Sigma detection rules, expert-reviewed

Suspicious Bapak AWS EC2 ImportKeyPair With Known Attacker Key Names via CloudTrail

This rule detects EC2 ImportKeyPair CloudTrail events that use SSH key names hardcoded by the Bapak cloud threat actor. It surfaces the actor planting persistent SSH access after credential compromise, and it matters because attacker controlled key material grants durable instance access.

Suspicious AWS IoT Credential Issuance via AssumeRoleWithCertificate

This rule detects the AWS IoT credentials provider AssumeRoleWithCertificate operation which exchanges an X.509 device certificate for temporary IAM role credentials. Wiz documents this as one of the less common ways to obtain credentials in AWS. This is important because this credential path is rarely used outside dedicated IoT fleets so its appearance can indicate an attacker abusing a stolen device certificate to mint role credentials and gain access.

Malicious AWS IAM User Creation With Known Threat Actor Names

This rule detects creation of IAM users with the persistence names ses_xcatze or AdminsDDefault which Wiz attributes to cloud-fluent threat actors establishing backdoor privileged identities. This is important because these are attacker-chosen usernames disguised to blend in with legitimate accounts and their creation indicates an adversary is building durable access into the AWS account.

Suspicious AWS API Activity From WinSCP Client User-Agent

This rule detects CloudTrail events whose user agent identifies the WinSCP transfer client which Wiz associates with cloud-fluent threat actors staging and exfiltrating data from S3 after obtaining credentials. This is important because WinSCP is an interactive file transfer tool that is unusual for automated cloud workloads and its presence signals hands-on-keyboard misuse of stolen access.

Suspicious AWS API Activity From S3 Browser Client User-Agent

This rule detects CloudTrail events whose user agent identifies the S3 Browser desktop client which Wiz ties to cloud-fluent threat actors performing enumeration and object deletion after credential theft. This is important because production workloads rarely use the S3 Browser GUI so its appearance in CloudTrail is a reliable indicator that stolen keys are being operated from an attacker workstation.

Suspicious AWS EC2 Instance Role Cloud Infrastructure Discovery

This rule detects an assumed EC2 instance IAM role enumerating EC2 instances and security groups through the DescribeInstances and DescribeSecurityGroups APIs. In the Wiz Kubernetes privilege escalation case study an attacker who reached the Instance Metadata Service from a compromised EKS pod used the stolen instance role to perform cloud infrastructure reconnaissance. This is important because such discovery from a workload role that normally does not enumerate infrastructure is an early sign of a stolen credential being abused for lateral movement.

Suspicious EKS Access Entry Creation via CloudTrail

This rule detects CloudTrail CreateAccessEntry events on the EKS service. Wiz Research showed that creating an access entry for an attacker controlled IAM principal is a new persistence and privilege vector into a cluster, so access entry creation outside of change management should be investigated.

Possible SMB Share C2 Beacon via Lock File Polling

This rule detects repeated access to lock extension files on a network share which matches the C3 UNC file share command and control channel described in the WithSecure lab where randomized lock files were written and polled on a roughly ten second interval. Command and control routed over an internal SMB share evades outbound network controls so lock file access patterns on shares are worth surfacing for triage.

Suspicious OneNote Embedded File Open Warning Disabled via Registry

This rule detects modification of the OneNote EmbeddedFileOpenWarningDisabled registry value to suppress the security prompt shown when opening embedded attachments. Attackers set this value so that weaponised OneNote documents execute embedded payloads without a warning, making this change a defense evasion step that enables silent user execution.

Malicious WDigest UseLogonCredential Cleartext Credential Enablement

This rule detects the WDigest UseLogonCredential value being set to one, which forces Windows to keep cleartext credentials in memory. In the WithSecure Catching Lazarus Part Two research the actor enables this before running Mimikatz to recover plaintext passwords from lsass. Attackers flip this setting to make credential theft trivial on modern Windows.

Malicious Security Support Provider Persistence via LSA Security Packages

This rule detects modification of the LSA Security Packages value to register a rogue Security Support Provider such as the lssc entry used by Lazarus. In the WithSecure Catching Lazarus research a malicious LSCC.dll is dropped into System32 and added as an SSP so it loads into lsass at boot. Attackers use SSP persistence to survive reboot and to capture credentials from the LSA process.

Possible PowerShell Empire Default C2 URI Beaconing

This rule detects HTTP requests to the default request URIs used by the PowerShell Empire C2 framework. In the WithSecure C2 and Exfiltration Lab 1 an Empire agent beacons to server paths such as /admin/get.php and /login/process.php while impersonating a Microsoft-IIS server. Attackers use these hardcoded default routes for command retrieval and result submission over HTTP.

Suspicious OneNote Spawning LOLBin from Exported Attachment Directory

This rule detects Microsoft OneNote spawning script interpreters or living-off-the-land binaries such as cmd.exe powershell.exe wscript.exe or mshta.exe, which occurs when a user opens a weaponised embedded attachment. OneNote phishing lures drop payloads under the Temp OneNote Exported folder and launch them via these LOLBins, making the parent-child relationship a reliable indicator of initial execution.

Malicious CrazyHunter Ransomware Toolkit Execution from Public Directory

This rule detects execution of CrazyHunter ransomware toolkit binaries such as go.exe go2.exe go3.exe and bb.exe from the C:\Users\Public directory, typically chained together by a ru.bat launcher script. These renamed tools stage encryption and defense evasion during a CrazyHunter intrusion, and running such binaries from a world-writable path is a strong indicator of hands-on-keyboard ransomware deployment.

Suspicious osascript Executing JavaScript Payload from Office Container

This rule detects osascript executing a JavaScript for Automation file from the Microsoft Word sandbox container which is the second stage payload execution described in the WithSecure macOS lab where a dropped app.js was run under osascript. Running attacker delivered JavaScript through osascript out of an Office container is a strong indicator of macOS initial access tooling such as a Mythic apfell agent.