Sigma detection rules, expert-reviewed

Proxy Detection: Cobalt Strike Malleable C2 Profile HTTP URI/User-Agent/Method Patterns

Flags proxy HTTP requests whose URI, method, User-Agent, host, and cookie fragments match known Cobalt Strike malleable profile patterns.

F5 BIG-IP iControl REST Webserver POST to /mgmt/tm/util/bash Command Execution

Alerts on webserver POST requests to the BIG-IP iControl REST bash execution endpoint (/mgmt/tm/util/bash).

F5 BIG-IP iControl REST API Bash Endpoint Command Execution via Proxy POST

Alerts on POST requests to the BIG-IP iControl REST /mgmt/tm/util/bash endpoint that can execute shell commands.

Proxy User-Agent starts with Base64-like prefixes associated with encoded client strings

Identifies proxy requests with User-Agent values starting with known Base64-encoded prefixes.

Suspicious Proxy Requests to IPFS URLs Containing Email Address

Alerts when proxy request URIs target IPFS and include an email address.

Detect rclone CLI Activity via Proxy User-Agent Prefix

Flags proxy traffic with a user agent beginning with rclone/v, indicating rclone usage through the proxy.

PUA Tool Update Check to /checkupdate.php (Advanced IP/Port Scanner) via Proxy

Identifies proxy HTTP requests to /checkupdate.php from Advanced IP/Port Scanner with expected update-check query parameters.

Webserver User-Agent Identifies Known Recon and Scanning Tool Strings

Alerts on web requests with User-Agent values containing known recon/scanner tool identifiers.

Proxy Log User-Agent Ending with '=' Suggesting Base64 Encoding

Alerts on proxy requests with User-Agent values ending in '=' that may indicate Base64-encoded content.

Web Server GET Requests Containing SSTI Payload Strings (Server-Side Template Injection)

Flags GET requests containing SSTI probe strings in web access logs when the response is not 404.

Microsoft BITS Proxy Requests to Uncommon Server IP Hosts

Identifies Microsoft BITS proxy connections where the destination host ends with a single-digit, indicating uncommon IP-style addressing.

Webserver: Suspicious Windows Path Strings in URI Query

Alerts when a web URI query contains encoded or plain Windows path strings indicative of possible exfiltration or webshell behavior.

Java Payload Indicators in Web Server Logs

Alerts when web access logs contain Java payload-like strings indicating possible injection or runtime execution attempts.

Webserver JNDI-Exploit-Kit Exploitation Indicators via Known Payload Paths

Flags webserver requests whose URL paths match known JNDI-Exploit-Kit exploit, deserialization, and memshell pattern strings.

Webserver: Successful IIS shortname fuzzing scan using "~1" parameter

Alerts on successful IIS probing requests containing ~1 and ending with a.aspx using GET/OPTIONS.