Sigma detection rules, expert-reviewed

Malicious Axios Supply Chain C2 Beacon Domain (via dns_query)

This rule detects DNS lookups for sfrclak.com, the command and control domain contacted with a POST beacon roughly every 60 seconds by the payload deployed in the Axios supply chain attack. Resolution of this hardcoded C2 domain indicates an active beaconing implant on the host.

Malicious DAEMON Tools Supply Chain Payload Download via PowerShell WebClient (via process_creation)

This rule detects PowerShell using a WebClient DownloadFile call to stage a payload into the Windows Temp directory, an action tied to the DAEMON Tools supply chain compromise. The download retrieves second stage backdoor components after a trojanized installer runs. Detecting the download to Temp surfaces the payload staging step of the intrusion.

Malicious axios NPM Supply Chain Persistence via MicrosoftUpdate Run Key

This rule detects creation of a Run key value named MicrosoftUpdate under the Windows CurrentVersion Run path, a persistence mechanism dropped by the trojanized axios npm packages through their postinstall setup.js script. The masquerading value name mimics a legitimate Microsoft update task while pointing to attacker second-stage code that beacons to sfrclak.com. Detecting this key is important because it establishes reboot-persistent execution of supply-chain malware on developer hosts.

Malicious axios NPM Supply Chain C2 Domain Resolution

This rule detects DNS resolution of sfrclak.com, the command-and-control domain contacted by the trojanized axios and plain-crypto-js npm packages after their postinstall scripts execute. The malware sends base64-encoded JSON beacons over HTTP to this host roughly every 60 seconds to fetch second-stage per-OS payloads. Detecting the lookup is important because it surfaces build and developer machines compromised through the npm supply chain.

Suspicious Double Base64 Decoded Payload Piped to Shell in CI (reviewdog Supply Chain)

This rule detects a base64 decoded payload being piped directly into a shell, the execution pattern of the injected reviewdog/action-setup install.sh that dumped CI runner memory. It matters because decode into shell in a build step is a common way supply chain payloads execute credential theft code without touching disk.

Malicious PyPI Package Installation from Gleaming Pisces Supply Chain (via process_creation)

This rule detects installation of the malicious PyPI packages real-ids, coloredtxt, beautifultext, or minisound published by Gleaming Pisces to deliver the PondRAT backdoor. Installing these poisoned packages compromises developer and build systems through the software supply chain.

Suspicious Child Process Spawned by 3CXDesktopApp via Supply Chain Compromise

This rule detects the 3CXDesktopApp.exe process spawning a command interpreter such as cmd.exe or powershell.exe. During the 3CX supply chain compromise the trojanized client executed follow-on commands to profile the host and retrieve second-stage payloads after sideloading a malicious ffmpeg.dll. The VoIP client has no legitimate reason to launch shells.

Malicious Bun Runtime Payload Dropped by Shai Hulud npm Supply Chain Attack

This rule detects creation of the setup_bun.js or bun_environment.js files associated with the Shai Hulud 2.0 npm supply-chain worm. A malicious preinstall script drops setup_bun.js which installs the Bun runtime and stages the large bun_environment.js payload for credential theft and self-propagation. These distinctive filenames written during package installation indicate the worm establishing execution.

Possible CI Runner Memory Scraping via Python Process Memory Read (tj-actions Supply Chain)

This rule detects a Python interpreter reading another process memory through /proc maps and mem, the technique the compromised tj-actions/changed-files GitHub Action used to dump CI runner memory. It is important because this behavior harvests secrets and tokens from the runner and leaks them into build logs.