Sigma detection rules, expert-reviewed

Possible Telegram API Command and Control DNS Query

This rule detects DNS resolution of api.telegram.org, the endpoint used by YoroTrooper for Telegram-based command-and-control and data exfiltration. Multiple threat actors abuse the Telegram Bot API as a resilient web-service C2 channel. Because legitimate applications also use Telegram, this signal is provided at low confidence and should be correlated with other host activity.

Suspicious Executable Written to User Documents Subfolder (via file_event)

This rule detects an executable being dropped into a subfolder of a user Documents directory, matching BundleBot behaviour of hiding its payload under a randomly named Documents folder. Executables rarely originate here through normal use, so writes of this kind warrant inspection for stealer staging.

Suspicious Connection to Local Zoom Opener Webserver Launch Endpoint (via network_connection)

This rule detects traffic to the local ZoomOpener helper webserver launch endpoint on loopback port 19421. This maps to the Zoom drive-by RCE chain where a webpage sends a crafted launch request to the hidden local server. An attacker leverages this to trigger silent installation and code execution on the victim host.

Possible Network Service Scanning via Nmap or Masscan (via process_creation)

This rule detects execution of network scanners such as nmap, masscan or zmap, a network-service-discovery technique attackers run to map reachable hosts and open ports for lateral movement. Internal scanning is tracked in the Red Canary Threat Detection Report. Detecting scanner execution surfaces reconnaissance from a compromised host.

Possible Clipboard Data Capture via PowerShell (via process_creation)

This rule detects PowerShell reading the clipboard through Get-Clipboard or the Forms Clipboard class, a collection technique used to steal copied passwords, tokens or wallet addresses. Clipboard capture is tracked in the Red Canary Threat Detection Report. Detecting these calls surfaces harvesting of sensitive copied data.

Possible Logged-On Session Discovery via Quser or Qwinsta (via process_creation)

This rule detects quser or qwinsta enumerating interactive logon sessions, a system-owner and remote-session discovery step attackers use to find active administrators before lateral movement. Session discovery is tracked in the Red Canary Threat Detection Report. Detecting these queries surfaces reconnaissance of who is logged on.

Nullsoft Scriptable Installer Script (NSIS) execution

Detects the loading of the NSIS System plugin library, indicative of an NSIS script execution.

Possible DNS Queries to Public Ethereum RPC Endpoints for EtherHiding Payload Retrieval (via dns_query)

This rule detects DNS resolution of public Ethereum RPC provider domains queried by EtherRAT to read its command and control configuration from a smart contract using the EtherHiding technique. Adversaries leverage blockchain RPC endpoints as a resilient dead drop that resists takedown while blending with legitimate crypto traffic, making this a heuristic signal worth reviewing on hosts with no expected blockchain activity.

Suspicious Kubernetes Service Account Token Generation via kubectl

This rule detects the use of kubectl create token to mint a service account token which attackers abuse after compromising an Amazon EKS node to impersonate service accounts and pivot from the Kubernetes cluster into the connected cloud account.

Suspicious Crontab Removal via Command Line (via process_creation)

This rule detects use of crontab with the remove flag to wipe scheduled jobs, a cleanup action performed by the Tox based coinminer to erase competing tasks and its own traces. Clearing the crontab helps the miner evade cleanup and hide indicators of prior activity.

Suspicious macOS SSH Loopback Connection for TCC Bypass

This rule detects an SSH client connecting to the local loopback address on macOS. It maps to a technique where an attacker uses ssh to localhost so the spawned session inherits full disk access granted to the SSH daemon, bypassing the TCC privacy prompt. Detecting loopback SSH can surface abuse of remote services for privacy control evasion.

Suspicious GAM OAuth Token Enumeration via Process Creation

This rule detects use of the GAM command line tool to print or delete OAuth tokens across a Google Workspace tenant, activity observed both during attacker reconnaissance of consented apps and legitimate administrative cleanup. Because token enumeration reveals which third-party apps hold access, unexpected GAM token operations outside change windows can indicate an attacker mapping or pruning OAuth grants.

Suspicious Sneaky 2FA Phishing Kit License Check via API Key Endpoint (via proxy)

This rule detects HTTP requests to the sneakylog license verification endpoint used by the Sneaky 2FA Phishing-as-a-Service platform. Each deployed phishing kit calls the api key path on the operator infrastructure to validate its license before serving the AiTM page. Observing this callback identifies hosts interacting with the Sneaky 2FA kit infrastructure.

Suspicious Python or uv Execution Spawned by AI CLI Assistant

This rule detects the python or uv interpreter launched as a child of an AI command line assistant such as the Claude or Gemini CLI which reflects adversaries directing these agents to run local code during hands on abuse. Because AI CLI tools can execute arbitrary commands on behalf of a user they can be steered into running attacker supplied scripts. Detecting unexpected interpreter children of AI assistants supports hunting for this emerging abuse.

Suspicious AWS SSO Account Role Enumeration via ListAccountRoles (via cloudtrail)

This rule detects the AWS SSO ListAccountRoles call, the reconnaissance step Red Canary noted adversaries performing after obtaining a cached SSO access token to enumerate assignable roles. A burst of ListAccountRoles from an unfamiliar source can indicate an actor mapping available roles before assuming credentials.