Sigma detection rules, expert-reviewed

Suspicious EC2 Instance Connect SSH Public Key Push (via cloudtrail)

This rule detects the EC2 Instance Connect SendSSHPublicKey call that injects a temporary SSH key into a running instance, a lateral movement technique adversaries use to gain interactive shell access to cloud hosts. Because this API grants direct host access from control plane credentials, unexpected use is a meaningful indicator of an attacker pivoting into compute workloads.

Suspicious EC2 Key Pair Import via aws (via cloudtrail)

This rule detects the AWS ImportKeyPair API call used to upload an attacker-controlled public key so newly launched instances can be accessed. During the SugarCRM cloud intrusion the actor combined ImportKeyPair with RunInstances to establish attacker-usable compute, making an unexpected key import an early sign of cloud resource abuse and persistence.

Malicious Cloud Attack Tooling User Agent in CloudTrail via aws (via cloudtrail)

This rule detects AWS CloudTrail activity originating from the Pacu and ScoutSuite offensive cloud toolkits identified by their user agent strings. These frameworks were used to enumerate and abuse AWS control-plane access after ~/.aws/credentials theft during the SugarCRM zero-day cloud intrusion, indicating an attacker performing hands-on-keyboard cloud reconnaissance and resource abuse.

Suspicious PikaBot Autorun Persistence Pointing to AppData Microsoft Dropzone via registry_set

This rule detects PikaBot autorun persistence where a Run key value references an executable planted in the AppData Roaming Microsoft dropzone. PikaBot writes its payload under a Microsoft themed folder and registers it for startup to survive reboots. Legitimate Microsoft software rarely autoruns loose executables directly from this user writable path, making the combination a useful loader persistence heuristic.

Malicious Live Ledger Persistence via Realter HD Audio Run Key via registry_set

This rule detects the Live Ledger crypto wallet stealer establishing autorun persistence through a Run key value named Realter HD Audio, a deliberate misspelling that masquerades as the legitimate Realtek HD Audio component. Live Ledger impersonates Ledger Live to steal cryptocurrency wallet data. The forged audio driver naming is a strong host based indicator of the stealer footholding for reboot survival.

Possible Spectre Ops C2 Beacon via nico and yfat Query Parameters via proxy

This rule detects Spectre Ops stealer command and control traffic that posts to a PHP endpoint carrying the distinctive nico and yfat query parameters. These custom parameter names carry stolen data and bot identifiers to the panel. The parameter pairing uniquely fingerprints the exfiltration channel independent of the C2 host or the nonstandard port.

Possible ZharkBot C2 Beacon via socket Endpoint with Bot Parameters via proxy

This rule detects ZharkBot command and control beacons that request a /socket/ endpoint with the structured query parameters id, bld, os, mn and us reporting bot, build and host details. This fixed parameter layout encodes victim registration data to the panel. Matching the endpoint and its parameter set fingerprints the bot check-in regardless of the C2 domain in use.

Suspicious External Address Reconnaissance via curl to ifconfig me via process_creation

This rule detects external address reconnaissance from the compromised host where an operator curls ifconfig.me to learn the victim public IP after landing on the box. This egress check confirms outbound reachability and identity before establishing the reverse tunnel and file based C2. Automated querying of external IP echo services on a server is a common early intrusion discovery step.

Suspicious Reverse SSH Tunnel Exposing Local SSH via process_creation

This rule detects the reverse SSH tunnel used in the AI assisted intrusions where ssh -R forwards a remote listener back to the local SSH service to keep persistent inbound access through an attacker relay. Protocol tunneling over SSH lets operators bypass inbound firewall controls. Legitimate administrative reverse tunnels exist, so review the destination and account context when this fires.

Suspicious Execution Delay via Ping Localhost to Null via process_creation

This rule detects the execution delay trick used by the Spectre Ops stealer where cmd runs ping localhost with a count and redirects output to nul to sleep between stages. This ping based sleep evades sandbox timing and paces the infection chain. While some scripts use ping delays benignly, the localhost count and null redirection combination is a common malware self throttling pattern worth surfacing.

Suspicious Browser Kiosk Mode Forcing Credential Entry via process_creation

This rule detects the Credential Flusher technique that launches a Chromium based browser in fullscreen kiosk mode pointed at a login URL to coerce the victim into re-entering account credentials. The captured passwords are then harvested by an accompanying StealC infostealer delivered through Amadey. The pairing of kiosk mode with an app URL is a deliberate credential prompting behavior rather than normal browsing.

Suspicious Per Minute Scheduled Task Creation via schtasks via process_creation

This rule detects ZharkBot persistence that registers a scheduled task firing every single minute using schtasks with the SC MINUTE and MO 1 arguments. Such aggressive one minute recurrence is atypical of legitimate maintenance tasks and is used by the loader to guarantee frequent re-execution. The high frequency schedule pattern is a reliable behavioral indicator of malicious task based persistence.

Malicious Live Ledger Stealer Execution via Ledger Lives Masquerade via process_creation

This rule detects execution of the Live Ledger stealer disguised as Ledger Lives.exe, a typosquat of the legitimate Ledger Live wallet application. The malware targets cryptocurrency users and exfiltrates wallet material. The near identical process name is intended to blend with the real wallet client and is a reliable signal of the impersonation payload running.

Possible F5 TMUI Directory Traversal Exploitation Attempt

This rule detects requests to the F5 BIG-IP TMUI interface containing the dot dot semicolon traversal sequence used to bypass authentication in CVE-2020-5902 as described in NCC Group RIFT F5 TMUI intelligence. Adversaries chain this traversal against the tmui path to reach protected endpoints and achieve remote code execution so matching requests indicate exploitation attempts.

Possible Log4Shell JNDI Exploitation Attempt in Web Request

This rule detects Log4Shell exploitation attempts where a JNDI lookup expression is embedded in the request URI or headers including LDAP RMI and DNS callbacks and URL encoded variants as described in NCC Group Log4Shell detection research. Adversaries inject these strings to trigger CVE-2021-44228 remote code execution in vulnerable Log4j components so matching requests indicate active exploitation.