Skip to content

Siemphony is in beta and still being built. How a rule earns its badge.

Siemphonybeta
Siemphony’s repertoire

Code repository domain resolved by a script host or transfer tool

Siemphony@siemphonylowT1567.001unverifiedPlaybook · Collection and exfiltration
Matches a DNS lookup for a public code-repository domain made by a scripting host, a transfer utility or Git's HTTPS helper, which is the outbound leg of AN0895 reduced to a single event. The dns_query source is chosen over the Sysmon EventID 3 connection event because the repository is identified by name and the connection event carries only an address — its DestinationHostname comes from a reverse lookup and resolves to nothing usable for these CDNs. `git.exe` is deliberately absent from the process list: `git push` over HTTPS hands the transport to `git-remote-https.exe`, so `git.exe` never issues the query and would be a dead selector here. The analytic's other two elements — the preceding read of a sensitive directory and MITRE's ExfilVolumeThreshold knob — need a correlation and a numeric comparison that Sigma cannot express, so this fires on the contact rather than on the volume moving through it, and it sees nothing at all unless the running Sysmon configuration enables DNS query logging. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0318, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The detection

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

title: Code repository domain resolved by a script host or transfer toolid: 990761bd-7b63-4b65-b88c-575ea26b8272status: experimentaldescription: |  Matches a DNS lookup for a public code-repository domain made by a scripting  host, a transfer utility or Git's HTTPS helper, which is the outbound leg of  AN0895 reduced to a single event. The dns_query source is chosen over the  Sysmon EventID 3 connection event because the repository is identified by  name and the connection event carries only an address — its  DestinationHostname comes from a reverse lookup and resolves to nothing  usable for these CDNs. `git.exe` is deliberately absent from the process  list: `git push` over HTTPS hands the transport to `git-remote-https.exe`,  so `git.exe` never issues the query and would be a dead selector here. The  analytic's other two elements — the preceding read of a sensitive directory  and MITRE's ExfilVolumeThreshold knob — need a correlation and a numeric  comparison that Sigma cannot express, so this fires on the contact rather  than on the volume moving through it, and it sees nothing at all unless the  running Sysmon configuration enables DNS query logging.  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0318, not hand-written and not tested by its author. Any lab result is on this rule's own page.references:  - https://attack.mitre.org/techniques/T1567/001  - https://attack.mitre.org/detectionstrategies/DET0318author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)date: 2026-08-16tags:  - attack.exfiltration  - attack.t1567.001logsource:  category: dns_query  product: windowsdetection:  selection_process:    Image|endswith:      - '\powershell.exe'      - '\pwsh.exe'      - '\cscript.exe'      - '\wscript.exe'      - '\mshta.exe'      - '\certutil.exe'      - '\curl.exe'      - '\python.exe'      - '\pythonw.exe'      - '\rclone.exe'      - '\git-remote-https.exe'  selection_repository:    QueryName|endswith:      - 'github.com'      - 'githubusercontent.com'      - 'gitlab.com'      - 'bitbucket.org'      - 'sourceforge.net'  condition: selection_process and selection_repositoryfalsepositives:  - "Developer workstations and build agents, which are most of what this rule matches: git-remote-https.exe resolves github.com on every clone, fetch and push, and a CI runner does it continuously. Wherever source control is part of the job this is the entire result set by a wide margin, which is why the level is set no higher than low."  - "Package and module installation. pip, poetry and npm driven through python.exe or a shell resolve github.com and codeload.github.com to fetch dependencies, and PowerShell bootstrap scripts pull install code from raw.githubusercontent.com — the same lookup an upload produces."  - "Updaters and security tooling that pull detection rules, signatures or release binaries from a repository's release hosting on a fixed schedule using curl.exe or a bundled python.exe."  - "Administrative and reporting automation querying the repository API for issue, release or membership metadata. A read and a write resolve the same name, so inventory scripts are indistinguishable from an exfiltration client at this event."level: low

Splunk · SPL

Run this as a search.

index=* ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cscript.exe" OR Image="*\\wscript.exe" OR Image="*\\mshta.exe" OR Image="*\\certutil.exe" OR Image="*\\curl.exe" OR Image="*\\python.exe" OR Image="*\\pythonw.exe" OR Image="*\\rclone.exe" OR Image="*\\git-remote-https.exe") AND (QueryName="*github.com" OR QueryName="*githubusercontent.com" OR QueryName="*gitlab.com" OR QueryName="*bitbucket.org" OR QueryName="*sourceforge.net"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\certutil.exe" OR TO_LOWER(process.executable) LIKE "*\\\\curl.exe" OR TO_LOWER(process.executable) LIKE "*\\\\python.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pythonw.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rclone.exe" OR TO_LOWER(process.executable) LIKE "*\\\\git-remote-https.exe") AND (TO_LOWER(dns.question.name) LIKE "*github.com" OR TO_LOWER(dns.question.name) LIKE "*githubusercontent.com" OR TO_LOWER(dns.question.name) LIKE "*gitlab.com" OR TO_LOWER(dns.question.name) LIKE "*bitbucket.org" OR TO_LOWER(dns.question.name) LIKE "*sourceforge.net"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,dns_query,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$|\\cscript\.exe$|\\wscript\.exe$|\\mshta\.exe$|\\certutil\.exe$|\\curl\.exe$|\\python\.exe$|\\pythonw\.exe$|\\rclone\.exe$|\\git-remote-https\.exe$)</field>    <field name="QueryName" type="pcre2">(?i)(github\.com$|githubusercontent\.com$|gitlab\.com$|bitbucket\.org$|sourceforge\.net$)</field>    <description>Code repository domain resolved by a script host or transfer tool</description>    <mitre>      <id>T1567.001</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"category":"dns_query","product":"windows"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Log in to react
Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

Log in to report a verdict.

Log in to join the discussion.

No comments yet. Someone who deploys this will have something to say about it.