Sigma detection rules, expert-reviewed

Possible Citrix NetScaler Gateway Buffer Overflow via formssso Endpoint (CVE-2023-3519) (via webserver)

This rule detects requests to the NetScaler Gateway formssso single sign-on endpoint with a start event and a target parameter. This maps to CVE-2023-3519 where an oversized target value overflows a stack buffer to achieve unauthenticated remote code execution. An attacker uses this to gain a foothold on the appliance.

Possible Magento XXE via guest-carts estimate-shipping-methods (CVE-2024-34102)

This rule detects POST requests to the Magento guest-carts estimate-shipping-methods REST endpoint whose body contains XML external entity syntax such as DOCTYPE, ENTITY, SYSTEM, or a php filter wrapper, matching the nested deserialization XXE for CVE-2024-34102 documented by Assetnote. Attackers abuse this to read sensitive files like app/etc/env.php and harvest secrets. The endpoint combined with XXE markers indicates targeted exploitation rather than normal shipping estimation.

Possible Progress WS_FTP Ad Hoc Deserialization via AHT_DEFAULT_UPLOAD_PARAMETER Marker

This rule detects multipart form-data uploads to WS_FTP Ad Hoc that carry the AHT_DEFAULT_UPLOAD_PARAMETER marker, matching the .NET BinaryFormatter deserialization exploit for CVE-2023-40044 documented by Assetnote. The marker delimits a base64 serialized object that the IIS module deserializes into code execution. Presence of this internal marker in a request body indicates targeted exploitation of the WS_FTP HTTP module.

Possible MOVEit Transfer SSRF via MOVEitISAPI action m2

This rule detects requests to MOVEitISAPI.dll with action=m2, the server-side request forwarding primitive identified through patch diffing by Assetnote for CVE-2023-34362. The m2 action proxies requests toward internal-only MOVEit endpoints and is a core step in reaching the vulnerable machine2 logic. Detecting this action on the ISAPI extension highlights probing or exploitation of the internal request path.

Suspicious MOVEit Transfer Token Request with grant_type session

This rule detects POST requests to the MOVEit Transfer token API using grant_type=session, matching the authentication step in the Assetnote MOVEit Transfer RCE chain for CVE-2023-34362 where a smuggled session is exchanged for a valid token. Attackers use this to convert manipulated session state into authenticated API access. The specific grant type on the token endpoint distinguishes exploitation from normal password or refresh grants.

Possible Sitecore SPEAK Bundle Arbitrary File Read via Path Traversal

This rule detects requests to the Sitecore SPEAK bundle endpoint with an absolute path traversal in the f parameter terminated by an encoded fragment, matching the arbitrary file read of web.config described in the Assetnote Sitecore RCE research. Attackers use this primitive to read sensitive configuration and harvest secrets for further exploitation. The combination of the bundle path and traversal markers indicates targeted file disclosure rather than normal asset loading.

Possible Craft CMS RCE via Query-String CLI Option Injection

This rule detects HTTP requests that inject Yii/Craft CLI options such as --templatesPath or --configPath through the query string, abusing PHP register_argc_argv on Craft CMS. This technique matches the Assetnote Craft CMS PHP footgun research where attacker-controlled argv values point to remote FTP or PHP stream wrappers to achieve remote code execution. Detecting these option strings early surfaces exploitation of the underlying command-line parsing footgun before code execution.

Possible Bitbucket Pre-Auth RCE via git archive exec Null-Byte Injection (CVE-2022-36804) (via webserver)

This rule detects requests to the Bitbucket archive REST endpoint carrying a null-byte encoded prefix and a git archive exec directive. This maps to CVE-2022-36804 where the prefix parameter is abused to inject arguments into the git archive command. An attacker uses this to spawn a shell and achieve unauthenticated remote command execution on the server.

Possible Unauthenticated Admin Creation in Dynamicweb CVE-2022-25369

This rule detects HTTP requests to the Dynamicweb setup Default.aspx page invoking the createadministrator action with supplied credentials. CVE-2022-25369 is a logic flaw allowing unauthenticated administrator creation as documented by Assetnote, which attackers chain into a webshell upload for remote code execution.

Possible DotCMS Path Traversal Webshell Upload via content API CVE-2022-26352

This rule detects POST requests to the DotCMS /api/content/ endpoint whose multipart filename contains directory-traversal sequences and a JSP extension. CVE-2022-26352 is an arbitrary file upload that drops a JSP webshell into the Tomcat webroot as documented by Assetnote, giving attackers remote code execution.

Suspicious Avaya Aura ACS Path Traversal to Admin Login via Semicolon Bypass (via webserver)

This rule detects requests to the Avaya Aura ACS admin login path that use a semicolon path-segment traversal such as /acs/..;/admin/public/login.jsp to bypass access controls, seen alongside a reflected XSS via the error parameter. This pattern was used to reach protected admin functionality on the appliance. Detecting it surfaces access-control bypass attempts against Avaya Aura Device Services.

Possible Avaya Aura Device Services WebDAV PHP Webshell Upload via PhoneBackup (via webserver)

This rule detects WebDAV PUT requests writing a PHP file into the Avaya Aura Device Services PhoneBackup directory, optionally with the User-Agent AVAYA seen in the exploit. This is the RCE path where an attacker uploads a PHP webshell and then requests it for command execution. Detecting it surfaces webshell deployment against Avaya Aura Device Services.

Possible Aspera Faspex Pre-Auth RCE via YAML Deserialization in package_relay (via webserver)

This rule detects POST requests to the Aspera Faspex package_relay relay_package endpoint, the injection point for a pre-auth RCE where the external_emails field carries a serialized YAML payload deserialized by YAML.load. Attackers abuse this Ruby on Rails unsafe deserialization to execute arbitrary commands. Detecting it surfaces exploitation attempts against internet-facing Faspex servers.

Malicious Dynamicweb Unauthenticated Administrator Creation via Setup Default.aspx (via webserver)

This rule detects requests to the Dynamicweb Access Setup Default.aspx page invoking the createadministrator action with adminusername and adminpassword parameters. This logic flaw in Dynamicweb 9.5.0 through 9.12.7 lets an unauthenticated attacker create an administrator account and then upload an ASPX webshell for RCE. Detecting it surfaces account creation abuse leading to full server compromise.

Possible DotCMS Arbitrary File Upload and JSP Webshell Drop via api content (via webserver)

This rule detects multipart POST or PUT requests to the DotCMS content API whose filename carries path traversal sequences aimed at the webapps ROOT html directory. This is the 0day exploitation path that drops a .jsp webshell outside the intended upload location for remote code execution. Detecting it surfaces webshell installation against internet-facing DotCMS instances.