Sigma detection rules, expert-reviewed

Possible Yellowfin BI JWT Forgery via refresh-tokens Endpoint

This rule detects HTTP requests to the Yellowfin BI /api/refresh-tokens endpoint associated with forged JWT abuse. Assetnote used hardcoded signing keys to mint tokens against this API before triggering JNDI-injection remote code execution, so anomalous access here can indicate exploitation.

TAG-144 Payload Staging via MyCustomAgent User-Agent (via proxy)

This rule detects HTTP requests using the hardcoded MyCustomAgent/1.0 user-agent that the TAG-144 loader sets when pulling staged payloads from paste services via ServerXMLHTTP. Adversaries leverage a fixed non-browser user-agent to fetch second-stage code, making this distinctive string a reliable delivery-stage indicator.

Possible Path Traversal Local File Inclusion Against Exposed Cloud Function (via webserver)

This rule detects web requests containing directory traversal sequences targeting sensitive Unix files such as etc/passwd, matching the local file inclusion probes sent to exposed Cloud Function endpoints. Adversaries use these payloads to read arbitrary files and enumerate a container before escalating to remote code execution, so traversal attempts against run.app services should be reviewed.

Possible Citrix NetScaler SAML Endpoint Abuse for Pre-Auth RCE (CVE-2023-3519) (via webserver)

This rule detects requests to the NetScaler SAML processing endpoints associated with CVE-2023-3519 exploitation. This maps to abuse of the SAML login and artifact endpoints where crafted assertions trigger the memory corruption vulnerability. An attacker leverages these unauthenticated endpoints to achieve remote code execution on the gateway.

Malicious CR4T C2 Beacon via TroubleShooter User-Agent (via proxy)

This rule detects outbound HTTP requests carrying the distinctive TroubleShooter User-Agent string which the CR4T implant of the DuneQuixote campaign uses when communicating with its command-and-control server.

Suspicious FakeBat Fake Browser Update Stats and Download Endpoints (via proxy)

This rule detects requests to the FakeBat distribution endpoints get_stats.php and the misspelled dwnl_standart.php used by fake browser update pages to track victims and serve the MSIX payload. The typo-laden download path is a distinctive campaign artifact hosted on doggygangers[.]com. This surfaces drive-by delivery of FakeBat leading to LummaC2.

Malicious XE Group thump.aspx Webshell Interaction via File Directory Parameters (via webserver)

This rule detects requests to the XE Group .thump.aspx webshell that carry the file-listing and file-read parameters the operator uses to browse and exfiltrate server files. The hidden-prefixed ASPX name combined with these directory parameters distinguishes webshell tasking from normal application traffic.

Possible Pre-Auth SSRF via VMware Workspace One UEM BlobHandler CVE-2021-22054

This rule detects HTTP requests to the VMware Workspace One UEM BlobHandler.ashx endpoint carrying a Url parameter. CVE-2021-22054 is a pre-authentication server-side request forgery reached through this handler with an encrypted Url payload as detailed by Assetnote, letting attackers pivot to internal services and cloud metadata.

Suspicious Khmer Shadow C2 Beacon with Malformed Chrome User-Agent (via proxy)

This rule detects outbound requests carrying the malformed Chrome 131 on Windows 10 user-agent string used by the Khmer Shadow implant to blend its C2 traffic. Adversaries craft this non-standard agent value that does not match any real browser build. The exact malformed string provides a low-noise channel indicator for this espionage cluster.

Suspicious Telegram Bot API Command and Control Communication (via proxy)

This rule detects outbound web requests to the Telegram Bot API endpoint on api.telegram.org that include a bot path, a command and control channel HookSpoofer stealer abuses to exfiltrate stolen data. The stealer posts harvested credentials and files to a hardcoded bot token. Because Telegram is also used legitimately this indicator is low confidence and best correlated with host stealer activity.

Suspicious RedHook Android RAT WebSocket Device Channel (via proxy)

This rule detects WebSocket connections to the RedHook Android RAT device channel identified by the ws/device path with the misspelled menberId parameter. The RAT maintains a real-time control socket to the operator using this distinctive URI. Detecting it flags a live command-and-control session from an infected device.

ScreenConnect SetupWizard Authentication Bypass Path Traversal (CVE-2024-1709)

This rule detects web requests to the ScreenConnect SetupWizard.aspx endpoint followed by an extra trailing path segment, the request shape that triggers the CVE-2024-1709 authentication bypass. Huntress observed this pattern used to reach the setup wizard on already configured servers and create attacker administrator accounts. A trailing path after SetupWizard.aspx is not produced by normal setup flows and indicates exploitation.

Suspicious C2 Beacon via cpp-httplib User Agent

This rule detects outbound HTTP requests carrying the cpp-httplib user agent, matching the Potemkin loader command-and-control channel observed with the test_agent identifier. The loader is built on the cpp-httplib library and this user agent rarely appears in legitimate enterprise browsing. Its presence in proxy or web telemetry indicates loader check-in and tasking.

Malicious Zloader C2 Communication Over HTTP

This rule detects HTTP requests to the Zloader command-and-control gate path milagrecf.php observed in the attempted attack against Intel 471. The fixed PHP gate receives beacons from the loader after the malicious Excel 4.0 macro executes. The hardcoded C2 path identifies compromised hosts contacting the operator regardless of the C2 host.

Possible Nagios XI Unauthenticated Terminal Web Shell Access

This rule detects access to the Nagios XI terminal endpoint which exposes an interactive web shell, an access path abused to gain unauthenticated command execution on the appliance. Requests to this terminal path from unexpected sources indicate probing or exploitation of the web shell functionality.