Sigma detection rules, expert-reviewed

Possible FortiWeb Authentication Bypass via Path Traversal to fwbcgi (via webserver)

This rule detects HTTP requests to the FortiWeb management CMDB admin API that traverse into the internal fwbcgi CGI handler. This request pattern corresponds to CVE-2025-64446 which lets unauthenticated attackers create administrator accounts. Legitimate API clients do not reach cgi-bin through path traversal.

Malicious Lazarus ScoringMathTea WordPress C2 URL Path

This rule detects HTTP requests to the compromised WordPress command-and-control path used by the ScoringMathTea RAT in the Lazarus UAV-sector campaign. The RAT beacons to a theme functions file at inc/functions/function-hand.php, and this structured path is a durable network indicator of the malicious channel.

Possible F5 iControl REST Remote Code Execution via Util Bash Endpoint

This rule detects POST requests to the F5 iControl REST util bash endpoint which grants arbitrary command execution when reached after the SSRF authentication bypass of CVE-2021-22986 documented by NCC Group. Access to this endpoint by an unauthenticated actor indicates full appliance compromise.

Suspicious 0ktapus Phishing Kit Credential Post Path Access

This rule detects web requests to the /login/email and /login/identifier endpoints combined with the Poll.js resource which are DOM and URL fingerprints of the 0ktapus phishing kit that impersonates Okta and single sign-on portals. This is important because these paths are hardcoded artifacts of the kit used to harvest credentials and multi-factor codes so their presence in proxy logs indicates a user interacting with a 0ktapus phishing site.

Malicious Tycoon 2FA AiTM Phishing WebSocket Channel

This rule detects the Tycoon 2FA phishing kit opening its adversary-in-the-middle relay over the fixed /web6socket/socket.io WebSocket endpoint. This path is unique to the kit and identifies a victim connecting to the AiTM proxy used to steal session cookies.

Suspicious Malware Delivery via Discord CDN Attachment

This rule detects downloads of archive and executable payloads from the Discord content delivery network attachments path which criminal actors abuse to host and distribute malware. Because Discord is a widely trusted service this channel is frequently used to bypass reputation based controls for staging second stage payloads.

Suspicious BumbleBee C2 URI Pattern (via proxy)

This rule detects outbound web requests to the BumbleBee command-and-control URI paths such as get_load, gate and gates. These fixed endpoint names are used by the loader to fetch tasks and payloads. Matching this beacon pattern surfaces infected hosts communicating with attacker infrastructure for tasking and payload delivery.

Malicious Cloud Metadata Credential SSRF via HTTP (via proxy)

This rule detects HTTP requests to the cloud instance metadata IAM security credentials path on Linux hosts. Attackers exploiting the LMDeploy server side request forgery vulnerability coerced the inference engine into fetching temporary IAM credentials from the metadata service. Requests reaching the metadata credentials endpoint from an application server indicate credential theft through SSRF.

Malicious Discord RAT Module Download from GitHub via Proxy

This rule detects retrieval of Discord RAT plugin modules hosted on the public Discord-RAT-2.0 GitHub repository. The malware dynamically downloads and reflectively loads capability modules such as credential theft, webcam capture, and token stealers from this raw content path.

Suspicious PHP Webshell Access under WordPress Cache Directory

This rule detects HTTP requests to a PHP file located in the WordPress wp-content cache directory. Legitimate WordPress caching stores static HTML and never executable PHP, so a PHP file served from this path indicates a dropped webshell used for post exploitation command execution.

SharePoint spinstall Webshell Deployment after ToolShell Exploitation (via webserver)

This rule detects requests to spinstall or related aspx webshells dropped after ToolShell exploitation of SharePoint CVE-2025-53770, which extract the ValidationKey and DecryptionKey machine key material from the server. Adversaries retrieve these keys to forge authentication and regain access even after patching.

Download of Fake Messaging App Update APK

This rule detects proxy or web download requests for APK files masquerading as updates for popular messaging and social apps. Arid Viper distributed Android spyware as fake update packages such as whatsapp-update.apk, messenger-update.apk, google-play-update.apk and instagram-update.apk. These update-themed APK names impersonate trusted applications to trick users into sideloading spyware.

Malicious SharePoint spinstall Web Shell Access Leaking Machine Keys

This rule detects web requests to the spinstall web shell dropped during on-premises SharePoint exploitation. Microsoft observed spinstall0.aspx and its variants deployed to leak the server MachineKey via GET requests. Retrieval of the ASP.NET machine key enables forged payloads and full compromise, so any access to this web shell is a critical finding.

Suspicious Access to SonicWall SMA JSP Webshell

This rule detects HTTP requests to JSP webshells planted on a compromised SonicWall SMA appliance. In the 0-day exploitation the actor placed error.jsp and errorDialog.jsp under the workplace directory and proxied them to a local listener to execute commands. Access to these attacker-planted endpoints indicates active webshell interaction and hands-on-keyboard control of the appliance.

Possible MOVEit Transfer Exploitation via MOVEitISAPI action m2 and X-siLock Headers

This rule detects requests to MOVEitISAPI.dll with action=m2 that also carry X-siLock control headers, matching the MOVEit Transfer RCE chain analyzed by Assetnote for CVE-2023-34362. The X-siLock headers drive internal session-variable manipulation used in the SQL injection to RCE path. Detecting this handler and header pairing surfaces active exploitation of the MOVEit ISAPI extension.