Sigma detection rules, expert-reviewed

Malicious BRICKSTORM C2 over WebSocket to Cloudflare Workers Domain (via proxy)

This rule detects WebSocket connections to a workers.dev subdomain used by the BRICKSTORM backdoor for command-and-control. Following Ivanti exploitation the actor tunneled BRICKSTORM traffic through Cloudflare Workers infrastructure to reach compromised vCenter hosts. Outbound wss traffic to attacker-registered workers.dev endpoints is a distinctive C2 indicator.

Suspicious UNC1549 Azure C2 Beacon to News Notifications URI Pattern (via proxy)

This rule detects HTTP requests to Azure-hosted command-and-control paths matching a /news/notifications/ prefix followed by a numeric identifier. UNC1549 tunneled MINIBIKE traffic through Azure cloud infrastructure using this structured URI scheme to blend with legitimate cloud services. The consistent notifications URI layout is a usable network fingerprint for the campaign.

Suspicious GCP Metadata Service Token Access via Command Line (via process_creation)

This rule detects a command line that queries the GCP metadata service compute endpoint for a service account access token, the action used to steal cloud credentials after achieving code execution in an exposed Cloud Function. Adversaries harvest the default service account token to pivot into the wider cloud project, so metadata token retrieval from a runtime process is a high-value credential access indicator.

Malicious Switch User to Rogue Root-Equivalent Account troot (via process_creation)

This rule detects a switch-user operation targeting the troot account, the uid 0 backdoor account injected into /etc/passwd and /etc/shadow during exploitation of Cisco Catalyst SD-WAN Manager. Adversaries create and then assume this masqueraded root-equivalent account to maintain privileged access, so an su to troot is a strong sign of post-exploitation activity.

Malicious Cisco SD-WAN Tenant List Upload Script Execution (via process_creation)

This rule detects execution of the vconfd_script_upload_tenant_list.sh helper script recorded during exploitation of Cisco Catalyst SD-WAN Manager (CVE-2026-20245), where the crafted tenant CSV was processed to append a rogue root account to system files. Adversaries trigger this internal script as part of the privilege escalation chain, so its appearance in logs indicates the vulnerability was exercised.

Possible Cisco Catalyst SD-WAN Manager Tenant Upload Exploitation CVE-2026-20245 (via process_creation)

This rule detects the tenant-upload tenant-list request pattern used to exploit CVE-2026-20245 in Cisco Catalyst SD-WAN Manager, where a crafted tenant CSV was uploaded to inject a privileged account into the appliance. Adversaries leverage this zero-day to gain root-level control of the management plane, so this request signature is a high-value indicator of active exploitation.

Suspicious Rclone Data Transfer to Cloud Storage (via process_creation)

This rule detects execution of rclone with a copy, sync, or move operation, matching the bulk exfiltration to Google Drive observed in the targeted campaign against US law firms. Adversaries use rclone to stage and transfer large volumes of harvested documents to attacker-controlled cloud storage, so its presence on endpoints should be reviewed for unauthorized data movement.

Suspicious Microsoft Edge Headless Launch with Unpacked Extension via SNOWBELT (via process_creation)

This rule detects Microsoft Edge started in headless mode while side-loading an unpacked extension from disk, the technique UNC6692 used to run the SNOWBELT browser extension during the Snow Flurries social engineering campaign. Adversaries abuse headless browser automation with loaded extensions to access and proxy data while blending into normal browser activity, so this launch pattern warrants investigation.

Suspicious Scheduled Task Launching rundll32 DLL via Ransomware

This rule detects schtasks creating a task that periodically executes rundll32 against a DLL as observed in ransomware persistence and re execution routines. Attackers schedule loader DLLs to survive reboots and re trigger their payload on a recurring interval.

Suspicious ESXi execInstalledOnly Disabled via esxcli During Ransomware

This rule detects esxcli disabling the execInstalledOnly enforcement setting on an ESXi host which ransomware crews do to allow unsigned binaries to run before encrypting virtual machines. Attackers weaken hypervisor integrity controls to deploy their locker at scale.

Malicious Defender Tampering via Registry DisableRealtimeMonitoring

This rule detects reg.exe writing the DisableRealtimeMonitoring or DisableAntiSpyware values to disable Microsoft Defender protections as commonly seen in ransomware pre encryption staging. Attackers turn off real time scanning so their tooling and payloads can run undetected.

Suspicious iptables Port Redirect Rule via GRIMBOLT

This rule detects iptables creating a REDIRECT rule sending traffic from 443 to 10443 as used by UNC6201 GRIMBOLT for single packet authorization gated command and control. Attackers use this redirect to hide a backdoor listener behind a normally trusted port.

Suspicious macOS ClickFix Execution Piping curl to zsh via UNC1069

This rule detects a shell command that downloads content with curl and pipes it directly into zsh as used by UNC1069 macOS ClickFix social engineering. Attackers execute remote script content in memory to install a WebSocket based backdoor without writing the stager to disk.

Suspicious msdt Execution of Audio Diagnostic via UNC1069 ClickFix

This rule detects msdt.exe launching the AudioPlaybackDiagnostic troubleshooter which UNC1069 abuses in ClickFix lures alongside mshta to execute payloads. Attackers use the Microsoft diagnostic tool as a living off the land execution proxy after socially engineering the victim.

Windows Registry: AuthorizedApplications List Enabled Firewall Exceptions

Flags registry updates that enable per-application Microsoft Defender Firewall exceptions via AuthorizedApplications\List.