Sigma rule: Potentially Suspicious Network Connection To Notion API

Rule

Title

Potentially Suspicious Network Connection To Notion API

Status

test

Level

low

Author

Gavin Knapp

Date

2023-05-03

File

rules/windows/network_connection/net_connection_win_domain_notion_api_susp_communication.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a non-browser process communicating with the Notion API. This could indicate potential use of a covert C2 channel such as "OffensiveNotion C2"

Log source

product

windows

category

network_connection

Detection

selection:
    DestinationHostname|contains: 'api.notion.com'
filter_main_notion:
    Image|endswith: '\AppData\Local\Programs\Notion\Notion.exe'
filter_main_brave:
    Image|endswith: '\brave.exe'
filter_main_chrome:
    Image:
        - 'C:\Program Files\Google\Chrome\Application\chrome.exe'
        - 'C:\Program Files (x86)\Google\Chrome\Application\chrome.exe'
filter_main_firefox:
    Image:
        - 'C:\Program Files\Mozilla Firefox\firefox.exe'
        - 'C:\Program Files (x86)\Mozilla Firefox\firefox.exe'
filter_main_ie:
    Image:
        - 'C:\Program Files (x86)\Internet Explorer\iexplore.exe'
        - 'C:\Program Files\Internet Explorer\iexplore.exe'
filter_main_maxthon:
    Image|endswith: '\maxthon.exe'
filter_main_edge_1:
    - Image|startswith: 'C:\Program Files (x86)\Microsoft\EdgeWebView\Application\'
    - Image|endswith: '\WindowsApps\MicrosoftEdge.exe'
    - Image:
          - 'C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe'
          - 'C:\Program Files\Microsoft\Edge\Application\msedge.exe'
filter_main_edge_2:
    Image|startswith:
        - 'C:\Program Files (x86)\Microsoft\EdgeCore\'
        - 'C:\Program Files\Microsoft\EdgeCore\'
    Image|endswith:
        - '\msedge.exe'
        - '\msedgewebview2.exe'
filter_main_opera:
    Image|endswith: '\opera.exe'
filter_main_safari:
    Image|endswith: '\safari.exe'
filter_main_seamonkey:
    Image|endswith: '\seamonkey.exe'
filter_main_vivaldi:
    Image|endswith: '\vivaldi.exe'
filter_main_whale:
    Image|endswith: '\whale.exe'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Legitimate applications communicating with the "api.notion.com" endpoint that are not already in the exclusion list. The desktop and browser applications do not appear to be using the API by default unless integrations are configured.

Tags

• attack.command-and-control
• attack.t1102

MITRE ATT&CK ids this rule names

• T1102

References

• https://github.com/mttaggart/OffensiveNotion
• https://medium.com/@huskyhacks.mk/we-put-a-c2-in-your-notetaking-app-offensivenotion-3e933bace332

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/network_connection/net_connection_win_domain_notion_api_susp_communication.yml