Sigma detection rules, expert-reviewed

Suspicious PIKABOT Command and Control Connection on Non-Standard Ports via Network Connection

This rule detects outbound connections to the uncommon high ports 2967 2223 and 5938 that PIKABOT uses for its HTTPS command and control while spoofing an Outlook user agent. These ports are atypical for normal web traffic so outbound sessions to them warrant review though some remote access software may reuse similar ranges.

Suspicious Outbound Connection to InvisibleFerret C2 Ports 1224 and 1245

This rule detects outbound TCP connections to the uncommon ports 1224 and 1245 used by the InvisibleFerret and BeaverTail command and control servers in the North Korean job-hunter campaigns per Unit 42. These fixed high ports carry the actor heartbeat and tasking traffic which is rare for legitimate applications and flags an infected host.

Suspicious HTTP POST to Local AI Malware Exfil Endpoint (via proxy)

This rule detects HTTP POST requests to the /crypto-data endpoint used by AI-assisted malware to transmit collected cryptocurrency and victim data. The specific exfiltration path combined with the POST method reflects the malware sending stolen data to its collection service.

Possible Stolen AWS Credential Validation via STS GetCallerIdentity

This rule detects AWS STS GetCallerIdentity calls which the Hugging Face breach actor issued to validate stolen cloud credentials after harvesting secrets from a compromised AI agent environment. Identity self-checks are a common first move once keys are obtained. Because legitimate automation also calls this API, baseline expected principals and alert on unfamiliar or first-seen callers.

Suspicious Exposed Ollama API Service Connection

This rule detects network connections to the default Ollama LLM service port, exposure that attackers abuse to hijack local AI inference in the evolved LLMjacking campaign. An internet-reachable Ollama endpoint allows unauthenticated model access and resource theft. Connections from untrusted sources to this port warrant review of the exposed service.

Possible Andariel Keylogger Output Archive Staged in Temp (via file_event)

This rule detects creation of the password-protected keylog archive and its embedded log file staged in the Temp directory by a keylogger attributed to the North Korean group Andariel. Adversaries write captured keystrokes and clipboard data to a compressed archive on disk before exfiltration, so these named artifacts indicate active credential capture.

Possible Access-Code Validation Beacon to Malware Delivery C2 (via proxy)

This rule detects HTTP requests to an /api/submit endpoint carrying a code parameter, the access-code validation call made by a DocuSign-themed loader before it retrieves its second stage in a Vidar delivery chain analyzed by Joe Sandbox. Adversaries gate payload delivery behind server-side code validation to evade sandboxes and analysts, so this submit-with-code request pattern surfaces the loader contacting its delivery infrastructure.

Possible n8n Campaign Datto RMM Relay Contact via centrastage.net

This rule detects DNS resolution of centrastage.net infrastructure associated with Datto RMM, which the n8n webhook campaign abuses as a remote management relay to control victim hosts. Because the domain also serves legitimate Datto RMM deployments, contact from an environment that does not sanction Datto is the meaningful signal. Correlate with unexpected RMM installers to confirm abuse.

Suspicious Go HTTP Client User Agent via Proxy

This rule detects outbound web requests carrying the default Go HTTP client user agent, which Peach Sandstorm used from Azure infrastructure during password spray attacks against target tenants. The user agent is a weak but useful signal that can highlight automated credential-guessing traffic when correlated with failed authentication.

Suspicious Oversized Numeric X-Forwarded-For Header Targeting Ivanti Connect Secure (via proxy)

This rule detects the network signature of Ivanti Connect Secure CVE-2025-22457 where an extremely long X-Forwarded-For header consisting only of digits and periods is used to overflow a stack buffer in the web process. Legitimate proxy chains do not produce headers of this length.

Suspicious Remote Script Download Piped to Shell via 8220 Gang Hadooken

This rule detects a curl or wget download whose output is piped directly into a shell interpreter, the download and execute pattern the 8220 gang schedules through cron every few minutes in the Hadooken campaign to pull and run its loader. Piping remote content into a shell removes any on disk staging and is a common Linux malware behavior. It is rarely required by legitimate automation.

Suspicious Workday Payment Election Change via Compromised Account (via workday)

This rule surfaces Workday audit events where an account modifies payment elections or core account details. This activity matches payroll pirate operations in which attackers who phished university credentials register their own MFA device and reroute direct deposit to attacker-controlled bank accounts. Correlating payment element changes with recent device enrollment helps surface payroll fraud before funds are lost.

Suspicious FinCounter DNS Tunneling Query via dns_query

This rule detects DNS queries whose leftmost label begins with the counter prefix used by the FinCounter DNS tunneling toolkit. Unit 42 catalogued this fixed prefix as a distinctive encoding marker of FinCounter command-and-control over DNS, so repeated queries of this shape from a host suggest a covert DNS tunnel.

Suspicious node.exe Inline Script Execution via -e

This rule detects node.exe executing an inline script through the -e flag, the stager execution method in the DEV#POPPER GitHub-lure infection. Victims who cloned the weaponized repository ran a hidden script that used node -e to bootstrap the RAT. While developers occasionally use node -e, inline Node execution from a cloned project should be reviewed for malicious staging.

Suspicious AWS Long-Term Access Key Creation for Persistence via CloudTrail (via aws)

This rule detects the creation of a long-term IAM access key, which adversaries generate as a backup AKIA credential to maintain persistent access to a compromised AWS account per Red Canary. Key creation for a user other than the caller, or immediately following STS token abuse, is a strong indicator that an attacker is establishing durable persistence.