Sigma detection rules, expert-reviewed

Possible Mamba 2FA AiTM Phishing URL Pattern

This rule detects HTTP requests matching the Mamba 2FA adversary in the middle phishing URL structure of a single letter path segment m, n or o followed by a query string carrying a Base64 encoded victim token. Mamba 2FA relays Microsoft 365 credentials and session cookies through this pattern to bypass multifactor authentication. Because the pattern is broad it should be corroborated with the known relay domains before action.

Renamed Grandoreiro DLL Sideloading via mingwm10 from User-Writable Path (via image_load)

This rule detects a process loading a mingwm10 runtime DLL from a user-writable directory, the side-loading vehicle used by the Grandoreiro banking trojan in its Brazil-to-Mexico campaign where a renamed Duplicate Files Finder binary loads a malicious mingwm10 DLL. Adversaries drop the trojanized runtime beside a relocated legitimate binary to execute under a trusted process. Loads from download or temp paths rather than an install directory are anomalous.

Possible Noodlophile Persistence via Run Key Launching Python Through cmd (via registry_set)

This rule detects a Registry Run key whose value launches a Python interpreter through cmd.exe, the persistence behavior used by the evolved Noodlophile stealer to re-run its Python payload at logon after DLL-sideloading delivery. Adversaries leverage a Run key that chains a command shell into an interpreter so the stealer survives reboots, making detection useful for surfacing persistence before repeated credential and browser-data theft.

Suspicious Expensive LDAP Query Reconnaissance

This rule detects Directory Service event 1644 recording expensive or inefficient LDAP search queries against a domain controller. This behavior matches LDAP-based reconnaissance where attackers issue broad filters to enumerate users, groups, and computers. A burst of expensive LDAP queries from unusual sources indicates active directory enumeration and should be correlated with the requesting host.

Suspicious Linux Host Reconnaissance via Whoami and Uname by UAT-7290

This rule detects a shell one-liner echoing the current user together with kernel and machine details from uname. UAT-7290 uses this command to profile compromised Linux hosts during initial access. Combined user and system enumeration is a common precursor to deploying tailored malware.

Suspicious AWS STS Session Token and Role Chaining Abuse via CloudTrail (via aws)

This rule surfaces AWS STS GetSessionToken and AssumeRole activity that adversaries abuse to mint temporary credentials and chain roles for lateral movement, as detailed in Red Canary's analysis of AWS cloud account abuse. Because these APIs are also used legitimately, alerts should be correlated with the calling identity and source to spot role chaining that escalates access across the environment.

Suspicious Bedrock AgentCore Runtime Invocation on Wildcard Resources (via aws)

This rule detects Bedrock AgentCore code interpreter and agent runtime invocations that, in the Agent God Mode scenario, are abused through wildcard IAM permissions to execute code across agent boundaries. Invocation of these runtimes by unexpected principals can indicate exploitation of excessive privileges for arbitrary execution in the AI environment.

Suspicious npm Credential Scan via whoami and npmrc Access

This rule detects the npm whoami identity check combined with access to the .npmrc credential file, a credential-harvesting step in the Shai Hulud 2.0 worm. The malicious payload queries npm /-/whoami and reads .npmrc to steal publishing tokens for propagating to further packages. Automated npm authentication probing paired with npmrc token access is a strong indicator of supply-chain credential theft.

Possible Path Traversal Local File Inclusion Against Exposed Cloud Function (via webserver)

This rule detects web requests containing directory traversal sequences targeting sensitive Unix files such as etc/passwd, matching the local file inclusion probes sent to exposed Cloud Function endpoints. Adversaries use these payloads to read arbitrary files and enumerate a container before escalating to remote code execution, so traversal attempts against run.app services should be reviewed.

Suspicious TeamViewer Remote Access DNS Resolution (via dns_query)

This rule detects DNS queries to TeamViewer infrastructure subdomains such as master, ping, router, and server nodes under teamviewer.com. Abuse of TeamViewer remote access enabled the Oldsmar water treatment facility intrusion where an operator workstation was manipulated remotely. TeamViewer is dual-use, so this detection is most valuable in ICS and OT segments where remote-access tooling should be absent or tightly controlled.

Suspicious VOLTZITE Single-Character Named ZIP Exfil Staging (via file_event)

This rule detects creation of ZIP archives whose file name is a single letter or digit, a staging convention observed in VOLTZITE intrusions. The group compresses collected data into minimally named archives to blend into disk activity before exfiltration. Detecting these staging files provides an opportunity to interrupt data theft prior to transfer.

Suspicious External IP Lookup to ipify Service (via dns_query)

This rule detects DNS resolution of the ipify external IP-lookup service, which adversaries query at the start of instant-messaging command and control to discover the victim public address. Malware pairs this lookup with sessions to Discord or Telegram APIs to fingerprint the environment before beaconing. The lookup is dual-use, so correlate with unsigned or masquerading binaries for higher confidence.

Suspicious Telegram Bot API Command and Control Communication (via proxy)

This rule detects outbound web requests to the Telegram Bot API endpoint on api.telegram.org that include a bot path, a command and control channel HookSpoofer stealer abuses to exfiltrate stolen data. The stealer posts harvested credentials and files to a hardcoded bot token. Because Telegram is also used legitimately this indicator is low confidence and best correlated with host stealer activity.

Suspicious Shell Password Gathering Referencing System Preferences (via process_creation)

This rule detects a shell command line referencing both system preferences and password, the shell-based credential-gathering pattern Red Canary associated with Atomic Stealer on macOS. This wording is used to coax users into entering their password while impersonating a system settings prompt, so its appearance warrants review for credential theft.

Suspicious Microsoft Teams Installer Masquerade via MC Teams Binary (via process_creation)

This rule detects execution of a binary named MC Teams.exe, the signed malware sample Red Canary documented masquerading as a Microsoft Teams installer while carrying a Neural Code Technologies Inc. signer. The legitimate Teams installer does not use this filename, so its execution suggests a freshly signed masquerading binary abusing code-signing trust.