Sigma detection rules, expert-reviewed

Possible SAP NetWeaver CVE-2025-31324 Webshell Upload via metadatauploader Endpoint (via webserver)

This rule detects POST requests to the SAP NetWeaver metadatauploader endpoint abused in CVE-2025-31324 for unauthenticated webshell upload. China-nexus actors dropped JSP webshells through this development server path. Requests to this endpoint from untrusted sources warrant investigation.

Malicious WmRAT C2 Beacon via excerorderslist Endpoint (via proxy)

This rule detects WmRAT command-and-control beacons to the excerorderslistoncbook PHP endpoint carrying the vrocean parameter with a Base64-encoded victim identifier. This URI and parameter pairing is unique to the Bitter APT PTCL campaign infrastructure. Traffic matching both is a high-confidence C2 indicator.

Malicious DarkGate C2 Communication via Synapse User-Agent (via proxy)

This rule detects outbound HTTP traffic carrying the distinctive DarkGate command-and-control User-Agent string. DarkGate beacons identify themselves with a hardcoded Synapse user agent not used by legitimate browsers. Presence of this exact string is a high-confidence C2 indicator.

Suspicious APT29 Zulip C2 Communication via curl User-Agent (via proxy)

This rule detects requests to the Zulip chat messages API using a curl User-Agent, the abuse of a legitimate collaboration service for command-and-control in the APT29 German Embassy campaign. The actor posted to the api v1 messages endpoint via curl to blend with normal SaaS traffic. Because Zulip is legitimate, the curl agent and messages path together narrow the match.

Suspicious Nmap Scanner Probe URIs in HTTP Requests (via webserver)

This rule detects HTTP requests to characteristic Nmap probe paths used by NSE scripts to fingerprint web servers and Hadoop or application endpoints. Requests for these signature URIs indicate automated scanning and service discovery against exposed infrastructure. Catching the probe paths reveals reconnaissance even when the scanner user-agent has been altered.

Suspicious AWS AiTM Phishing Kit Endpoint Access via Proxy

This rule detects web requests carrying the input_24 parameter to the /api endpoints used by the AWS adversary-in-the-middle phishing kit, which relays victim credentials and MFA responses to the legitimate AWS console. The kit exposes paths such as /api/check, /api/login and /api/auth alongside MFA relay branches for email, sms and gauth. Detecting these accesses is important because they indicate users interacting with a live credential-and-session-stealing phishing site.

Malicious NPM Backdoor C2 Beacon to Injective Telemetry Endpoint via Proxy

This rule detects HTTP POST requests to the Injective testnet gRPC-web telemetry host abused as command-and-control by the trojanized @injectivelabs/sdk-ts npm package. The backdoor base64-encodes wallet mnemonics and private keys derived in PrivateKey.ts and exfiltrates them in the request payload. Detecting this outbound beacon is critical because it represents active theft of cryptocurrency credentials from developer and CI environments.

Suspicious AWS Console Phishing MFA Relay Endpoints

This rule detects requests to the MFA relay endpoints of the AWS console phishing kit that intercept second-factor codes delivered by email, SMS, or authenticator app. The kit prompts victims for their one-time codes and forwards them so the operator can complete authentication in real time. Traffic to these email, sms, and gauth relay paths on a login-lookalike host indicates active MFA interception.

Suspicious C2 Beacon with Legacy MSIE User Agent

This rule detects outbound HTTP traffic to the axios RAT command and control host over a non-standard port using a hardcoded legacy Internet Explorer user agent. The implant beacons to sfrclak.com on port 8000 with an obsolete MSIE client string that rarely appears from modern endpoints. The combination of this destination and the archaic user agent identifies the RAT check-in channel.

Suspicious 1Phish Kit Cookies and Telemetry Beacon

This rule detects the 1Phish kit fingerprint cookies validated_user_1pass and hideclick ignore alongside its base64 clid telemetry parameter. These constants are set by the phishing kit to track victim progress and evade automated crawlers. Requests carrying these kit-specific cookies or the clid telemetry marker identify pages served by the 1Phish infrastructure.

Suspicious 1Phish Kit Session API Harvesting Credentials and OTP

This rule detects requests to the 1Phish kit session API paths that collect credentials, one-time passcodes, and recovery codes from victims. The kit exposes structured api session endpoints keyed by session id to stage each stolen factor as the phishing flow progresses. Traffic to these session credential, otp, and recovery routes indicates an active 1Phish deployment harvesting authentication material.

Suspicious Infostealer C2 Heartbeat to bot heartbeat Endpoint

This rule detects outbound POST requests to a bot heartbeat command and control endpoint used by the macOS infostealer to check in with its operator. The implant beacons to a heartbeat path to receive tasking and confirm the victim is live. Regular POST traffic to this endpoint indicates an active infostealer implant maintaining C2.

Suspicious AiTM Session Cookie Exfiltration to log_cookie Endpoint

This rule detects web requests to a log_cookie collection endpoint carrying stolen session identifiers such as idx, JSESSIONID, and sid, the harvesting path used by the AiTM phishing kit. The reverse proxy captures live authenticated cookies from M365 and Okta victims and ships them to attacker infrastructure for session hijacking. Traffic to this endpoint with session token parameters indicates successful token theft.

Suspicious Data Exfiltration to Telegram or Discord Web Service

This rule detects outbound requests to the Telegram bot API or a Discord webhook endpoint which the MUT-8694 campaign uses to exfiltrate stolen host information and credentials from infected Windows machines to attacker controlled channels.

Malicious HTTP User Agent zzhbot From Docker API Compromise

This rule detects outbound HTTP requests using the User-Agent string zzhbot which the vurl reverse connection tool sets when beaconing to its command and control infrastructure in the campaign targeting exposed Docker APIs.