Sigma detection rules, expert-reviewed

Suspicious AWS IAM Role Creation With Cross-Account Trust Policy

This rule detects an IAM CreateRole event whose assumeRolePolicyDocument establishes a trust relationship that allows another AWS account principal to assume the role. Adversaries create such backdoored roles so an attacker-controlled external account gains persistent access into the victim environment. This is important because cross-account trust relationships are a stealthy persistence mechanism that survives credential rotation.

Possible SES Sending Configuration Enumeration via CloudTrail

This rule detects reconnaissance enumeration of Amazon SES sending configuration through GetAccountSendingEnabled, GetSendQuota, ListIdentities, and GetIdentityVerificationAttributes calls. Adversaries with stolen credentials probe SES quotas and verified identities to determine whether the account can be abused to send spam or phishing. A burst of these read calls from an unexpected principal often precedes SES abuse.

Suspicious AWS Role Assumption via Cognito Web Identity

This rule detects CloudTrail AssumeRoleWithWebIdentity events whose identity provider is cognito-identity.amazonaws.com which the AWS Amplify role takeover technique abuses to assume a victim account authRole or unauthRole from an attacker controlled identity pool for cross account access.

Suspicious System Profiler Hardware Enumeration (via process_creation)

This rule detects system_profiler querying SPHardwareDataType which the Cosmic Leopard macOS implant uses to fingerprint the host and detect virtual or analysis environments. Hardware enumeration is an early discovery step that informs targeting and sandbox evasion decisions.

Suspicious Google Cloud Function Create or Update Triggering Build

This rule detects creation or modification of a Google Cloud Function which automatically triggers a build using the default Cloud Build service account. Talos observed this serverless attack vector where an actor deploys a malicious function to execute attacker code during the build and inherit the over-privileged build service account, so unexpected function writes warrant review as a privilege-escalation foothold.

Possible Telegram API Command and Control DNS Query

This rule detects DNS resolution of api.telegram.org, the endpoint used by YoroTrooper for Telegram-based command-and-control and data exfiltration. Multiple threat actors abuse the Telegram Bot API as a resilient web-service C2 channel. Because legitimate applications also use Telegram, this signal is provided at low confidence and should be correlated with other host activity.

Suspicious Executable Written to User Documents Subfolder (via file_event)

This rule detects an executable being dropped into a subfolder of a user Documents directory, matching BundleBot behaviour of hiding its payload under a randomly named Documents folder. Executables rarely originate here through normal use, so writes of this kind warrant inspection for stealer staging.

Suspicious Connection to Local Zoom Opener Webserver Launch Endpoint (via network_connection)

This rule detects traffic to the local ZoomOpener helper webserver launch endpoint on loopback port 19421. This maps to the Zoom drive-by RCE chain where a webpage sends a crafted launch request to the hidden local server. An attacker leverages this to trigger silent installation and code execution on the victim host.

Possible Network Service Scanning via Nmap or Masscan (via process_creation)

This rule detects execution of network scanners such as nmap, masscan or zmap, a network-service-discovery technique attackers run to map reachable hosts and open ports for lateral movement. Internal scanning is tracked in the Red Canary Threat Detection Report. Detecting scanner execution surfaces reconnaissance from a compromised host.

Possible Clipboard Data Capture via PowerShell (via process_creation)

This rule detects PowerShell reading the clipboard through Get-Clipboard or the Forms Clipboard class, a collection technique used to steal copied passwords, tokens or wallet addresses. Clipboard capture is tracked in the Red Canary Threat Detection Report. Detecting these calls surfaces harvesting of sensitive copied data.

Possible Logged-On Session Discovery via Quser or Qwinsta (via process_creation)

This rule detects quser or qwinsta enumerating interactive logon sessions, a system-owner and remote-session discovery step attackers use to find active administrators before lateral movement. Session discovery is tracked in the Red Canary Threat Detection Report. Detecting these queries surfaces reconnaissance of who is logged on.

Nullsoft Scriptable Installer Script (NSIS) execution

Detects the loading of the NSIS System plugin library, indicative of an NSIS script execution.

Possible DNS Queries to Public Ethereum RPC Endpoints for EtherHiding Payload Retrieval (via dns_query)

This rule detects DNS resolution of public Ethereum RPC provider domains queried by EtherRAT to read its command and control configuration from a smart contract using the EtherHiding technique. Adversaries leverage blockchain RPC endpoints as a resilient dead drop that resists takedown while blending with legitimate crypto traffic, making this a heuristic signal worth reviewing on hosts with no expected blockchain activity.

Suspicious Kubernetes Service Account Token Generation via kubectl

This rule detects the use of kubectl create token to mint a service account token which attackers abuse after compromising an Amazon EKS node to impersonate service accounts and pivot from the Kubernetes cluster into the connected cloud account.

Suspicious Crontab Removal via Command Line (via process_creation)

This rule detects use of crontab with the remove flag to wipe scheduled jobs, a cleanup action performed by the Tox based coinminer to erase competing tasks and its own traces. Clearing the crontab helps the miner evade cleanup and hide indicators of prior activity.