Sigma detection rules, expert-reviewed

Suspicious Nimbus Manticore Agent Polling Endpoints over HTTP (via proxy)

This rule detects HTTP requests to the /agent/init, /agent/poll, and /agent/result endpoints used by the Nimbus Manticore native implant to register, poll for tasking, and return results from Azure-hosted command-and-control infrastructure. Adversaries leverage these structured routes to operate the beacon while blending into web traffic, making detection valuable for exposing active command-and-control.

Suspicious HTTP POST to Local AI Malware Exfil Endpoint (via proxy)

This rule detects HTTP POST requests to the /crypto-data endpoint used by AI-assisted malware to transmit collected cryptocurrency and victim data. The specific exfiltration path combined with the POST method reflects the malware sending stolen data to its collection service.

Malicious wp2shell Batch Endpoint Exploitation (via webserver)

This rule detects POST requests to the WordPress batch REST endpoint that return HTTP 207 multi-status, matching in-the-wild exploitation of wp2shell for CVE-2026-63030 and CVE-2026-60137. Attackers chain requests through the batch route to reach vulnerable handlers and drop a web shell. The 207 response to the batch route is characteristic of this exploitation.

Suspicious Typosquatted Apple User-Agent Beaconing from Ivanti Implant (via proxy)

This rule detects HTTP requests bearing a typosquatted Apple user-agent string that substitutes look-alike characters for the letter l. Implants deployed against Ivanti Connect Secure used App1e and AppIe user-agents during their dormancy and beaconing. A user-agent forging the Apple brand with homoglyphs is a distinctive command-and-control fingerprint.

Possible AntSword Webshell Access on Ivanti EPMM 403.jsp

This rule detects HTTP POST requests to the 403.jsp resource on Ivanti EPMM carrying the AntSword webshell parameter k. It is tied to a Java webshell appended to the legitimate 403.jsp error page during EPMM exploitation to provide operators remote command execution. Detecting these requests reveals interaction with the deployed webshell.

WezRat Command and Control HTTP URI Pattern

This rule detects HTTP requests matching the WezRat command and control URI scheme including the distinctive wez Agent InsMch endpoint. The backdoor tasks and reads data through these fixed URI paths while spoofing a firefox user agent. Detecting the URI pattern reveals active command and control traffic.

Malicious Arkanix Stealer C2 Communication via Custom User-Agent

This rule detects outbound HTTP traffic carrying the hardcoded User-Agent string used by the Arkanix C++ and Python infostealer. Kaspersky observed Arkanix identifying itself to its panel with the ArkanixStealer client string while requesting stealer and hidden VNC modules. This distinctive agent is a reliable indicator of an infected host communicating with the stealer backend to receive payloads and exfiltrate credentials.

Malicious Cobalt Strike Malleable C2 URI Beacon via Proxy

This rule detects HTTP requests to the Cobalt Strike malleable profile URI /1/events/com.amazon.csm.csa.prod observed in the Nitrogen 2.0 campaign. This fixed path masquerades as Amazon telemetry to blend with normal traffic. Detecting it identifies beaconing to Cobalt Strike infrastructure.

Suspicious Access to MOVEit Transfer Internal machine2 Endpoint

This rule detects HTTP access to the MOVEit Transfer machine2.aspx endpoint, which Assetnote identified during patch diffing as an internal-only interface reachable through SSRF in CVE-2023-34362. External or unexpected requests to this endpoint indicate an attacker has pivoted past the intended trust boundary. Because legitimate clients should not reach machine2 directly, such access is a strong exploitation signal.

Possible Access-Code Validation Beacon to Malware Delivery C2 (via proxy)

This rule detects HTTP requests to an /api/submit endpoint carrying a code parameter, the access-code validation call made by a DocuSign-themed loader before it retrieves its second stage in a Vidar delivery chain analyzed by Joe Sandbox. Adversaries gate payload delivery behind server-side code validation to evade sandboxes and analysts, so this submit-with-code request pattern surfaces the loader contacting its delivery infrastructure.

Possible FortiOS Authentication Bypass via local_access_token on WebSocket CLI Endpoint (via webserver)

This rule detects exploitation of FortiOS and FortiProxy CVE-2024-55591 where an unauthenticated request to the Node.js websocket CLI endpoint supplies a local_access_token to bypass session validation and gain super_admin access. The combination of the ws cli path and the token parameter is not seen in normal administration.

Suspicious Go HTTP Client User Agent via Proxy

This rule detects outbound web requests carrying the default Go HTTP client user agent, which Peach Sandstorm used from Azure infrastructure during password spray attacks against target tenants. The user agent is a weak but useful signal that can highlight automated credential-guessing traffic when correlated with failed authentication.

Malicious Mirage Kitten C2 Communication via Keyboard-Walk URIs (via proxy)

This rule detects HTTP requests to the distinctive keyboard-walk URI paths used by Mirage Kitten malware for command-and-control against Middle East and Africa targets. These fixed, non-dictionary URI stems are strong C2 indicators and their presence in web traffic points to active beaconing from a compromised host.

Possible VMware Workspace ONE Access Authentication Bypass via Embedded Auth Broker Callback (CVE-2022-22972) (via webserver)

This rule detects POST requests to the Workspace ONE Access embedded auth broker callback endpoint used in the CVE-2022-22972 host header authentication bypass. This maps to exploitation where an attacker supplies a crafted Host header to trick the internal auth broker into issuing a valid session. Successful abuse grants unauthenticated administrative access to the appliance.

Malicious Stealth Soldier C2 User-Agent (via proxy)

This rule detects outbound web requests carrying the hardcoded Stealth Soldier user-agent string used by the Stealth Soldier backdoor in espionage attacks across North Africa. This static, tool-specific user-agent is a distinctive command-and-control fingerprint that legitimate clients do not present.