Browse Rules

Attempt to Unload Elastic Endpoint Security Kernel Extension

Identifies attempts to unload the Elastic Endpoint Security kernel extension via the kextunload command.

Unusual Network Connection to Suspicious Top Level Domain

This rule monitors for the unusual occurrence of outbound network connections to suspicious top level domains.

DNS Request to Suspicious Top Level Domain

This rule detects DNS queries to commonly abused top level domains. Malware authors may use these domains to host command and control infrastructure, exfiltrate data, or to download payloads for later execution.

Shell Execution via Elastic Endpoint

This rule detects shell executions via Elastic Endpoint. Elastic Endpoint has a built-in response action console that can be used to execute shell commands on compromised systems.

Potential Kubeletctl Execution

Detects the execution of kubeletctl on Linux hosts. Kubeletctl is a command-line tool that can be used to interact with the Kubelet API directly, simplifying access to Kubelet endpoints that can be used for discovery and, in some cases, lateral movement within Kubernetes environments.

Machine Learning Detected DGA activity using a known SUNBURST DNS domain

A supervised machine learning model has identified a DNS question name that used by the SUNBURST malware and is predicted to be the result of a Domain Generation Algorithm.

Unusual Network Connection to Suspicious Web Service

This rule monitors for the unusual occurrence of outbound network connections to suspicious webservice domains.

microsoft_binary_suspicious_communication_endpoint

Detects an executable in the Windows folder accessing suspicious domains License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md.

Machine Learning Detected a DNS Request Predicted to be a DGA Domain

A supervised machine learning model has identified a DNS question name that is predicted to be the result of a Domain Generation Algorithm (DGA), which could indicate command and control network activity.

Suspicious Curl to Google App Script Endpoint

Detects the use of curl to a Google Script endpoint for the purpose of downloading a second stage payload or tool. Threat actors utilize exposed Google Script endpoints to host payloads as Google URLs are generally whitelisted and bypass security controls.

Suspicious Curl to Jamf Endpoint

Detects curl requests to JAMF Pro endpoints from suspicious processes like unsigned binaries or scripting interpreters. This indicates potential abuse of stolen JAMF credentials for lateral movement in enterprise macOS environments.

Creation or Modification of Domain Backup DPAPI private key

Identifies the creation or modification of Domain Backup private keys. Adversaries may extract the Data Protection API (DPAPI) domain backup key from a Domain Controller (DC) to be able to decrypt any domain user master key file.

Potential Evasion via Windows Filtering Platform

Identifies multiple Windows Filtering Platform block events and where the process name is related to an endpoint security software. Adversaries may add malicious WFP rules to prevent Endpoint security from sending telemetry.

Potential Direct Kubelet Access via Process Arguments

Detects potential direct Kubelet API access attempts on Linux by identifying process executions whose arguments contain URLs targeting Kubelet ports (10250/10255). Adversaries may probe or access Kubelet endpoints to enumerate pods, fetch logs, or attempt remote execution, which can enable discovery and lateral movement in Kubernetes environments.

Process Discovery via Built-In Applications

Identifies the use of built-in tools attackers can use to discover running processes on an endpoint.

Account or Group Discovery via Built-In Tools

Adversaries may use built-in applications to get a listing of local system or domain accounts and groups.

Enumerating Domain Trusts via NLTEST.EXE

Identifies the use of nltest.exe for domain trust discovery purposes. Adversaries may use this command-line utility to enumerate domain trusts and gain insight into trust relationships, as well as the state of Domain Controller (DC) replication in a Microsoft Windows NT Domain.

Machine Learning Detected a DNS Request With a High DGA Probability Score

A supervised machine learning model has identified a DNS question name with a high probability of sourcing from a Domain Generation Algorithm (DGA), which could indicate command and control network activity.

Network Connection to OAST Domain via Script Interpreter

Detects when a package service such as npm, gems, or a script interpreter makes an outbound network connection to an OAST (Out-of-band Application Security Testing) domain. Threat actors have been using OAST domains to exfiltrate sensitive data from compromised systems via malicious packages.

Malicious Remote File Creation

Malicious remote file creation, which can be an indicator of lateral movement activity.

Suspicious Endpoint Security Parent Process

A suspicious Endpoint Security parent process was detected. This may indicate a process hollowing or other form of code injection.

NLTest Domain Trust Discovery

The following analytic identifies the execution of `nltest.exe` with command-line arguments `/domain_trusts` or `/all_trusts` to query Domain Trust information. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant as it indicates potential reconnaissance efforts by adversaries to understand domain trust relationships, which can inform their lateral movement strategies. If confirmed malicio

Connection to Common Large Language Model Endpoints

Identifies DNS queries to known Large Language Model domains by unsigned binaries or common Windows scripting utilities. Malwares may leverage the capabilities of LLM to perform actions in the affected system in a dynamic way.

Network Activity to a Suspicious Top Level Domain

Identifies DNS queries to commonly abused Top Level Domains by common LOLBINs or executables running from world writable directories or unsigned binaries. This behavior matches on common malware C2 abusing less formal domain names.

Ollama DNS Query to Untrusted Domain

Detects Ollama DNS queries to domains outside official infrastructure. Adversaries can redirect Ollama to pull models from attacker-controlled servers via OLLAMA_HOST or custom manifests. Malicious models may contain backdoors, exploit parsing vulnerabilities like CVE-2025-1975, or poison inference outputs.