Sigma detection rules, expert-reviewed

Suspicious RDP Bitmap Cache Temp Files Written by mstsc in Rogue RDP Campaign (via file_event)

This rule detects mstsc.exe writing _TS prefixed temporary files, the bitmap cache artifacts produced when a victim connects to a rogue RDP server delivering redirected remote applications. Presence of these client cache files corroborates outbound rogue RDP sessions used for data access.

Suspicious External IP Discovery via api.ipify.org

This rule detects DNS resolution of api.ipify.org. Meduza Stealer queries this service to learn the victim external IP address for geofencing before exfiltration. While the service has legitimate uses, resolution originating from non-browser processes can indicate infostealer reconnaissance.

Suspicious LDAP Enumeration of Certificate Templates (via security)

This rule detects LDAP queries enumerating pKICertificateTemplate objects, an AD CS reconnaissance step used to find misconfigured templates vulnerable to certificate-based privilege escalation. This activity commonly precedes malicious certificate requests observed in Security Events 4886 and 4887.

Possible System and File Discovery via System_profiler or Mdfind (via process_creation)

This rule detects system_profiler or mdfind enumerating host details and indexed files, a system-information and file-discovery step attackers use to profile a macOS endpoint after initial access. Host discovery is tracked in the Red Canary Threat Detection Report macOS coverage. Detecting these queries surfaces reconnaissance of the system.

Possible Telegram Bot API Command and Control Channel

This rule detects DNS resolution of the Telegram bot API host api.telegram.org. QwixxRAT and similar stealers abuse the Telegram Bot API as a command-and-control and exfiltration channel to receive commands and upload stolen data. Because legitimate Telegram clients also resolve this host this signal should be correlated with unexpected processes making the query.

Suspicious Long Alphanumeric DNS Subdomain Indicative of DNS Tunneling

This rule detects DNS queries whose leftmost label is an unusually long fixed-width alphanumeric string, matching the 28 to 31 character encoded subdomains used by the Saitama DNS implant to smuggle command-and-control data. Such high-entropy labels are a hallmark of DNS tunneling and warrant review of the querying host for a covert C2 channel.

Suspicious External IP Discovery via Curl to Ipinfo

This rule detects curl querying ipinfo.io to learn the host external IP address, a reconnaissance step attackers use to geolocate and fingerprint a compromised environment. This was observed in a hands-on-keyboard operation. External IP lookups from servers or non-admin contexts can indicate attacker situational awareness.

Suspicious Chafer Backdoor HTTP C2 Communication via Proxy

This rule detects HTTP requests to the comm.aspx endpoint used by the Chafer backdoor for command-and-control communication. Observed in NCC Group research analyzing the Chafer backdoor beaconing to comm.aspx over HTTP. Identifying this request path helps detect infected hosts contacting Chafer C2 infrastructure.

Suspicious Registry Run Key Modification For Persistence

This rule detects new or modified values under the Windows Run and RunOnce autostart keys observed through registry set telemetry. In the WithSecure Code Execution and Persistence Lab 2 payload paths are written to these keys to launch at logon. Attackers use autostart registry persistence to maintain access across reboots.

Suspicious Mail Send via Microsoft Graph by Application Identity via M365 Audit

This rule detects mail sent through the Microsoft Graph sendMail action by an application or agent identity, the delivery step an attacker uses after hijacking an Entra assistive agent to send internal spearphishing. Because agents that gain send-mail access can distribute malicious links from a trusted internal identity, Graph-driven mail sends attributed to service principals should be reviewed against recent consent grants.

Uncommon Network Share Discovery via Net View (via process_creation)

This rule detects use of net view to enumerate remote hosts and their shared folders, a discovery step adversaries run to map reachable systems and data before lateral movement and collection. Network share discovery supports the hands-on-keyboard reconnaissance profiled in the Red Canary Threat Detection Report. Because interactive share enumeration across hosts is uncommon on typical endpoints, it is a useful indicator of an operator orienting inside the network.

Suspicious Metabase Setup Token Disclosure via Session Properties Endpoint (CVE-2023-38646) (via webserver)

This rule detects requests to the unauthenticated Metabase session properties endpoint that leaks the setup token. This maps to the reconnaissance stage of CVE-2023-38646 where the token is harvested to enable the H2 JDBC injection. Repeated or external access to this endpoint may indicate an attacker preparing pre-auth code execution.

Suspicious Python Execution Spawned from Batch and Script Chain

This rule detects python.exe launched by a command interpreter that was itself started from a batch or PowerShell parent, matching the BAT to PowerShell to CMD to python execution tree of the Snake Python infostealer. Attackers use this chained launcher to unpack and run the Python stealer while blending into scripted activity. The interpreter-to-python lineage highlights the malware execution flow.

Suspicious MOTD Or Git Hook Script Creation For Linux Persistence

This rule detects creation of executable scripts in the dynamic message-of-the-day directory or a git hooks directory which are persistence locations abused to run attacker code on login or developer workflow events. Adversaries drop scripts into update-motd.d or git hooks so their payload executes automatically with the privileges of the triggering process.

Suspicious macOS Hardware Fingerprinting via ioreg IOPlatformUUID (via process_creation)

This rule detects use of ioreg to read the IOPlatformExpertDevice and IOPlatformUUID hardware identifiers, a host-fingerprinting step performed by the FlutterShell backdoor. The unique UUID is used to track infected macOS hosts and tailor follow-on backdoor commands.