen 2.0 campaign. This fixed path masquerades as Amazon telemetry to blend with normal traffic. Detecting it identifies beaconing to Cobalt Strike infrastructure.

Possible Access-Code Validation Beacon to Malware Delivery C2 (via proxy)

This rule detects HTTP requests to an /api/submit endpoint carrying a code parameter, the access-code validation call made by a DocuSign-themed loader before it retrieves its second stage in a Vidar delivery chain analyzed by Joe Sandbox. Adversaries gate payload delivery behind server-side code validation to evade sandboxes and analysts, so this submit-with-code request pattern surfaces the loader contacting its delivery infrastructure.

Malicious LummaC2 Stealer C2 Endpoint Beacon via Proxy

This rule detects HTTP requests to the LummaC2 command-and-control endpoints /c2conf and /c2sock used by version 4.0 of the stealer. These fixed URI paths handle configuration retrieval and data exfiltration. Detecting them identifies infected hosts communicating with LummaC2 infrastructure.