Sigma detection rules, expert-reviewed

Malicious SharePoint ToolShell Exploitation via ToolPane Endpoint

This rule detects a POST request to the SharePoint ToolPane endpoint in edit mode with a referer set to the SignOut page, the exact exploitation pattern of the ToolShell on-premises SharePoint vulnerabilities. This unauthenticated request chain is used to forge ViewState and achieve remote code execution and should be treated as active exploitation.

Possible Ivanti Connect Secure Webshell Access

This rule detects HTTP access to Ivanti Connect Secure API paths and CGI scripts associated with the WIREFIRE, LIGHTWIRE, and backdoored compcheckresult webshells dropped during the zero-day exploitation. Attackers use these implanted webshells for persistent remote command execution on the appliance. Requests to these specific endpoints indicate an already-compromised device.

Possible Data Exfiltration to Discord Webhook Endpoint (via proxy)

This rule detects outbound web requests to a Discord webhook API path which the Empyrean stealer and many commodity stealers use to exfiltrate stolen credentials and tokens. Requests to this endpoint from non messaging applications warrant investigation.

Malicious HarborWatch RAT Command and Control Beacon by User Agent (via proxy)

This rule detects outbound HTTP requests carrying the HarborWatchAgent user agent string used by the custom monitoring RAT delivered through a fake Amazon ClickFix lure. This hardcoded agent value is specific to the malware and should not appear in normal traffic.

Suspicious SD-WAN Compromise JSP Webshell Access

This rule detects web requests to the JSP webshells dropped during the Cisco Catalyst SD-WAN exploitation, including the XenShell and named sysinit and vmurnp_ikp shells. Access to these attacker-planted JSP files gives operators command execution on the compromised appliance. Requests to these paths indicate webshell interaction following exploitation.

Malicious AquaShell Webshell Access on Cisco Secure Email Gateway by UAT-9686

This rule detects HTTP POST requests to the AquaShell Python webshell planted at the euq_webui index.py endpoint on Cisco Secure Email appliances. UAT-9686 uses this unauthenticated webshell to execute arbitrary commands on compromised gateways. Requests to this appliance path indicate active exploitation and remote command execution.

Suspicious Cloudflare Workers Brand-Impersonation Phishing Domains via Proxy

This rule detects proxy requests to Cloudflare Workers subdomains that impersonate document and cloud storage brands such as docviewer, onedrive, and adobe, matching the phishing lure infrastructure of the ARToken EvilTokens campaign reported by Cisco Talos. Attackers host credential and device-code capture pages on ephemeral workers.dev subdomains. Detecting these brand-mimicking hosts flags users being funneled into the phishing panel.

Malicious BadIIS C2 Communication via lwxatisme User-Agent

This rule detects HTTP traffic carrying the User-Agent string lwxatisme, a fixed marker used by the commodity BadIIS ecosystem tracked by Talos to authenticate to its C2. The BadIIS native IIS module keys off this hardcoded agent to gate operator commands. Presence of this User-Agent indicates a BadIIS-infected server communicating with its controller.

Suspicious UAT-10608 Credential Harvesting C2 Beacon via HTTP

This rule detects outbound HTTP requests carrying the UAT-10608 command-and-control beacon layout where the URI encodes the victim host, the harvesting phase and a campaign identifier as h, l and id parameters. This structured query pattern is used by the credential harvesting operation to report progress and exfiltrate results over HTTP. Matching traffic indicates an actively beaconing compromised host.

Possible PS1Bot C2 Beacon With Drive Serial URI Pattern (via proxy)

This rule detects HTTP GET requests whose URI query contains the PS1Bot command-and-control marker k=result used to exfiltrate results keyed by the victim drive serial number. This structured URI pattern identifies PS1Bot beaconing to its command-and-control server. Detection of this traffic reveals active command-and-control and data exfiltration.

Suspicious WarmCookie C2 Beacon With Fixed Firefox User-Agent

This rule detects web traffic carrying the hardcoded Firefox 115.0 User-Agent string used by WarmCookie. WarmCookie beaconed to its command-and-control servers with a fixed Mozilla Firefox 115.0 User-Agent regardless of the host browser. A single static outdated User-Agent applied to all C2 requests is an application-layer protocol indicator that stands out from real browser diversity.

Malicious GhostLocker2 C2 Communication via HTTP POST (via proxy)

This rule detects HTTP POST requests to the GhostLocker2 command-and-control endpoints /addInfection and /incrementLaunch used by GhostSec ransomware. These beacons report new infections and launch counts to the operator panel and indicate active ransomware deployment.

Malicious RemusStealer Credential Exfiltration to pics TLD C2

This rule detects HTTP POST requests to hosts under the .pics top-level domain whose body carries access_token and step parameters, the exfiltration pattern of RemusStealer distributed by this ecosystem. This structured upload to an uncommon TLD signals active credential and session-token theft.

Malicious NSIS_InetLoad User-Agent C2 Traffic in Malware Distribution Ecosystem

This rule detects outbound HTTP requests carrying the User-Agent NSIS_InetLoad (Mozilla), a fixed string emitted by NSIS-based downloaders in this malware distribution ecosystem when fetching second-stage payloads. This unusual agent is a reliable network indicator of the loader stage.

Possible React2Shell CVE-2025-55182 Prototype Pollution Exploitation

This rule detects web requests carrying prototype pollution markers that reach Node.js command execution primitives. This is the exploitation pattern for CVE-2025-55182 also known as React2Shell against public facing Node.js and React applications.