Sigma detection rules, expert-reviewed

Suspicious PHP Webshell Access with Hardcoded Key

This rule detects POST requests containing the hardcoded key iUqPd tied to the PHP webshell deployed after PAN-OS exploitation. This behavior matches Operation Lunar Peek where operators executed system commands through a webshell parameter guarded by a static key. Webshell interaction on a firewall or web-facing host indicates active post-exploitation command execution.

Suspicious UPSTYLE Command Channel Pattern in Web Requests via CVE-2024-3400

This rule detects web requests carrying the base64 command pattern wrapped in img brackets used by the UPSTYLE backdoor deployed in Operation MidnightEclipse against CVE-2024-3400. The backdoor reads operator commands embedded in crafted requests that surface in the device error log. Detecting this pattern surfaces the covert command channel used to control the compromised firewall.

Malicious Ivanti Connect Secure Path Traversal Exploitation of CVE-2024-21887

This rule detects HTTP requests to the Ivanti Connect Secure totp user-backup-code endpoint containing path traversal sequences, matching exploitation of CVE-2023-46805 and CVE-2024-21887 described by Unit 42. Attackers chain authentication bypass and command injection through this traversal path to gain unauthenticated remote code execution on the appliance.

Malicious MOVEit moveitisapi Exploitation Request via webserver

This rule detects HTTP requests to moveitisapi.dll carrying the action=m2 parameter associated with the MOVEit Transfer CVE-2023-34362 SQL injection exploitation flow. These crafted requests drive the injection and web shell interaction, so matching this endpoint and parameter reveals attempted or successful exploitation at the web tier.

Malicious GenAI Browser Extension C2 and PAC Redirection (via proxy)

This rule detects web traffic to the command-and-control WebSocket endpoint, proxy auto-config file, and data-exfiltration API used by high-risk generative-AI browser extensions reported by Unit 42. These extensions hijack browser proxy settings and read user email and session data, exfiltrating it to attacker infrastructure.

Suspicious Non-Standard HTTP Methods Used for Covert C2 (via proxy)

This rule detects HTTP requests using the non-standard verbs POT, DPF, UPF, CPF, and LPF employed by malware in a suspected China-based espionage operation to encode command and control operations. These invalid HTTP methods are not produced by legitimate clients, so their presence marks covert C2 signaling.

Malicious PUBLOAD Fake Windows Update C2 Request via Proxy (via proxy)

This rule detects outbound HTTP requests to the fake Windows Update redirect URI used by the PUBLOAD downloader attributed to Stately Taurus. The path masquerades as a legitimate Microsoft update redirect while delivering ToneShell and Bookworm payloads. Catching this beacon reveals an infected host reaching attacker command-and-control disguised as benign update traffic.

Possible Prometei Botnet C2 URI Pattern

This rule detects outbound HTTP requests matching the Prometei botnet download and command-and-control URI patterns, including architecture-tagged downloader requests and the p.cgi tasking endpoint. The botnet retrieves UPX-packed ELF payloads from a k.php path and beacons to a cgi-bin p.cgi endpoint. These structured URI patterns identify Prometei infections on the network.

Possible Lampion C2 Beacon With dados Parameter

This rule detects outbound HTTP GET requests carrying a dados URL parameter used by the Lampion malware for command-and-control tasking and data transfer. The malware appends stolen or beacon data to this parameter when contacting its infrastructure. Monitoring this structured request pattern helps surface active Lampion C2 traffic.

Malicious PubLoad C2 Beacon Spoofing Microsoft Host (via proxy)

This rule detects PubLoad C2 traffic that spoofs the Host header as www.asia.microsoft.com while requesting the URI path v6-winsp1-wuredir, a pattern used by Stately Taurus to disguise beacons as Windows Update traffic. The mismatch between a Microsoft-looking Host and the non-Microsoft destination reveals the covert command-and-control channel.

Suspicious OWA Proxy User-Agent Indicating Mailbox Access

This rule detects the anomalous Outlook Web Access proxy User-Agent Client=OWA;Action=ViaProxy tied to attacker mailbox access. This behavior matches a phishing campaign against European organizations where compromised accounts were used to reach mailboxes through OWA proxying. This distinctive User-Agent signals post-compromise mailbox interaction and potential email collection.

Malicious BeaverTail C2 Download Path Request (via proxy)

This rule detects web requests to the /pdown and /client download paths used by the BeaverTail and InvisibleFerret malware in the DPRK Contagious Interview campaign, typically served over port 1224. These fixed retrieval paths indicate a lured victim fetching second-stage payloads from actor infrastructure.

Malicious Splinter Post-Exploitation Implant C2 URI Pattern (via proxy)

This rule detects web requests to the fixed HTTP command-and-control endpoints used by the Splinter post-exploitation red-team implant, including its heartbeat, task-event, and file-transfer paths. These structured URI patterns are unique to the tool and indicate an active implant beaconing to its controller.

Suspicious Cobalt Strike Download Profile POST to pkg Path

This rule detects HTTP traffic matching a public Cobalt Strike Malleable C2 profile that fetches staged content over download URIs and returns tasking through POST requests to pkg paths. The pairing of these request shapes reflects beacon staging and result submission channels. Detecting this profile behavior exposes Cobalt Strike command and control masquerading as ordinary web downloads.

Suspicious Cobalt Strike OCSP Malleable C2 Profile Traffic

This rule detects HTTP traffic matching the public Cobalt Strike OCSP Malleable C2 profile where beacon check-ins and tasking ride on ocsp URIs while spoofing the Microsoft-CryptoAPI user agent. Attackers reuse this profile to disguise command and control as legitimate certificate validation traffic. Detecting the combination of the crafted ocsp path and the CryptoAPI agent exposes beaconing that mimics benign OCSP requests.