Sigma detection rules, expert-reviewed

Suspicious Remote Script Download Piped to Shell via 8220 Gang Hadooken

This rule detects a curl or wget download whose output is piped directly into a shell interpreter, the download and execute pattern the 8220 gang schedules through cron every few minutes in the Hadooken campaign to pull and run its loader. Piping remote content into a shell removes any on disk staging and is a common Linux malware behavior. It is rarely required by legitimate automation.

Suspicious Workday Payment Election Change via Compromised Account (via workday)

This rule surfaces Workday audit events where an account modifies payment elections or core account details. This activity matches payroll pirate operations in which attackers who phished university credentials register their own MFA device and reroute direct deposit to attacker-controlled bank accounts. Correlating payment element changes with recent device enrollment helps surface payroll fraud before funds are lost.

Suspicious FinCounter DNS Tunneling Query via dns_query

This rule detects DNS queries whose leftmost label begins with the counter prefix used by the FinCounter DNS tunneling toolkit. Unit 42 catalogued this fixed prefix as a distinctive encoding marker of FinCounter command-and-control over DNS, so repeated queries of this shape from a host suggest a covert DNS tunnel.

Suspicious node.exe Inline Script Execution via -e

This rule detects node.exe executing an inline script through the -e flag, the stager execution method in the DEV#POPPER GitHub-lure infection. Victims who cloned the weaponized repository ran a hidden script that used node -e to bootstrap the RAT. While developers occasionally use node -e, inline Node execution from a cloned project should be reviewed for malicious staging.

Suspicious AWS Long-Term Access Key Creation for Persistence via CloudTrail (via aws)

This rule detects the creation of a long-term IAM access key, which adversaries generate as a backup AKIA credential to maintain persistent access to a compromised AWS account per Red Canary. Key creation for a user other than the caller, or immediately following STS token abuse, is a strong indicator that an attacker is establishing durable persistence.

Suspicious LaunchDaemon Load via launchctl

This rule detects loading and enabling of a launchd job via launchctl with the -w flag. This behavior matches macOS lateral movement and persistence tradecraft where attackers install malicious plist based services to maintain access. While used by legitimate administration, unexpected launchctl load activity on endpoints can indicate persistence installation and should be reviewed.

Suspicious 32-bit PowerShell Executed From SysWOW64 (via process_creation)

This rule detects invocation of the 32-bit PowerShell binary from SysWOW64, a technique GuLoader uses to run shellcode inside a 32-bit host on 64-bit systems. While some legacy tooling calls this path, its use as a malware execution surface makes it worth surfacing for review.

Suspicious CurKeep Backdoor C2 API Endpoints (via proxy)

This rule detects web requests to the shell and file API endpoints used by the CurKeep backdoor for command-and-control in the Stayin Alive campaign. The fixed api shell and api file URI paths reflect the backdoor tasking channel and help surface implant traffic in proxy logs.

Suspicious Browser and Wallet Credential Theft via JavaScript Stealer

This rule detects a script or process accessing browser and cryptocurrency wallet credential stores for Chrome, Edge, MetaMask, Phantom and 1Password, matching the INVISIBLEFERRET JavaScript stealer that packages stolen data into a ZIP for exfiltration. This credential and wallet harvesting supports DPRK financial theft in the EtherHiding campaign.

Suspicious AWS Organizations and Account Discovery via aws (via cloudtrail)

This rule detects AWS Organizations and account enumeration API calls that map the blast radius of compromised access keys. Unit 42 observed this cloud service discovery during the SugarCRM incident where stolen credentials were used to survey the target environment before resource abuse, so alerting is warranted when these calls come from unexpected principals.

Suspicious Domain Admins Group Enumeration via net.exe (via process_creation)

This rule detects enumeration of the Domain Admins group with net localgroup and the /domain switch, used for privilege-mapping discovery during a compromised-vendor intrusion. Attackers query privileged group membership to identify high-value accounts before lateral movement. While administrators occasionally run this, its appearance alongside credential dumping is high signal.

Possible Check Point SmartConsole Token Redemption Endpoint Access (via proxy)

This rule detects HTTP requests to the SmartConsole /cpmws/LoginSvcRemote token redemption endpoint. Rapid7 documented abuse of this SOAP endpoint to redeem forged SSO tokens as part of the CVE-2026-16232 authentication bypass against Check Point management servers. Legitimate SmartConsole clients also reach this endpoint so alerts should be correlated with unexpected source hosts or forged application token audit events.

Suspicious Wscript Executing UN VBS Cleanup Script via Command Line (via process_creation)

This rule detects wscript.exe executing a VBScript named UN.vbs, the cleanup component used by the Parallax RAT to remove infection artifacts. It is associated with the Parallax RAT campaign reported by Uptycs. Attackers run this script to erase traces after establishing access, so the execution is a useful indicator of post-infection cleanup activity.

Possible Linux Hardware Reconnaissance via Dmidecode Baseboard Query

This rule detects execution of dmidecode requesting baseboard information, a host-fingerprinting step used by the Prometei botnet alongside reads of /proc/cpuinfo. Malware profiles infected systems this way before cryptomining. While inventory tools may use dmidecode, its use by unexpected parents warrants review.

Possible Task Manager Access Indicator for Potential LSASS Dump (via process_creation)

This rule detects provides an indicator of a user accessing the task manager in order to eventually dump the LSASS process content using the "Details" tab > right click on "lsass.exe" > Create a dump file.