Sigma detection rules, expert-reviewed

Possible SSRF via VMware Workspace One Access instanceHealth CVE-2021-22056

This rule detects HTTP requests to the VMware Workspace One Access instanceHealth REST endpoint that inject an at-sign into the hostName parameter. CVE-2021-22056 abuses this health-check path for server-side request forgery as detailed by Assetnote, which can leak an admin JWT and reach internal services.

Possible WatchGuard Pre-Auth RCE via agent login XML-RPC CVE-2022-26318

This rule detects POST requests to the WatchGuard /agent/login endpoint that carry an XML-RPC agent.login method call. CVE-2022-26318 is a pre-authentication buffer overflow reached through an oversized gzip-encoded XML methodCall to this endpoint as shown by Assetnote, enabling remote code execution on the firewall.

Possible Yellowfin BI Authentication Bypass via StoryBody Endpoint

This rule detects HTTP requests to the Yellowfin BI /StoryBody.i4 endpoint carrying the identity parameters abused for authentication bypass. Assetnote exploited hardcoded keys and this endpoint with ipPerson and ipOrg parameters to forge sessions, a first step toward JNDI-injection remote code execution.

Possible Oracle Opera CGI Webshell Command Execution via operabin

This rule detects HTTP requests to CGI scripts under the Oracle Opera /operabin/ path that pass a cmd parameter. Following a FileReceiver webshell drop described by Assetnote, attackers invoke the planted CGI script with a cmd argument to run operating system commands on the Opera host.

Possible Pre-Auth Webshell Upload via Oracle Opera FileReceiver Servlet

This rule detects HTTP requests to the Oracle Opera FileReceiver servlet used to drop a CGI webshell into the operabin cgi-bin directory. Assetnote research chains an order-of-operations bug to reach pre-auth remote code execution via this servlet, which attackers use to plant a webshell for persistent command execution.

Possible Reflected XSS via cPanel cpanelwebcall Endpoint CVE-2023-29489

This rule detects HTTP requests to the cPanel /cpanelwebcall/ path that contain reflected cross-site scripting payload markers. CVE-2023-29489 allows unauthenticated reflected XSS on cPanel management ports as documented by Assetnote, which attackers use to hijack sessions and pivot into hosting infrastructure.

Possible SSRF via Gatsby _gatsby File Proxy Endpoint

This rule detects HTTP requests to the Gatsby /_gatsby/file remote file proxy carrying an absolute URL or a cloud metadata target. Assetnote research showed this static site generator proxy can be coerced into server-side request forgery against internal services and the cloud metadata endpoint.

Possible SSRF to Cloud Metadata via Nuxt _ipx Image Proxy

This rule detects HTTP requests to the Nuxt/Next _ipx image optimization proxy that reference the cloud instance metadata service. Static site generators expose _ipx as an open image proxy that can be abused for server-side request forgery as shown in Assetnote research, allowing an attacker to reach 169.254.169.254 and steal cloud credentials.

Suspicious Connection to Local Zoom Opener Webserver Launch Endpoint (via network_connection)

This rule detects traffic to the local ZoomOpener helper webserver launch endpoint on loopback port 19421. This maps to the Zoom drive-by RCE chain where a webpage sends a crafted launch request to the hidden local server. An attacker leverages this to trigger silent installation and code execution on the victim host.

Malicious CastleLoader C2 Communication via Hardcoded User-Agent

This rule detects outbound HTTP requests using the hardcoded non-standard User-Agent token associated with CastleLoader C2 check-ins. The loader beacons to its server with this fixed string before receiving tasks.

Malicious XE Group Webshell Upload via VeraCore UploadImage CVE-2024-57968 (via webserver)

This rule detects abuse of the VeraCore UploadImage handler to upload an ASP or ASPX webshell through the CVE-2024-57968 unrestricted-upload flaw exploited by XE Group. The request combines the PMA upload controller with a script-file filename parameter, reflecting the point at which the actor plants a persistent webshell on the server.

Malicious PHP Code Injection in URL via CraftCMS CVE-2025-32432 Exploitation (via webserver)

This rule detects inline PHP code appearing in a request URL, the code-injection technique used after CraftCMS CVE-2025-32432 exploitation to write a file manager webshell to the web root via file_put_contents and file_get_contents. Adversaries embed PHP tags and file functions in the request so the vulnerable application stores and executes attacker-controlled code.

Suspicious Cobalt Strike Loader C2 Traffic via Forged MSIE yie9 User-Agent (via proxy)

This rule detects command-and-control traffic using the forged Internet Explorer 9 user-agent carrying the yie9 token observed with the Cobalt Strike PowerShell loader across Chinese and Russian infrastructure. Adversaries leverage a spoofed legacy browser user-agent to blend beacon traffic into normal web requests.

GateDoor Command-and-Control via gateway REST Endpoints (via proxy)

This rule detects outbound HTTP requests to the Django REST command-and-control endpoints used by GateDoor and RustDoor, including gateway register, gateway report and gateway future_task for device registration and command polling. Matching these fixed URI paths in proxy logs can reveal an infected host beaconing to the backdoor infrastructure.

Malicious alexantr File Manager Webshell Access after CraftCMS Compromise (via webserver)

This rule detects requests to a filemanager.php webshell with its upload and delete parameters, the open-source alexantr file manager dropped to the web root following CraftCMS CVE-2025-32432 exploitation. Adversaries use this webshell to browse, upload and remove files on the compromised server for hands-on-keyboard actions.