Sigma detection rules, expert-reviewed

Suspicious Hardcoded Legacy Chrome User-Agent from Sparkling Pisces Tooling (via proxy)

This rule detects HTTP requests carrying the hardcoded legacy user-agent string Chrome/31.0.1650.57 embedded in Sparkling Pisces malware. Traffic from this obsolete browser version is anomalous on modern networks and can reveal the keylogger or backdoor beaconing out.

Suspicious Vidar Second-Stage Download via Structured index.zip Dropzone Paths (via proxy)

This rule detects HTTP requests for index.zip archives under file-type-segmented dropzone paths such as /pe/, /dll/, /py/, /ps/ and /bat/, the second-stage retrieval pattern used by an access-code-gated DocuSign-themed delivery chain that dropped the Vidar information stealer as analyzed by Joe Sandbox. Adversaries organize payload dropzones by artifact type behind an access gate, so requests matching this structured path layout indicate retrieval of a staged payload.

Suspicious DeadLock Ransomware C2 Proxy Request to prrq.php Endpoint (via proxy)

This rule detects HTTP requests to the /prrq.php proxy endpoint used by DeadLock ransomware to reach C2 proxy servers whose addresses are rotated through Polygon smart contracts per Group-IB. Adversaries route control and ransom-negotiation traffic through these proxy PHP endpoints, so requests to this path signal DeadLock C2 activity.

Malicious Cobalt Strike C2 Beaconing via REST URI Paths and Legacy MSIE User-Agent (via proxy)

This rule detects HTTP command-and-control beaconing that combines the /rest/funcStatus and /rest/policy/3/ URI paths with a legacy MSIE 7.0 .NET CLR User-Agent, a Malleable C2 profile used by a multi-stage Cobalt Strike loader analyzed by Joe Sandbox. Adversaries craft these profiles to blend beacon traffic into ordinary web requests, making the combined URI and User-Agent pattern a reliable signal of an active beacon before hands-on-keyboard activity.

Possible Adversary-in-the-Middle Proxy Login via Crafted URL Parameters

This rule detects HTTP requests carrying the qrc and login_hint URL parameters used by an adversary-in-the-middle proxy that relays victims to a spoofed Outlook login page. This tradecraft was observed in an HTML smuggling campaign that harvested Microsoft 365 credentials and session tokens. AiTM session theft bypasses multi-factor authentication and enables account takeover.

Malicious File Upload to SAP NetWeaver Metadata Uploader Endpoint

This rule detects HTTP POST requests to the SAP NetWeaver Visual Composer metadatauploader endpoint exploited in CVE-2025-31324. Threat actors abuse this unauthenticated upload flaw to drop JSP web shells and achieve remote code execution on internet-facing SAP servers. Detecting these uploads catches initial access before web shell deployment.

Possible Citrix NetScaler CVE-2023-4966 Session Token Disclosure

This rule detects HTTP requests to the OpenID configuration discovery endpoints on Citrix NetScaler that are abused by CVE-2023-4966 to disclose session memory and steal valid session tokens. When paired with an abnormally large Host header these requests indicate exploitation attempts against an exposed NetScaler appliance for session hijacking.

Suspicious CTF-Framed Vulnerability Scanner User Agent via Webserver

This rule detects HTTP User-Agents matching the CTF and CVE-hunt framing that attackers use while jailbreaking LLM services and mass-scanning for vulnerabilities. These agents self-identify with capture-the-flag and CVE-scanner labels as part of automated probing. Their presence indicates reconnaissance against internet-facing AI applications.

Possible Mamba 2FA AiTM Phishing URL Pattern

This rule detects HTTP requests matching the Mamba 2FA adversary in the middle phishing URL structure of a single letter path segment m, n or o followed by a query string carrying a Base64 encoded victim token. Mamba 2FA relays Microsoft 365 credentials and session cookies through this pattern to bypass multifactor authentication. Because the pattern is broad it should be corroborated with the known relay domains before action.

Suspicious Data Exfiltration to Telegram Bot API sendDocument (via proxy)

This rule detects HTTP requests to the Telegram Bot API sendDocument endpoint, the exfiltration channel used by 0bj3ctivityStealer to upload harvested credentials and wallet data as documents to an attacker-controlled bot. Adversaries leverage Telegram as a resilient exfiltration service that blends with legitimate traffic, making detection of bot document uploads useful for exposing data theft.

CastleLoader Stager HTTP Beacon via Misspelled GoogeBot User-Agent (via proxy)

This rule detects outbound HTTP requests carrying the misspelled GoogeBot user-agent used by the CastleLoader stager to retrieve follow-on TAG-150 payloads while masquerading as a search-engine crawler. Adversaries leverage crawler-like user-agents to blend malicious downloads into ordinary web traffic, making this distinctive typo a reliable delivery-stage indicator.

Suspicious SSRF Probe for Cloud Instance Metadata Service

This rule detects HTTP requests attempting to reach the cloud instance metadata service link local address through a url parameter. Attackers abuse server side request forgery to pull IAM security credentials from the metadata endpoint of a misconfigured public facing application.

IDAT Loader Delivery via Compromised WordPress wpstream youtube.min.js (via proxy)

This rule detects HTTP requests to the wpstream plugin youtube.min.js path used by the UAC-0184 IDAT Loader campaign to stage its steganographic payload from a compromised WordPress site. Adversaries leverage a legitimate-looking script path on a hijacked site to blend delivery traffic with normal content requests, making early detection critical for catching the intrusion at the delivery stage before Remcos RAT is deployed.

Suspicious HTTP Beacon Using Rare MyIE User Agent (via proxy)

This rule detects outbound HTTP traffic carrying the uncommon MyIE user agent string used by the MemFun implant in a suspected China-based espionage operation against military targets in Southeast Asia. The hardcoded user agent identifies the malware's beaconing channel, so matching traffic to external hosts indicates active command and control.

Suspicious Error 524 Decoy Smishing Phishing Endpoint Access (via proxy)

This rule detects access to the single-page phishing endpoints used by the Error 524 decoy smishing campaign, including getApp application-id lookups and WebSocket uuid exfiltration paths. The campaign hides credential and card data theft behind fake Cloudflare Error 524 pages. Detecting these URIs reveals victims interacting with the phishing infrastructure.