Sigma detection rules, expert-reviewed

Possible Next.js Middleware Auth Bypass via X-Middleware-Subrequest Header (CVE-2025-29927)

This rule detects HTTP requests carrying the X-Middleware-Subrequest header, which Next.js internally uses to prevent middleware recursion and which attackers forge to bypass middleware-based authentication in CVE-2025-29927 as analyzed by Assetnote. A client-supplied value for this header causes the framework to skip auth middleware and return protected content. Because legitimate external clients never send this internal header, its presence strongly indicates an exploitation attempt.

Possible Ivanti Pulse Connect Secure Command Injection via License Keys-Status Endpoint (via webserver)

This rule detects requests to the Pulse Connect Secure license keys-status API node parameter carrying shell metacharacters. This maps to the command injection flaw where the node name is passed unsanitized into a shell context. An attacker uses this to execute arbitrary operating system commands on the appliance.

Possible Ivanti Pulse Connect Secure Auth Bypass via TOTP Backup Code Path Traversal (via webserver)

This rule detects requests to the Pulse Connect Secure TOTP user backup code API containing directory traversal sequences. This maps to the authentication bypass where traversal from the totp endpoint reaches restricted admin and system functions. An attacker uses this to bypass authentication and pivot toward remote code execution.

Possible Citrix ShareFile Unauthenticated Upload Path Traversal Webshell (CVE-2023-24489) (via webserver)

This rule detects unauthenticated POST requests to the ShareFile storage controller upload endpoints carrying a traversal uploadid and archive extraction flags. This maps to CVE-2023-24489 where a cryptographic flaw allows uploading and unzipping an ASPX webshell outside the intended directory. An attacker uses this to achieve remote code execution and persistence.

Suspicious Citrix StoreFront SAML Test Endpoint Access for XSS (CVE-2023-5914) (via webserver)

This rule detects POST requests to the Citrix StoreFront SAML test authentication endpoint associated with CVE-2023-5914. This maps to abuse of the SamlTest handler where a crafted SAMLResponse reflects into a cross-site scripting payload. An attacker leverages this to execute script in an administrator context.

Possible Citrix Bleed Session Token Leak via OpenID Configuration Endpoint (CVE-2023-4966) (via webserver)

This rule detects requests to the NetScaler OpenID configuration discovery endpoint used to trigger CVE-2023-4966 memory disclosure. This maps to Citrix Bleed where an oversized Host header causes the appliance to leak adjacent memory containing session tokens. An attacker replays the leaked NSC_AAAC cookie to hijack authenticated sessions.

Possible Citrix NetScaler Gateway Buffer Overflow via formssso Endpoint (CVE-2023-3519) (via webserver)

This rule detects requests to the NetScaler Gateway formssso single sign-on endpoint with a start event and a target parameter. This maps to CVE-2023-3519 where an oversized target value overflows a stack buffer to achieve unauthenticated remote code execution. An attacker uses this to gain a foothold on the appliance.

Possible Magento XXE via guest-carts estimate-shipping-methods (CVE-2024-34102)

This rule detects POST requests to the Magento guest-carts estimate-shipping-methods REST endpoint whose body contains XML external entity syntax such as DOCTYPE, ENTITY, SYSTEM, or a php filter wrapper, matching the nested deserialization XXE for CVE-2024-34102 documented by Assetnote. Attackers abuse this to read sensitive files like app/etc/env.php and harvest secrets. The endpoint combined with XXE markers indicates targeted exploitation rather than normal shipping estimation.

Possible Progress WS_FTP Ad Hoc Deserialization via AHT_DEFAULT_UPLOAD_PARAMETER Marker

This rule detects multipart form-data uploads to WS_FTP Ad Hoc that carry the AHT_DEFAULT_UPLOAD_PARAMETER marker, matching the .NET BinaryFormatter deserialization exploit for CVE-2023-40044 documented by Assetnote. The marker delimits a base64 serialized object that the IIS module deserializes into code execution. Presence of this internal marker in a request body indicates targeted exploitation of the WS_FTP HTTP module.

Possible MOVEit Transfer SSRF via MOVEitISAPI action m2

This rule detects requests to MOVEitISAPI.dll with action=m2, the server-side request forwarding primitive identified through patch diffing by Assetnote for CVE-2023-34362. The m2 action proxies requests toward internal-only MOVEit endpoints and is a core step in reaching the vulnerable machine2 logic. Detecting this action on the ISAPI extension highlights probing or exploitation of the internal request path.

Suspicious MOVEit Transfer Token Request with grant_type session

This rule detects POST requests to the MOVEit Transfer token API using grant_type=session, matching the authentication step in the Assetnote MOVEit Transfer RCE chain for CVE-2023-34362 where a smuggled session is exchanged for a valid token. Attackers use this to convert manipulated session state into authenticated API access. The specific grant type on the token endpoint distinguishes exploitation from normal password or refresh grants.

Possible Sitecore SPEAK Bundle Arbitrary File Read via Path Traversal

This rule detects requests to the Sitecore SPEAK bundle endpoint with an absolute path traversal in the f parameter terminated by an encoded fragment, matching the arbitrary file read of web.config described in the Assetnote Sitecore RCE research. Attackers use this primitive to read sensitive configuration and harvest secrets for further exploitation. The combination of the bundle path and traversal markers indicates targeted file disclosure rather than normal asset loading.

Possible Craft CMS RCE via Query-String CLI Option Injection

This rule detects HTTP requests that inject Yii/Craft CLI options such as --templatesPath or --configPath through the query string, abusing PHP register_argc_argv on Craft CMS. This technique matches the Assetnote Craft CMS PHP footgun research where attacker-controlled argv values point to remote FTP or PHP stream wrappers to achieve remote code execution. Detecting these option strings early surfaces exploitation of the underlying command-line parsing footgun before code execution.

Possible Bitbucket Pre-Auth RCE via git archive exec Null-Byte Injection (CVE-2022-36804) (via webserver)

This rule detects requests to the Bitbucket archive REST endpoint carrying a null-byte encoded prefix and a git archive exec directive. This maps to CVE-2022-36804 where the prefix parameter is abused to inject arguments into the git archive command. An attacker uses this to spawn a shell and achieve unauthenticated remote command execution on the server.

Possible Unauthenticated Admin Creation in Dynamicweb CVE-2022-25369

This rule detects HTTP requests to the Dynamicweb setup Default.aspx page invoking the createadministrator action with supplied credentials. CVE-2022-25369 is a logic flaw allowing unauthenticated administrator creation as documented by Assetnote, which attackers chain into a webshell upload for remote code execution.