Sigma detection rules, expert-reviewed

Possible FortiGate RCE via Chunked hostcheck_validate Request (CVE-2024-21762)

This rule detects POST requests to the FortiGate SSL VPN hostcheck_validate endpoint using Transfer-Encoding chunked, matching the out-of-bounds write exploited in CVE-2024-21762 as analyzed by Assetnote. The exploit relies on a malformed chunked body with a zero-length terminator and excess trailer lines to corrupt memory and reach code execution. Detecting chunked requests to this specific endpoint surfaces attempts against the vulnerable parser.

Possible VMware Workspace ONE SSRF via instanceHealth hostName At-Injection (via webserver)

This rule detects requests to the SAAS REST instanceHealth endpoint whose hostName or path parameters contain an at-sign injection redirecting the server-side request to an attacker host. This is the post-auth SSRF CVE-2021-22056 used to leak administrative JWT Authorization tokens from internal cluster instances. Detecting it surfaces token theft and internal request forgery against the vulnerable appliance.

Malicious Koi Loader C2 Check-in via Index PHP Beacon (via proxy)

This rule detects Koi Loader command-and-control beacons to an index.php endpoint carrying the campaign-specific subid=px8eIkut parameter used for host registration. This structured query pattern accompanies the pipe-delimited 101|GUID|VoYGkc5R check-in marker. Detecting it surfaces active Koi Loader C2 that precedes Koi Stealer deployment and credential exfiltration.

Possible NetHealth Implant C2 Beacon URI Pattern

This rule detects outbound HTTP requests matching the structured C2 beacon paths used by the Rapid Breach implant, including the resutato.com tap.php stager and the st.php beacon carrying computer and user name query parameters. These fixed URI patterns indicate command-and-control communication with the attacker infrastructure.

Suspicious AiTM Phishing Kit Session Validation Endpoint via Proxy

This rule detects web requests to reverse-proxy adversary-in-the-middle phishing kit endpoints, specifically the check_response handler carrying a session_id parameter alongside kit paths such as api/login, 2fa, sms and tap. It is associated with the Operation Fake KickOff campaign that abused recruiters and SaaS services to harvest corporate credentials and relay multi-factor authentication tokens. Detecting these structured kit paths surfaces live credential and MFA session theft.

Malicious Ivanti EPMM Exploitation via appstore fob Endpoint (via webserver)

This rule detects requests to the Ivanti EPMM exploit endpoints under the appstore and aftstore fob paths, the access pattern used to trigger CVE-2026-1281 and CVE-2026-1340. Hitting these routes drives unauthenticated code paths that lead to JSP webshell deployment and reverse shells.

Suspicious AWS Console AiTM Phishing Kit API Endpoints

This rule detects requests to the AWS console phishing kit API endpoints that relay login attempts using its distinctive input_24 parameter. The adversary-in-the-middle kit proxies AWS console authentication through check, login, and auth routes to capture credentials in real time. Traffic to these kit endpoints carrying the input_24 field indicates victims interacting with the AWS console phishing infrastructure.

Suspicious Marimo Terminal WebSocket RCE Access via Webserver

This rule detects access to the marimo terminal WebSocket endpoint that an attacker abused for remote code execution as the initial pivot in an LLM-guided intrusion toward an internal database. The endpoint exposes an interactive shell over the notebook interface. Requests to this path from untrusted sources indicate attempted exploitation of the exposed marimo service.

Possible Citrix NetScaler Webshell Deployment under VPN Theme Directory (CVE-2023-3519) (via webserver)

This rule detects requests to PHP files located under the NetScaler VPN theme directory. This maps to post-exploitation of CVE-2023-3519 where attackers write a PHP webshell to /var/vpn/theme after the buffer overflow. Access to a PHP resource in this static theme path indicates a deployed webshell used for persistent remote command execution.

Possible Metabase Pre-Auth RCE via H2 JDBC Injection on Setup Validate (CVE-2023-38646) (via webserver)

This rule detects requests to the Metabase setup validate endpoint carrying an H2 JDBC connection string with a trace level directive referencing the application jar. This maps to CVE-2023-38646 where a leaked setup token allows unauthenticated H2 injection to write and execute code. An attacker uses this chain to achieve remote code execution before authentication.

Suspicious Nmap Scripting Engine User-Agent in HTTP Requests (via webserver)

This rule detects HTTP requests carrying the Nmap Scripting Engine user-agent string, indicating automated NSE web probing against exposed services. Scanning activity of this kind precedes exploitation as adversaries enumerate service versions and vulnerabilities. Identifying the NSE user-agent surfaces active reconnaissance targeting internet-facing or ICS-adjacent web assets.

Possible Log4Shell JNDI Injection in HTTP Request

This rule detects JNDI lookup strings in HTTP request URIs or fields, indicative of Log4Shell (CVE-2021-44228) exploitation attempts against Log4j. Attackers embed jndi:ldap, jndi:rmi, or jndi:dns references, often inside headers such as X-Api-Version, to force the vulnerable logger to fetch and execute a remote class.

Mirai and Rondo Payload Retrieval via Known Loader Paths

This rule detects outbound web requests to loader paths used to distribute Mirai binaries and the Rondo cryptominer. These retrievals follow CVE-2025-55182 exploitation of IoT and smart home devices.

ZOHOMURK Non-Browser Zoho and IPFetcher User-Agents (via proxy)

This rule detects the hardcoded Zoho client and IPFetcher user-agent strings used by the ZOHOMURK implant when abusing Zoho WorkDrive and ipinfo.io during the Mustang Panda campaign. Adversaries reuse these non-browser agent strings for OAuth, folder enumeration and external IP discovery. Because legitimate Zoho software does not emit these exact tokens, the agents provide a reliable channel indicator.

Possible PAN-OS Auth Bypass via Double-Encoded Path Traversal to ztp_gate (CVE-2025-0108)

This rule detects requests to the PAN-OS unauth path that use double-encoded traversal sequences to reach authenticated PHP scripts such as ztp_gate.php, matching the Nginx and Apache path confusion auth bypass for CVE-2025-0108 documented by Assetnote. The double-encoded %252e segments defeat the X-pan-AuthCheck routing and expose privileged management endpoints. This encoded traversal against ztp_gate indicates an attempt to bypass authentication on the management interface.