Sigma detection rules, expert-reviewed

Possible GammaSteel C2 Using Spoofed iPhone User Agent

This rule detects outbound web traffic presenting an iPhone OS 18_0 user agent from an endpoint. Gamaredon GammaSteel beacons to its command server with this mobile user agent to blend in with normal traffic. Mobile browser user agents originating from a Windows workstation proxy are anomalous and merit review.

Suspicious Firewall Flush via iptables in Kinsing Intrusion

This rule detects iptables being run with the flush flag to clear all firewall rules. Kinsing flushes iptables to remove competing miner blocks and to keep its own C2 and mining traffic unimpeded, an impair-defenses action that can also occur during legitimate administration.

Possible Trojanised Python Native Extension Load of gradient Module

This rule detects a Python process loading a gradient native extension module which was used to deliver a Python RAT to vulnerability researchers. The ChocoPoCs campaign ships trojanised packages whose native gradient extension executes attacker code on import. Because the module name is generic this pattern needs corroboration from the surrounding package before it is treated as malicious.

Possible python311 DLL Side-Loading by Non Python Host Process

This rule detects a process that is not a Python interpreter loading python311.dll which can indicate DLL side-loading. Silver Fox side-loads a malicious python311.dll alongside a decoy executable to run ValleyRAT shellcode. Because many legitimate applications embed Python this pattern requires context before it can be confirmed as malicious.

Possible Remote Monitoring and Management Tool Abuse for Remote Access

This rule detects execution of remote monitoring and management tools including AnyDesk TeamViewer and NetSupport client32 that adversaries such as Storm-1811 abuse to gain hands on keyboard access after social engineering. These tools are legitimate but are frequently deployed by intruders to maintain interactive control of victim hosts. Detecting their execution supports baselining and hunting for unsanctioned remote access.

Suspicious Azure OpenAI Model Enumeration and Deployment Creation (via azure)

This rule detects the Azure OpenAI Models_List and Deployments_Create operations that Red Canary described adversaries using to enumerate available models and stand up new deployments after obtaining access to a resource. Reconnaissance of models followed by deployment creation can indicate an actor preparing to abuse a victim Azure OpenAI service for inference at the owner expense.

Suspicious Entra ID Application Consent Failure Indicating Unauthorized OAuth Grant Attempt (via azure)

This rule detects Entra ID sign-in failures carrying error codes 65001 and 90095 which represent an unapproved application consent attempt and a denied admin-consent request. Red Canary observed adversaries triggering these consent errors while trying to authorize rogue OAuth applications for mailbox access in business email compromise schemes, so a cluster of these failures can reveal an in-progress service principal abuse attempt.

Suspicious RunOnce Persistence Pointing to User AppData

This rule detects a RunOnce registry value whose payload path resides in the user AppData directory. The DarkCloud stealer establishes persistence through HKCU RunOnce entries referencing its dropped AutoIt-compiled executable. A RunOnce value launching a binary from a user-writable location is a common malware persistence pattern.

Possible Lampion C2 Beacon With dados Parameter

This rule detects outbound HTTP GET requests carrying a dados URL parameter used by the Lampion malware for command-and-control tasking and data transfer. The malware appends stolen or beacon data to this parameter when contacting its infrastructure. Monitoring this structured request pattern helps surface active Lampion C2 traffic.

Suspicious Advanced IP Scanner Execution for Network Discovery

This rule detects execution of Advanced IP Scanner, a dual-use network mapping tool frequently staged by ransomware crews to enumerate reachable hosts before lateral movement. The Gentlemen ransomware operators run it during the discovery phase of their intrusions. Detecting it in unexpected contexts can reveal pre-encryption reconnaissance.

Suspicious Cryptocurrency Wallet File Access by Stealer (via process_creation)

This rule detects command-line access to wallet.dat files, targeted by Gremlin Stealer to harvest cryptocurrency wallet data alongside browser cookies and credentials. Collecting wallet.dat is a common stealer behavior aimed at draining victim crypto assets after exfiltration.

Suspicious Kubernetes Enumeration via kubectl in Cloud Compromise

This rule detects cluster-wide pod enumeration via kubectl across all namespaces from a node or workload context. This behavior matches the ModeLeak reconnaissance phase where a compromised Vertex AI custom job used service agent credentials to map cluster resources. Broad cross-namespace enumeration from non-administrative contexts often precedes privilege escalation and lateral access to model artifacts.

Suspicious Outbound Connection to TuxBot Botnet C2 Ports

This rule detects an outbound network connection to destination port 1999 or 31337, the fixed command-and-control ports used by the TuxBot v3 IoT botnet framework. These ports carry the botnet magic-byte protocol that tasks infected devices. Detecting connections to them surfaces likely bot check-in traffic worth investigating.

Suspicious MQTT Command and Control Connection by WikiLoader

This rule detects outbound network connections to MQTT broker ports used by a unique WikiLoader variant for command and control after a spoofed GlobalProtect infection. Repurposing the MQTT messaging protocol provides a resilient channel that many defenses do not inspect. Detecting connections on these ports from endpoints exposes potential WikiLoader beaconing.

Possible Rogue Device Registration in Entra ID (via azure)

This rule detects Entra ID device registration and join events that adversaries abuse to plant attacker-controlled devices for Primary Refresh Token acquisition. Unit 42 observed this technique with ROADtools during nation-state cloud intrusions to establish durable identity-based access.