Sigma detection rules, expert-reviewed

Suspicious attrib Hidden and System Attribute Assignment

This rule detects the attrib command setting hidden and system attributes on files, a concealment technique observed in the Suky Castle campaign where the chain applied attrib to hide dropped artifacts before scheduling persistence. It captures the marking of files as hidden and system to keep malicious payloads out of view. Detecting this is important because interactive use of attrib to apply both hidden and system flags is uncommon and frequently tied to staging of malware.

Possible OxideHarvest Stealer Execution via Combined Short Flag Set

This rule detects a process invoked with the combined i, u, p, t and o short flags used by the OxideHarvest Rust stealer distributed alongside the Gentlemen EDR killer framework. The flag set drives credential and data harvesting stages of the stealer once security tooling has been disabled. Detecting this argument combination helps surface stealer execution, although the generic single-letter flags require corroboration to reduce noise.

Possible Firewall Rule Manipulation via netsh advfirewall by FishMonger

This rule detects use of netsh to add advanced firewall rules, an action used by the FishMonger group to weaken host defenses and allow SprySOCKS communication. The technique modifies the Windows firewall configuration to permit inbound or outbound traffic for attacker tooling. Detecting this command is useful because unexpected firewall changes on endpoints can indicate defense evasion, though it also occurs during legitimate administration.

Possible Local Group Membership Enumeration via Security Event 4798

This rule detects Windows Security event 4798 recording enumeration of a user local group membership, generated by the net user Beacon Object File used during Cobalt Strike post-exploitation reconnaissance. Attackers enumerate account and group membership to plan privilege escalation and lateral movement. A high volume or unusual source of these events can indicate automated discovery activity.

Suspicious WordPress Path Probing Against Non WordPress Web Server

This rule detects requests to common WordPress administrative and plugin paths that indicate automated content discovery and probing as described in Elastic research on detecting web server fuzzing in Traefik. A burst of such requests against a server that does not host WordPress signals reconnaissance for exploitable endpoints.

Suspicious Kernel Module Load Or Unload For Rootkit Deployment via PUMAKIT

This rule detects invocation of module management utilities that insert or remove Linux kernel modules which the PUMAKIT rootkit relies on to load its kernel component and manipulate the running kernel. Adversaries load a malicious LKM to gain kernel level control and conceal processes files and network activity.

Suspicious Udev Rule Reload After Rules Directory Modification

This rule detects udevadm being invoked to reload or trigger device manager rules which follows an attacker writing a malicious rule into the udev rules directory to gain event driven persistence. Adversaries register a udev rule that runs a payload when a device event fires giving them privileged execution outside standard autostart locations.

Suspicious SUID Binary Discovery via Find Perm 4000

This rule detects the find command searching the filesystem for setuid binaries using the perm 4000 predicate which is a common privilege escalation discovery step on Linux hosts. Adversaries enumerate SUID executables to locate misconfigured binaries that can be abused to elevate to root.

Suspicious System Profiler Hardware Reconnaissance via BANSHEE

This rule detects the system_profiler utility being run against hardware and software data types which the BANSHEE macOS infostealer uses to fingerprint the victim host model and environment. Adversaries collect this system information to profile targets and support later data exfiltration decisions.

Possible C2 Beacon to Dynamic DNS Provider via DNS Query

This rule detects DNS resolution of dynamic-DNS domains under ddns.net, serveirc.com, and hopto.org, the fast-flux infrastructure MuddyWater used for MuddyC2Go beacons. Adversaries favor dynamic DNS to rotate C2 endpoints cheaply, so resolutions to these providers from server or non-consumer hosts merit correlation with process activity.

Suspicious AWS IAM Role Creation With Cross-Account Trust Policy

This rule detects an IAM CreateRole event whose assumeRolePolicyDocument establishes a trust relationship that allows another AWS account principal to assume the role. Adversaries create such backdoored roles so an attacker-controlled external account gains persistent access into the victim environment. This is important because cross-account trust relationships are a stealthy persistence mechanism that survives credential rotation.

Possible SES Sending Configuration Enumeration via CloudTrail

This rule detects reconnaissance enumeration of Amazon SES sending configuration through GetAccountSendingEnabled, GetSendQuota, ListIdentities, and GetIdentityVerificationAttributes calls. Adversaries with stolen credentials probe SES quotas and verified identities to determine whether the account can be abused to send spam or phishing. A burst of these read calls from an unexpected principal often precedes SES abuse.

Suspicious AWS Role Assumption via Cognito Web Identity

This rule detects CloudTrail AssumeRoleWithWebIdentity events whose identity provider is cognito-identity.amazonaws.com which the AWS Amplify role takeover technique abuses to assume a victim account authRole or unauthRole from an attacker controlled identity pool for cross account access.

Suspicious System Profiler Hardware Enumeration (via process_creation)

This rule detects system_profiler querying SPHardwareDataType which the Cosmic Leopard macOS implant uses to fingerprint the host and detect virtual or analysis environments. Hardware enumeration is an early discovery step that informs targeting and sandbox evasion decisions.

Suspicious Google Cloud Function Create or Update Triggering Build

This rule detects creation or modification of a Google Cloud Function which automatically triggers a build using the default Cloud Build service account. Talos observed this serverless attack vector where an actor deploys a malicious function to execute attacker code during the build and inherit the over-privileged build service account, so unexpected function writes warrant review as a privilege-escalation foothold.