Sigma detection rules, expert-reviewed

PATCHCORD Beacon C2 Tasking via api.jsp clientId Poll (via proxy)

This rule detects the PATCHCORD implant polling its command channel with the hardcoded Beacon user-agent and the api.jsp clientId tasking URI observed in the Afghan telecom intrusion set. Adversaries use this fixed user-agent and endpoint to fetch operator commands over HTTP. The distinctive agent string and URI make this beacon reliably separable from normal web traffic.

Suspicious Cisco ASA WebVPN Login Scanning with Spoofed Chrome User-Agent

This rule detects inbound requests to Cisco ASA web login endpoints /+CSCOE+/logon.html and /+webvpn+/index.html that carry the single spoofed browser identifier Chrome/102.0.5005.63 used across a coordinated scanning botnet. The activity mapped a surge of 25,000 IPs probing Cisco ASA devices, frequently a precursor to a newly disclosed vulnerability being weaponized for initial access.

SilentMare Loader C2 Beacon via Custom GatewayClient User-Agent (via proxy)

This rule detects outbound HTTP requests carrying the hardcoded GatewayClient and Metrics User-Agent strings used by the SilentMare and HollowMare trojan families distributed through Google Search ads. These custom agents identify updater check-ins that pull AES-encrypted .NET payloads from attacker infrastructure, making them a reliable network fingerprint for the loader stage.

Possible C2 Beacon with Fixed Authorization URI Parameter via proxy

This rule detects outbound web requests to index.php carrying the fixed authorization=1 query parameter used by the DGA based command-and-control of the pirated-media miner campaign. The constant URI structure across randomized domains is a reliable protocol fingerprint. Catching the beacon URI reveals active C2 traffic that domain blocklists miss.

Possible React Server Components Exploitation via Next-Action Header

This rule detects inbound web requests carrying a Next-Action server action header together with crafted action parameter markers, the request shape used to trigger CVE-2025-55182 in React Server Components. Exploitation abuses the server action deserialization path to reach arbitrary command execution. Requests bearing this header alongside the action index syntax against a Next.js application warrant investigation for RCE attempts.

Possible Super SSRF via Jira Server nativemobile batch CVE-2022-26135

This rule detects POST requests to the Jira Server /rest/nativemobile/1.0/batch endpoint used to perform blind server-side request forgery. CVE-2022-26135 abuses this batch API with an attacker-controlled location value as shown by Assetnote, allowing requests to arbitrary internal hosts and cloud metadata.

Suspicious PHP Stream Wrapper in Query-String CLI Argument

This rule detects HTTP requests combining injected CLI option syntax in the query string with remote PHP stream wrappers such as ftp, phar, or php filter, matching the Craft CMS argv injection to remote code execution chain documented by Assetnote. Attackers use these wrappers to load remote templates or configuration and pivot to code execution. The pairing of a leading double-dash option with a wrapper scheme strongly indicates exploitation rather than benign parameters.

Possible IcedID C2 Communication via HTTP Parameters (via proxy)

This rule detects HTTP requests carrying the analytics mimicking parameter set combined with the __io token used by IcedID command and control traffic. The malware disguises beacons as web analytics requests to blend into normal browsing traffic while relaying host data.

Malicious OilRig Solar and Mango C2 URI Pattern via Proxy (via proxy)

This rule detects outbound HTTP requests matching the Solar and Mango command-and-control URI pattern used by OilRig, where template.aspx is queried with the rt=d and sun= parameters. This structured URI encodes tasking and exfiltration for the group's downloaders and marks active C2 traffic.

Possible Log4Shell JNDI Exploitation Attempt in Web Request

This rule detects Log4Shell (CVE-2021-44228) exploitation strings such as JNDI LDAP/RMI/DNS lookups and Log4j lookup obfuscation appearing in web request URIs and User-Agent headers. Attackers embed these expressions to force vulnerable Log4j2 loggers into resolving attacker-controlled JNDI references, leading to remote code execution.

Malicious Keenadu Android Backdoor C2 Registration and Task Polling URIs

This rule detects HTTP requests to the command-and-control URI paths used by the Keenadu Android backdoor including its client registration and task polling endpoints. Kaspersky tied these structured paths to Keenadu infrastructure linking several major Android botnets. Traffic matching these endpoints indicates an infected device beaconing to its operator to receive tasking and exfiltrate data.

Possible Sitecore Experience Platform Pre-Auth RCE via TypeConfuseDelegate Gadget (via webserver)

This rule detects POST requests to the Sitecore Reporting Report.ashx handler carrying a parameters XML body with NetDataContractSerializer and TypeConfuseDelegate gadget markers. This is the pre-auth deserialization RCE CVE-2021-42237 that reaches Process.Start on the server. Detecting it exposes code-execution attempts against internet-facing Sitecore Experience Platform instances.

Suspicious Sneaky 2FA Phishing Kit License Check via API Key Endpoint (via proxy)

This rule detects HTTP requests to the sneakylog license verification endpoint used by the Sneaky 2FA Phishing-as-a-Service platform. Each deployed phishing kit calls the api key path on the operator infrastructure to validate its license before serving the AiTM page. Observing this callback identifies hosts interacting with the Sneaky 2FA kit infrastructure.

Suspicious PAN-OS Exploit User-Agent for CVE-2024-0012

This rule detects HTTP requests carrying the malformed User-Agent string used in exploitation of PAN-OS CVE-2024-0012 and CVE-2024-9474. This behavior matches Operation Lunar Peek where attackers chained authentication bypass and privilege escalation against management interfaces. The distinctive rv 11.0 token differs from legitimate browsers and provides a reliable signature for exploit traffic against exposed firewalls.

Possible ITG05 Headlace Staging via Mocky and Mockbin Services (via proxy)

This rule detects ITG05 Headlace retrieving staged payloads from the mocky and mockbin request-mocking services used as disposable command-and-control. Requests to these API-mocking hosts from enterprise endpoints are unusual and warrant review. The services return next-stage scripts to the infection chain.