Sigma detection rules, expert-reviewed

Suspicious AWS STS Session Token and Role Chaining Abuse via CloudTrail (via aws)

This rule surfaces AWS STS GetSessionToken and AssumeRole activity that adversaries abuse to mint temporary credentials and chain roles for lateral movement, as detailed in Red Canary's analysis of AWS cloud account abuse. Because these APIs are also used legitimately, alerts should be correlated with the calling identity and source to spot role chaining that escalates access across the environment.

Suspicious Bedrock AgentCore Runtime Invocation on Wildcard Resources (via aws)

This rule detects Bedrock AgentCore code interpreter and agent runtime invocations that, in the Agent God Mode scenario, are abused through wildcard IAM permissions to execute code across agent boundaries. Invocation of these runtimes by unexpected principals can indicate exploitation of excessive privileges for arbitrary execution in the AI environment.

Suspicious npm Credential Scan via whoami and npmrc Access

This rule detects the npm whoami identity check combined with access to the .npmrc credential file, a credential-harvesting step in the Shai Hulud 2.0 worm. The malicious payload queries npm /-/whoami and reads .npmrc to steal publishing tokens for propagating to further packages. Automated npm authentication probing paired with npmrc token access is a strong indicator of supply-chain credential theft.

Possible Path Traversal Local File Inclusion Against Exposed Cloud Function (via webserver)

This rule detects web requests containing directory traversal sequences targeting sensitive Unix files such as etc/passwd, matching the local file inclusion probes sent to exposed Cloud Function endpoints. Adversaries use these payloads to read arbitrary files and enumerate a container before escalating to remote code execution, so traversal attempts against run.app services should be reviewed.

Suspicious TeamViewer Remote Access DNS Resolution (via dns_query)

This rule detects DNS queries to TeamViewer infrastructure subdomains such as master, ping, router, and server nodes under teamviewer.com. Abuse of TeamViewer remote access enabled the Oldsmar water treatment facility intrusion where an operator workstation was manipulated remotely. TeamViewer is dual-use, so this detection is most valuable in ICS and OT segments where remote-access tooling should be absent or tightly controlled.

Suspicious VOLTZITE Single-Character Named ZIP Exfil Staging (via file_event)

This rule detects creation of ZIP archives whose file name is a single letter or digit, a staging convention observed in VOLTZITE intrusions. The group compresses collected data into minimally named archives to blend into disk activity before exfiltration. Detecting these staging files provides an opportunity to interrupt data theft prior to transfer.

Suspicious External IP Lookup to ipify Service (via dns_query)

This rule detects DNS resolution of the ipify external IP-lookup service, which adversaries query at the start of instant-messaging command and control to discover the victim public address. Malware pairs this lookup with sessions to Discord or Telegram APIs to fingerprint the environment before beaconing. The lookup is dual-use, so correlate with unsigned or masquerading binaries for higher confidence.

Suspicious Telegram Bot API Command and Control Communication (via proxy)

This rule detects outbound web requests to the Telegram Bot API endpoint on api.telegram.org that include a bot path, a command and control channel HookSpoofer stealer abuses to exfiltrate stolen data. The stealer posts harvested credentials and files to a hardcoded bot token. Because Telegram is also used legitimately this indicator is low confidence and best correlated with host stealer activity.

Suspicious Shell Password Gathering Referencing System Preferences (via process_creation)

This rule detects a shell command line referencing both system preferences and password, the shell-based credential-gathering pattern Red Canary associated with Atomic Stealer on macOS. This wording is used to coax users into entering their password while impersonating a system settings prompt, so its appearance warrants review for credential theft.

Suspicious Microsoft Teams Installer Masquerade via MC Teams Binary (via process_creation)

This rule detects execution of a binary named MC Teams.exe, the signed malware sample Red Canary documented masquerading as a Microsoft Teams installer while carrying a Neural Code Technologies Inc. signer. The legitimate Teams installer does not use this filename, so its execution suggests a freshly signed masquerading binary abusing code-signing trust.

Suspicious RDP Bitmap Cache Temp Files Written by mstsc in Rogue RDP Campaign (via file_event)

This rule detects mstsc.exe writing _TS prefixed temporary files, the bitmap cache artifacts produced when a victim connects to a rogue RDP server delivering redirected remote applications. Presence of these client cache files corroborates outbound rogue RDP sessions used for data access.

Suspicious External IP Discovery via api.ipify.org

This rule detects DNS resolution of api.ipify.org. Meduza Stealer queries this service to learn the victim external IP address for geofencing before exfiltration. While the service has legitimate uses, resolution originating from non-browser processes can indicate infostealer reconnaissance.

Suspicious LDAP Enumeration of Certificate Templates (via security)

This rule detects LDAP queries enumerating pKICertificateTemplate objects, an AD CS reconnaissance step used to find misconfigured templates vulnerable to certificate-based privilege escalation. This activity commonly precedes malicious certificate requests observed in Security Events 4886 and 4887.

Possible System and File Discovery via System_profiler or Mdfind (via process_creation)

This rule detects system_profiler or mdfind enumerating host details and indexed files, a system-information and file-discovery step attackers use to profile a macOS endpoint after initial access. Host discovery is tracked in the Red Canary Threat Detection Report macOS coverage. Detecting these queries surfaces reconnaissance of the system.

Possible Telegram Bot API Command and Control Channel

This rule detects DNS resolution of the Telegram bot API host api.telegram.org. QwixxRAT and similar stealers abuse the Telegram Bot API as a command-and-control and exfiltration channel to receive commands and upload stolen data. Because legitimate Telegram clients also resolve this host this signal should be correlated with unexpected processes making the query.