Rule Library
Sigma Rules
2 rules found for "uniqu3-us3r"
3,779Total
3,161Detection
474Emerging
141Hunting
Detectionmediumexperimental
Kubernetes Potential Enumeration Activity
Detects potential Kubernetes enumeration or attack activity via the audit log. This includes the execution of common shells, utilities, or specialized tools like 'Rakkess' (access_matrix) and 'TruffleHog' via Kubernetes API requests. Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster.
Kubernetesaudit
uniqu3-us3rTue Apr 28application
Emerging Threatlowexperimental
EvilTokens PhaaS Kit Phishing Related Request - Proxy
Detects outbound web proxy requests to URLs matching the EvilTokens Phishing-as-a-Service (PhaaS) kit infrastructure. Specifically Cloudflare Workers and Railway.app domains used in OAuth device code authorization phishing attacks. This indicates a user has clicked a phishing link.
Proxy Log
uniqu3-us3rTue Apr 282026