Sigma detection rules, expert-reviewed

Suspicious Hydra Android Banking Trojan C2 Mirror List Retrieval via Proxy

This rule detects HTTP requests to the Hydra Android banking trojan command-and-control mirror-list endpoint which returns a base64-encoded JSON list of fallback C2 servers. Observed in NCC Group Threat Spotlight research on Hydra which retrieves mirror lists over HTTP as well as from onion and code-hosting services. Identifying this retrieval helps surface infected mobile devices reaching out for updated C2 infrastructure.

Malicious MetaStealer C2 via cpp-httplib User-Agent (via proxy)

This rule detects outbound web requests presenting the cpp-httplib user-agent to the MetaStealer tasking endpoints such as api/client/new and tasks/get_worker. The combination of the library user-agent and these fixed URIs is a specific C2 fingerprint. Matching it surfaces hosts beaconing to MetaStealer infrastructure to register and receive stealer tasks.

Possible Cobalt Strike Beacon URI Pattern via Web C2

This rule detects outbound HTTP requests to Cobalt Strike malleable profile URIs observed in Blister post-exploitation traffic, including the /safebrowsing/ and /rest/2/meetings beacon paths often paired with Fastly domain fronting. These structured C2 URIs indicate beaconing to an attacker-controlled team server masquerading as benign web services.

Suspicious F5 Appliance Reconnaissance Commands

This rule detects post exploitation reconnaissance commands run on an F5 appliance such as enumerating configuration files and locating the VERSION file as described in NCC Group RIFT F5 TMUI intelligence. Adversaries execute these commands after TMUI exploitation to fingerprint the device and its configuration before deploying webshells so these sequences on an appliance are suspicious.

Suspicious Download Utility Spawned by Java Process

This rule detects a Java process spawning a download utility such as curl or wget which is a common post exploitation pattern after Log4Shell remote code execution as described in NCC Group Log4Shell detection research. Adversaries use the compromised Java application to pull second stage payloads onto the host so a Java parented download tool warrants investigation.

Malicious Fivehands Go Encryptor Execution via Command Line Flags

This rule detects execution of the Fivehands Go based file encryptor identified by its characteristic command line flags key path blocks and full as described in NCC Group Fivehands ransomware research. The operator invokes the encryptor with a supplied key and target path to encrypt files and append the crypt extension which is the destructive final stage of the intrusion.

Suspicious Access To Kubernetes Service Account Token File

This rule detects command line access to the mounted Kubernetes service account token path under var run secrets kubernetes io as described in NCC Group Kubernetes detection engineering research. Adversaries read this bearer token to impersonate the pod service account and authenticate to the API server for lateral movement and privilege escalation.

Suspicious Security Software Removal Batch Script Execution

This rule detects execution referencing batch scripts named to uninstall Sophos endpoint protection which Conti operators run to disable defenses before deploying ransomware. Observed in NCC Group research on Conti operations after the leaks using Removesophos and uninstallSophos batch files. Scripted removal of security tooling is a defense-evasion behavior that precedes impact.

Malicious Data Exfiltration via Renamed Rclone Using Masqueraded Configuration

This rule detects execution referencing a Rclone configuration file masquerading as a Windows host process file which Conti operators use to exfiltrate data to cloud storage. Observed in NCC Group research on Conti operations after the leaks using a renamed Rclone binary with a svchost.conf configuration. Cloud exfiltration via renamed Rclone is a common ransomware pre-encryption step.

Suspicious Loading of Malicious Netfilter Kernel Module for Traffic Signaling

This rule detects loading of a rogue netfilter kernel module used by the freenode Linux backdoor to implement magic-packet traffic signaling. Observed in NCC Group research analyzing the Linux backdoor from the freenode IRC network compromise which installs an ipt_ip_udp module hooking PREROUTING. Rogue kernel modules that enable covert wake-on-packet backdoors are a strong indicator of rootkit activity.

Suspicious Shell History Anti-Forensics via HISTFILE Manipulation

This rule detects commands that unset or redirect the shell history file to prevent command logging which the freenode Linux backdoor operators use to hide activity. Observed in NCC Group research analyzing the Linux backdoor from the freenode IRC network compromise. Disabling shell history is an anti-forensic behavior commonly seen in hands-on-keyboard intrusions.

Suspicious Cloud Exfiltration via Rclone

This rule detects execution of the rclone cloud sync utility with copy or sync operations, a data-exfiltration technique used by the Karakurt extortion actor to push staged files to attacker-controlled cloud storage. Bulk transfer of internal data to an external cloud provider is a strong sign of exfiltration ahead of extortion.

Malicious Kubernetes Node Escape via chroot to Node kubectl Path

This rule detects a chroot into the node-local kubectl directory used on managed Kubernetes nodes, a container-to-node escape technique observed in real-world cluster attacks after landing in a privileged pod. Breaking out to the node host filesystem gives the attacker control over the worker node and any credentials stored on it.

Possible Kubernetes Service Account Token Theft from Pod Secrets Path

This rule detects a process referencing the in-pod service-account secrets directory where Kubernetes mounts the projected token, ca certificate and namespace, a credential-access step observed in real-world cluster attacks. Reading this token lets an attacker authenticate to the Kubernetes API as the pod identity and expand access across the cluster.

Suspicious Kubernetes Pod Deployment with Privileged or Host Namespace Flags

This rule detects on-the-fly creation of Kubernetes pods running tooling such as busybox or socat with privileged, host-PID or host-path options, a container-escape and pivot technique seen in real-world cluster attacks. Launching a privileged pod that mounts the node filesystem lets an attacker break out of the container onto the underlying host.