Sigma detection rules, expert-reviewed

Suspicious SD-WAN Compromise Nim Implant C2 Beacon

This rule detects HTTP requests to the Nim implant endpoints observed in the ongoing Cisco Catalyst SD-WAN exploitation, where the backdoor uses fixed URI paths for handshake and exfiltration. The dedicated /api/v1/handshake and /exfiltrate routes reveal the implant control channel used after webshell deployment. Matching traffic indicates an active Nim implant beaconing from a compromised appliance.

Suspicious Stealth Soldier C2 Request URI (via proxy)

This rule detects HTTP POST requests to the Server Request endpoint used by the Stealth Soldier backdoor for command-and-control. The fixed URI path combined with the POST method is a structured C2 pattern that helps surface backdoor beaconing in web proxy telemetry.

Possible Ivanti EPMM CVE-2025-4428 Exploitation via format Parameter (via webserver)

This rule detects requests to the Ivanti EPMM api v2 endpoint carrying a format parameter that invokes runtime code execution, the exploitation pattern for CVE-2025-4428. Attackers embedded Java Runtime.exec calls in this parameter to achieve remote command execution. Such requests against the mifs api are a strong exploitation indicator.

Suspicious Peach Sandstorm Password Spray via go-http-client User Agent (via proxy)

This rule detects inbound authentication traffic carrying the default Go HTTP library user agent go-http-client. Peach Sandstorm used this user agent while conducting password spray attacks against enterprise sign-in endpoints for initial access.

Suspicious InvisibleFerret C2 Endpoints over Port 1224 (via proxy)

This rule detects HTTP requests to the InvisibleFerret command and control server that exposes payload, browser, clipboard and key exfiltration endpoints over TCP port 1224. The Lazarus backdoor cycles through fixed URI paths such as payload, brow, mclip and keys on this port. The pairing of the non-standard port with these named resources reveals the backdoor traffic.

Possible SysAid On-Premise Command Injection via API.jsp javaLocation Parameter (via webserver)

This rule detects exploitation of SysAid On-Premise CVE-2024-36394 where a request to the API settings endpoint supplies a javaLocation parameter with newline encoded operating system commands to achieve execution. The javaLocation parameter combined with the API.jsp endpoint is a strong exploitation signal.

Malicious Sparkling Pisces Backdoor C2 URI Pattern (via proxy)

This rule detects web requests to the fixed command-and-control URIs used by the Sparkling Pisces KLogEXE keylogger and FPSpy backdoor, which encode operator index parameters in PHP endpoints. These structured request patterns are specific to the toolset and indicate an infected host communicating with its controller.

Malicious GachiLoader C2 Beacon via X-Secret gachifamily Header

This rule detects HTTP traffic carrying the custom header value gachifamily or the GachiLoader C2 URI patterns /log and /richfamily, structural markers of the malware's command-and-control channel. These fixed protocol artifacts identify GachiLoader beaconing and tasking regardless of the C2 host in use.

Malicious Katz Stealer Command-and-Control via katz-ontop User-Agent (via proxy)

This rule detects outbound HTTP requests carrying the distinctive katz-ontop token appended to the User-Agent string by the Katz Stealer implant during command-and-control communication. Adversaries leverage this hardcoded agent identifier to beacon to their infrastructure, making detection valuable for exposing active stealer command-and-control on the network.

Suspicious Command and Control via Discord or Telegram Bot API

This rule detects processes connecting to Discord webhook or Telegram bot API endpoints, a command and control and exfiltration channel used by the Tomiris APT. The actors tunneled tasking and stolen data through Discord webhooks and Telegram bot APIs to hide inside allowed messaging traffic. Non-browser processes contacting these bot endpoints strongly suggest abuse of trusted web services for C2.

Possible FortiWeb Authentication Bypass via Path Traversal to fwbcgi (via webserver)

This rule detects in the wild exploitation of Fortinet FortiWeb CVE-2025-64446 where a request to the cmdb API traverses the path to the internal fwbcgi handler to bypass authentication and create administrative users. The combination of the cgi-bin fwbcgi target and directory traversal is a reliable exploitation marker.

SharePoint ToolShell Exploitation via ToolPane.aspx DisplayMode Edit (via webserver)

This rule detects requests to the SharePoint ToolPane.aspx endpoint with the DisplayMode Edit parameter, the exploitation vector for the ToolShell chain CVE-2025-53770 and CVE-2025-53771 that abuses Referer header handling to reach authenticated functionality without authentication. Adversaries use this request to deploy a webshell and steal ASP.NET machine keys.

Possible Hive0051 GammaLoad C2 Beacon via Crafted User-Agent (via proxy)

This rule detects the distinctive User-Agent string used by Hive0051 GammaLoad implants for victim profiling during command-and-control. The agent appends a host token followed by an eight-character uppercase hex identifier and a keyword delimited by repeated semicolons and slash-dot sequences. This structure does not occur in standard browser traffic.

Possible ERMAC or Hook Android Malware C2 via PHP Endpoint URI Pattern

This rule detects HTTP requests to the distinctive /php/<token>.php/ URI structure used by the ERMAC and Hook Android banking malware families for encrypted command-and-control. The trailing-slash PHP endpoint carrying an AES and Base64 encoded body is a reliable network fingerprint of these C2 channels.

Possible GCleaner Loader C2 Check-in via cpa ping php Endpoint via proxy

This rule detects GCleaner loader command and control check-ins that request the /cpa/ping.php endpoint carrying a substr parameter. GCleaner is a pay per install loader that pulls follow on payloads after beaconing to its panel. The distinctive URI and query structure identifies the loader control channel independent of the rotating C2 IP addresses.