Sigma detection rules, expert-reviewed

Suspicious Long Alphanumeric DNS Subdomain Indicative of DNS Tunneling

This rule detects DNS queries whose leftmost label is an unusually long fixed-width alphanumeric string, matching the 28 to 31 character encoded subdomains used by the Saitama DNS implant to smuggle command-and-control data. Such high-entropy labels are a hallmark of DNS tunneling and warrant review of the querying host for a covert C2 channel.

Suspicious External IP Discovery via Curl to Ipinfo

This rule detects curl querying ipinfo.io to learn the host external IP address, a reconnaissance step attackers use to geolocate and fingerprint a compromised environment. This was observed in a hands-on-keyboard operation. External IP lookups from servers or non-admin contexts can indicate attacker situational awareness.

Suspicious Chafer Backdoor HTTP C2 Communication via Proxy

This rule detects HTTP requests to the comm.aspx endpoint used by the Chafer backdoor for command-and-control communication. Observed in NCC Group research analyzing the Chafer backdoor beaconing to comm.aspx over HTTP. Identifying this request path helps detect infected hosts contacting Chafer C2 infrastructure.

Suspicious Registry Run Key Modification For Persistence

This rule detects new or modified values under the Windows Run and RunOnce autostart keys observed through registry set telemetry. In the WithSecure Code Execution and Persistence Lab 2 payload paths are written to these keys to launch at logon. Attackers use autostart registry persistence to maintain access across reboots.

Suspicious Mail Send via Microsoft Graph by Application Identity via M365 Audit

This rule detects mail sent through the Microsoft Graph sendMail action by an application or agent identity, the delivery step an attacker uses after hijacking an Entra assistive agent to send internal spearphishing. Because agents that gain send-mail access can distribute malicious links from a trusted internal identity, Graph-driven mail sends attributed to service principals should be reviewed against recent consent grants.

Uncommon Network Share Discovery via Net View (via process_creation)

This rule detects use of net view to enumerate remote hosts and their shared folders, a discovery step adversaries run to map reachable systems and data before lateral movement and collection. Network share discovery supports the hands-on-keyboard reconnaissance profiled in the Red Canary Threat Detection Report. Because interactive share enumeration across hosts is uncommon on typical endpoints, it is a useful indicator of an operator orienting inside the network.

Suspicious Metabase Setup Token Disclosure via Session Properties Endpoint (CVE-2023-38646) (via webserver)

This rule detects requests to the unauthenticated Metabase session properties endpoint that leaks the setup token. This maps to the reconnaissance stage of CVE-2023-38646 where the token is harvested to enable the H2 JDBC injection. Repeated or external access to this endpoint may indicate an attacker preparing pre-auth code execution.

Suspicious Python Execution Spawned from Batch and Script Chain

This rule detects python.exe launched by a command interpreter that was itself started from a batch or PowerShell parent, matching the BAT to PowerShell to CMD to python execution tree of the Snake Python infostealer. Attackers use this chained launcher to unpack and run the Python stealer while blending into scripted activity. The interpreter-to-python lineage highlights the malware execution flow.

Suspicious MOTD Or Git Hook Script Creation For Linux Persistence

This rule detects creation of executable scripts in the dynamic message-of-the-day directory or a git hooks directory which are persistence locations abused to run attacker code on login or developer workflow events. Adversaries drop scripts into update-motd.d or git hooks so their payload executes automatically with the privileges of the triggering process.

Suspicious macOS Hardware Fingerprinting via ioreg IOPlatformUUID (via process_creation)

This rule detects use of ioreg to read the IOPlatformExpertDevice and IOPlatformUUID hardware identifiers, a host-fingerprinting step performed by the FlutterShell backdoor. The unique UUID is used to track infected macOS hosts and tailor follow-on backdoor commands.

Nullsoft Scriptable Installer Script (NSIS) file creation

Detects the creation of the NSIS System plugin library, indicative of an NSIS script execution.

Possible PowerShell Empire Default User-Agent In HTTP Traffic

This rule detects outbound HTTP traffic carrying the default user-agent string shipped with the PowerShell Empire C2 framework. In the WithSecure C2 and Exfiltration Lab 1 the Empire agent beacons out with an unmodified Mozilla compatible MSIE user-agent that is characteristic of the framework default profile. Attackers rely on this static header for their staging and command channel unless an operator customizes it.

Suspicious Cron Persistence File Created in System Cron Directories

This rule detects creation of a file named 0anacron inside the system cron directories which the DripDropper Linux malware uses to masquerade as a trusted periodic job and establish scheduled task persistence. Placing a script among legitimate cron jobs lets the malware re execute and survive reboots. Detecting this file write surfaces persistence establishment on compromised Linux hosts.

Azure Entra ID Sign-ins with User-Agent Containing "axios"

Flags Azure Entra ID sign-ins with a user agent containing "axios", indicating potential automated sign-in activity.

Proxy requests to EvilTokens PhaaS phishing domains (Cloudflare Workers, Railway.app)

Alerts on proxy requests to Cloudflare Workers or Railway.app URLs associated with EvilTokens phishing PhaaS kit infrastructure.