Sigma detection rules, expert-reviewed

Malicious S3 Bucket Deletion During Bling Libra Extortion

This rule detects deletion of S3 buckets through the DeleteBucket API, a destructive action the Bling Libra group behind ShinyHunters took after stealing data to pressure victims during extortion. Removing buckets destroys data availability and leaves a ransom note in a newly created bucket. Detecting this exposes destructive impact on cloud storage during an extortion event.

Windows Registry Modification in Security Center AV Provider Keys (ProductEXE/DisplayName/ReportingExe)

Alerts on registry modifications under Security Center AV Provider keys that update antivirus product fields like ProductEXE and DisplayName.

PowerShell: Defendnot hacktool installation via one-liner fetching dnot.sh

Flags PowerShell one-liners that reference dnot.sh and GitHub/defendnot paths consistent with Defendnot installation.

Windows Security Log: Defendnot scheduled task (defendnot) persistence via --from-autorun

Detects Defendnot persistence by alerting on scheduled task create/update activity for \defendnot with --from-autorun.

Windows reg.exe Registry Tampering of Internal Tool and Explorer Policy Settings (T1112)

Alerts when reg.exe modifies Windows policy settings that disable or restrict internal tools and Explorer/System behavior.

Suspicious S3 Access from Desktop File Transfer Clients by Bling Libra

This rule detects AWS S3 API activity originating from desktop file transfer clients identified by S3 Browser and WinSCP user agents, tooling the Bling Libra group behind ShinyHunters used to enumerate and manipulate buckets with stolen credentials. Interactive client access to S3 is unusual for automated workloads and signals hands-on abuse. Detecting this exposes credentialed data access ahead of extortion.

Suspicious Lambda Function Creation Across Regions in AWS Extortion Operation

This rule detects creation of Lambda functions by an execution role provisioned for the large-scale cloud extortion operation, where the actor deployed functions across many regions to scan targets for exposed environment files and harvest secrets. Programmatic function creation spread across regions reflects automated abuse rather than normal deployment. Detecting these events exposes the actor building out exfiltration tooling.

Malicious Administrator Policy Attachment for Privilege Escalation in AWS

This rule detects the AdministratorAccess managed policy being attached to a role or user through AttachRolePolicy or AttachUserPolicy, a privilege escalation step in the large-scale cloud extortion operation that leveraged leaked environment variables. Granting full admin to a controlled identity gives the actor complete account control. Detecting this exposes escalation ahead of data theft and extortion.

Suspicious SSH Key Push to EC2 via EC2 Instance Connect

This rule detects use of EC2 Instance Connect SendSSHPublicKey and SendSerialConsoleSSHPublicKey to inject a temporary public key onto an instance, an access path abused by adversaries holding valid AWS credentials to reach virtual machines. Pushing keys through the control plane grants interactive access while bypassing key management controls. Detecting these calls exposes credentialed lateral movement into compute workloads.

Suspicious Remote Command Execution to EC2 Instances via AWS SSM

This rule detects use of AWS Systems Manager to run commands or open interactive sessions on EC2 instances through SendCommand and StartSession events. Adversaries with valid cloud credentials abuse SSM to reach virtual machines without SSH or RDP as described in Unit 42 cloud VM attack path research. Detecting these calls exposes control-plane driven access to compute workloads.

Suspicious AWS Secrets Manager Secret Value Retrieval (via cloudtrail)

This rule detects retrieval of stored secret values from AWS Secrets Manager, a credential access action Muddled Libra performs to harvest embedded keys and passwords for deeper compromise. Because applications legitimately call this API, the event is best correlated with unusual principals or volumes rather than treated as malicious on its own.

Suspicious AWS Transfer Family Server Creation for Data Exfiltration (via cloudtrail)

This rule detects creation of AWS Transfer Family servers or users, a capability Muddled Libra provisions to move stolen data out of a compromised account over managed file transfer. Standing up transfer infrastructure is uncommon and, when it follows credential access, indicates an adversary staging exfiltration to an external or attacker controlled destination.

Suspicious SSM Session or Command Execution on EC2 Instance (via cloudtrail)

This rule detects Systems Manager StartSession or SendCommand activity that runs commands or opens interactive sessions on EC2 instances, a technique used to move laterally into workloads using cloud credentials. While SSM is used for legitimate operations, unexpected sessions or command runs from unfamiliar principals indicate an adversary executing code inside instances.

Suspicious EC2 Instance Connect SSH Public Key Push (via cloudtrail)

This rule detects the EC2 Instance Connect SendSSHPublicKey call that injects a temporary SSH key into a running instance, a lateral movement technique adversaries use to gain interactive shell access to cloud hosts. Because this API grants direct host access from control plane credentials, unexpected use is a meaningful indicator of an attacker pivoting into compute workloads.

Suspicious EC2 Key Pair Import via aws (via cloudtrail)

This rule detects the AWS ImportKeyPair API call used to upload an attacker-controlled public key so newly launched instances can be accessed. During the SugarCRM cloud intrusion the actor combined ImportKeyPair with RunInstances to establish attacker-usable compute, making an unexpected key import an early sign of cloud resource abuse and persistence.