Sigma detection rules, expert-reviewed

Possible GammaSteel C2 Using Spoofed iPhone User Agent

This rule detects outbound web traffic presenting an iPhone OS 18_0 user agent from an endpoint. Gamaredon GammaSteel beacons to its command server with this mobile user agent to blend in with normal traffic. Mobile browser user agents originating from a Windows workstation proxy are anomalous and merit review.

Malicious Silver Fox Stealer Exfiltration Using WhatsAppBackup User Agent

This rule detects outbound requests using the WhatsAppBackup 1.0 user agent associated with the Silver Fox Python stealer. The stealer uploads collected victim data to a web service while presenting this custom agent. Because no legitimate WhatsApp client uses this string it is a reliable exfiltration indicator.

Suspicious Interlock Backdoor C2 Beacon to init1234 Endpoint (via proxy)

This rule detects HTTP POST requests to the init1234 endpoint used by the Interlock PowerShell backdoor for command and control. The Interlock ransomware operators register their compromised hosts by beaconing to this fixed URI. The specific init1234 path combined with the POST method reveals active backdoor communication.

Suspicious PolarEdge Backdoor C2 URL with Module and putdata Command (via proxy)

This rule detects requests to the PolarEdge backdoor command and control URL that carries module and cmd putdata parameters. The ORB network encodes the compromised device model and operation such as CISCO_3 in the module value while cmd putdata signals data upload. This structured URI pattern is specific to the PolarEdge implant and reveals active C2 communication.

Suspicious HATVIBE C2 Beacon via HTTP PUT to PHP Endpoints (via proxy)

This rule detects HTTP PUT requests to the setup.php local.php and upset.php endpoints used by the HATVIBE backdoor for command and control. The Double-Tap campaign associated with APT28 relies on these specific PHP URIs combined with the uncommon PUT method to exfiltrate data and receive commands. The unusual method plus fixed endpoint set distinguishes this beacon from normal web traffic.

Possible FakeBat Loader Payload Download and C2 URI Patterns

This rule detects HTTP requests to FakeBat loader infrastructure including the MSIX delivery script dwnl.php and command and control endpoints such as check.php, buy and profile that carry victim fingerprint parameters like av, domain, key and os. These URI structures are specific to the FakeBat distribution and reporting channel. Matching them surfaces hosts fetching the loader or beaconing to adversary servers.

Suspicious Tycoon 2FA Phishing Script Retrieval

This rule detects retrieval of the randomly numbered myscr JavaScript file served by the Tycoon 2FA phishing kit. The kit loads a script matching the /myscr######.js pattern to render its credential-harvesting page, so this URI shape signals an AiTM phishing landing.

Malicious DDoSia Client C2 Check-In via Fixed User-Agent

This rule detects the NoName057(16) DDoSia client registering with its C2 by POSTing to a /client/login endpoint using a hardcoded legacy Gecko User-Agent. The combination of that outdated User-Agent string and the login path identifies the DDoS bot fetching its target list.

Suspicious HijackLoader PNG Payload Retrieval via ClearFake

This rule detects retrieval of a HijackLoader stage disguised as a PNG image from the ClearFake osmesis distribution path. The loader downloads its encoded payload from a URI under /osmesis/ ending in .png, blending malware delivery into image traffic.

Malicious WordPress Core SQL Injection Scanner via User-Agent

This rule detects HTTP requests carrying a User-Agent string that self identifies the CVE-2026-63030 exploitation tool. Attackers probe the WordPress REST batch endpoint for a UNION based SQL injection using this distinctive automated client marker.

Suspicious Remote Access Tool User Agent in Outbound Traffic via Proxy

This rule detects outbound HTTP requests carrying the NetSupport Manager or JWrapperDownloader user agents, network fingerprints of remote access tooling used during intrusions. Because these agents accompany download and command-and-control traffic for tools frequently abused as RATs, their presence in proxy logs indicates remote access tool activity that should be validated against sanctioned software.

Possible TP-Link Command Injection via WlanNetworkRpm Endpoint (via webserver)

This rule detects HTTP requests to the TP-Link WlanNetworkRpm configuration endpoint that carry shell metacharacters or download commands in the ssid1 parameter, matching exploitation of CVE-2023-33538 for unauthenticated command injection. Attackers abuse this router flaw to fetch and run Condi or Mirai IoT bot payloads.

Malicious SharePoint ToolPane Exploitation via SignOut Referer

This rule detects HTTP POST requests to ToolPane.aspx carrying a Referer header pointing at SignOut.aspx. This exact request pattern is the authentication bypass used to exploit the SharePoint ToolShell vulnerabilities. The crafted Referer combined with the ToolPane endpoint is a reliable exploitation signature.

Suspicious Tomcat Session Deserialization Trigger via Crafted JSESSIONID

This rule detects HTTP requests whose JSESSIONID value begins with a dot followed by a filename, the trigger for the Tomcat CVE-2025-24813 partial-PUT deserialization chain. The crafted session identifier forces Tomcat to deserialize an attacker-uploaded session file. This pattern indicates active exploitation.

Malicious Tomcat Partial PUT of Session File via Content-Range Header

This rule detects HTTP PUT requests targeting a .session file while carrying a Content-Range header, the upload step of the Tomcat CVE-2025-24813 partial-PUT deserialization exploit. Attackers write a serialized Java session file that is later deserialized for remote code execution. This upload pattern is a strong pre-exploitation indicator.