Sigma detection rules, expert-reviewed

Possible SonicWall Credential Testing via userLogin Endpoint

This rule detects HTTP POST requests to the SonicWall /cgi-bin/userLogin endpoint, the interface used by NetExtender and web login for credential submission. In the observed campaign this endpoint is hit through commercial proxy infrastructure to test credentials against internet-facing SonicWall firewalls. A high rate of such POST requests indicates brute-force or credential-stuffing activity against the SSL-VPN login surface.

Suspicious CurKeep Backdoor C2 API Endpoints (via proxy)

This rule detects web requests to the shell and file API endpoints used by the CurKeep backdoor for command-and-control in the Stayin Alive campaign. The fixed api shell and api file URI paths reflect the backdoor tasking channel and help surface implant traffic in proxy logs.

Suspicious UPDTAE Backdoor Reverse Shell HTTP Beacon via Quad7 Operators

This rule detects HTTP requests carrying the hardcoded User-Agent value IOT together with POST requests to the /iot/post URI, the reverse shell beaconing pattern of the UPDTAE backdoor deployed by the Quad7 operators. The implant polls its C2 roughly every thirty seconds using this fixed header and path. The unusual static User-Agent and endpoint make this a reliable network indicator.

Malicious wp2shell User Agent in Web Requests (via webserver)

This rule detects inbound web requests carrying the wp2shell or rezwp2shell user-agent strings used by the exploitation tooling for CVE-2026-63030 and CVE-2026-60137. These agent values identify automated scanning and exploitation attempts against WordPress. The strings are tool-specific and rarely seen in benign traffic.

Malicious SharePoint ToolShell Exploitation Request to ToolPane (via webserver)

This rule detects the exploitation request pattern for the SharePoint ToolShell vulnerabilities, a POST to the ToolPane endpoint in edit display mode with a spoofed SignOut referer used to bypass authentication. This request pattern corresponds to CVE-2025-49706 and CVE-2025-49704 exploitation rather than legitimate access.

Possible Check Point SmartConsole Token Redemption Endpoint Access (via proxy)

This rule detects HTTP requests to the SmartConsole /cpmws/LoginSvcRemote token redemption endpoint. Rapid7 documented abuse of this SOAP endpoint to redeem forged SSO tokens as part of the CVE-2026-16232 authentication bypass against Check Point management servers. Legitimate SmartConsole clients also reach this endpoint so alerts should be correlated with unexpected source hosts or forged application token audit events.

Suspicious Ivanti Connect Secure License Keys-Status Command Injection Request (via webserver)

This rule detects HTTP requests to the Ivanti Connect Secure /api/v1/license/keys-status/ endpoint that embed a shell command separator followed by an interpreter reference. Actors chained a semicolon and python invocation onto this path to achieve command injection and drop reverse shells. Requests to this endpoint carrying inline command syntax indicate active exploitation.

Malicious Apache Camel Exec Header Injection

This rule detects HTTP requests containing Apache Camel exec-command headers used to bypass the header filter in CVE-2025-27636 and CVE-2025-29891. Attackers inject CamelExecCommandExecutable and CamelExecCommandArgs headers to run arbitrary commands on vulnerable Camel routes. Presence of these headers in inbound traffic indicates exploitation attempts.

Suspicious DEEPPOST Data Exfiltration URI Pattern via BrazenBamboo

This rule detects HTTP requests to the /api/third/file/upload/ endpoint used by the BrazenBamboo DEEPPOST exfiltration tool to upload stolen files. DEEPPOST posted collected data to attacker infrastructure over a fixed API path. Detecting this URI reveals active data theft from compromised hosts.

Malicious TBK DVR Command Injection Exploitation via RondoDox (via webserver)

This rule detects RondoDox botnet exploitation of the TBK DVR command injection flaw CVE-2024-3721 by requesting the device.rsp endpoint with the distinctive S_O_S_T_R_E_A_MAX command marker. This request injects operating system commands to drop the loader. The pattern is unique to the exploit.

Malicious Credential Harvesting Request via All-in-1 PHP Endpoint (via proxy)

This rule detects HTTP requests to an All-in-1.php endpoint carrying user and password query parameters characteristic of the GTFire phishing scheme credential harvesting kit. GTFire lures victims through translate.goog and web.app redirect hops before submitting stolen credentials via crafted GET parameters. Surfacing this traffic reveals active phishing credential theft against organization users.

Malicious OysterLoader C2 Beacon Using WordPressAgent User Agent

This rule detects outbound web requests carrying the distinctive WordPressAgent FingerPrint user agent used by OysterLoader. The loader beacons to its command server with this hardcoded agent and reaches encrypted endpoints. A non browser user agent of this exact form is a high confidence network indicator of OysterLoader activity.

Suspicious Tycoon 2FA Credential Exfiltration Fields

This rule detects HTTP requests carrying the Tycoon 2FA exfiltration parameters bltdip, bltdref, bltdua and bltddata. These custom field names package the stolen victim context and session data sent back to the phishing kit, uniquely marking AiTM credential theft.

Possible MOVEit Transfer SQL Injection via X-siLock-SessVar Header

This rule detects requests to the MOVEit Transfer guestaccess endpoint carrying an X-siLock-SessVar header with SQL injection syntax, matching the header-driven SQLi documented by Assetnote for CVE-2023-34362. Attackers set session variables through this header to inject into backend queries and stage remote code execution. The endpoint and header combination indicates targeted injection rather than benign guest access.

MintsLoader Stage-Two C2 Beacon via htr.php Key and Campaign Parameters (via proxy)

This rule detects MintsLoader stage-two command-and-control beacons that request the htr.php endpoint with key, host id, and campaign parameters against DGA-generated domains. Adversaries leverage this structured request to fetch the next-stage payload keyed to the infected host, making the endpoint-and-parameter combination a strong C2 indicator.