Sigma detection rules, expert-reviewed

Suspicious HijackLoader Connectivity Check to Apache Incubator Logo (via proxy)

This rule detects HTTP requests to the Apache incubator default.png logo path that HijackLoader uses as an internet connectivity check before contacting its command and control server. This exact static resource request from non browser processes is uncommon.

Possible Citrix Session Recording SOAPAction Deserialization RCE (CVE-2023-6184) (via webserver)

This rule detects POST or M-POST requests to the Citrix Session Recording broker rem endpoints carrying a SOAPAction header. This maps to the .NET deserialization vulnerability where crafted SOAP requests to the RestApiStat and Player broker interfaces execute arbitrary code. An attacker uses this to gain remote code execution on the session recording server.

Malicious SSLoad Downloader C2 Beacon via Custom SSLoad User-Agent (via proxy)

This rule detects outbound HTTP traffic carrying the hardcoded SSLoad User-Agent used by the SSLoad downloader when it registers a fingerprinted host and beacons for tasks to its command-and-control server. This bespoke agent string is not produced by legitimate software and identifies the downloader stage of the intrusion on the wire.

Possible Ivanti Connect Secure Path Traversal Exploitation

This rule detects HTTP requests to the Ivanti Connect Secure TOTP backup-code endpoint containing directory traversal sequences, the access pattern used to exploit the authentication bypass zero-day. Threat actors chain this traversal to reach restricted API paths and deploy webshells. Detecting these requests exposes active exploitation of the Ivanti appliance.

Suspicious Chafer Backdoor HTTP C2 Communication via Proxy

This rule detects HTTP requests to the comm.aspx endpoint used by the Chafer backdoor for command-and-control communication. Observed in NCC Group research analyzing the Chafer backdoor beaconing to comm.aspx over HTTP. Identifying this request path helps detect infected hosts contacting Chafer C2 infrastructure.

Possible Origin Logger C2 Exfiltration via Hardcoded User Agent and Gate Endpoints via proxy

This rule detects Origin Logger keylogger command and control traffic that beacons with a hardcoded Firefox/99.0 user agent to /gate and /login exfiltration endpoints. Origin Logger is an AgentTesla derived stealer that harvests browser credentials and web session data. Correlating the fixed user agent with the exfil URI paths surfaces credential theft egress while suppressing benign Firefox browsing.

Suspicious BunnyLoader C2 Gate Endpoint Communication (via proxy)

This rule detects HTTP requests to a gate.php endpoint, the command and control resource BunnyLoader polls to register infected hosts and pull tasking on a short heartbeat interval. This gate path is a common malware beacon convention, so requests to it warrant review for loader command and control traffic.

Possible Palo Alto PAN-OS Authentication Bypass via PHP Path Confusion js.map Suffix (via webserver)

This rule detects the path confusion technique in Palo Alto PAN-OS CVE-2024-0012 where a request appends a js.map suffix after a php script to bypass the authentication check on management endpoints. The mixed php and js.map path is not produced by normal clients.

Suspicious Metabase Setup Token Disclosure via Session Properties Endpoint (CVE-2023-38646) (via webserver)

This rule detects requests to the unauthenticated Metabase session properties endpoint that leaks the setup token. This maps to the reconnaissance stage of CVE-2023-38646 where the token is harvested to enable the H2 JDBC injection. Repeated or external access to this endpoint may indicate an attacker preparing pre-auth code execution.

Possible Sitecore Path Traversal via ValidateXHtml PAGESTATE Injection

This rule detects requests to the Sitecore EditHtml.ValidateXHtml handler carrying a __PAGESTATE parameter with directory traversal sequences, matching the order-of-operations bug that Assetnote leveraged to reach RCE in Sitecore 8.x to 10.x. The traversal in the page-state value leaks server paths and enables the subsequent exploitation chain. Early detection of this handler abuse exposes reconnaissance before code execution.

Malicious BadIIS SEO Poisoning C2 Request via Web Server (via webserver)

This rule detects HTTP requests to the hardcoded BadIIS command-and-control endpoint used by the Operation Rewrite SEO poisoning campaign. The BadIIS native IIS module intercepts requests and communicates with attacker infrastructure through this fixed URI path. Detecting these requests exposes a compromised IIS server acting as a malicious proxy for SEO fraud and traffic redirection.

Possible Kentico Xperience Staging Sync Authentication Bypass via SyncServer Endpoint (via webserver)

This rule detects requests to the Kentico Xperience staging synchronization web service which is abused in the pre-auth RCE chain to upload objects after a password digest authentication bypass. Access to this SOAP endpoint from untrusted sources should be reviewed.

Malicious Jamf Pro SSRF Targeting Cloud Metadata via imageUrl (via webserver)

This rule detects requests to the Jamf Pro eduFeatureSettingsTest endpoint whose imageUrl parameter references the cloud instance metadata address 169.254.169.254. This is the full-read SSRF CVE-2021-39303 and CVE-2021-40809 aimed at stealing AWS instance credentials from the metadata service. Detecting it surfaces active theft of cloud IAM credentials through the vulnerable server.

Suspicious Watering Hole Exfiltration to Fake wp-includes Endpoint via SilentSelfie

This rule detects HTTP POST requests to the path /wp-includes/ms-menu.php, a fake WordPress endpoint used by the SilentSelfie watering hole campaign to receive stolen geolocation, WebRTC IP and webcam selfie data from visitors of compromised Kurdish websites. The ms-menu.php filename does not exist in genuine WordPress installations. Traffic to it indicates victim data exfiltration.

Possible Progress WhatsUp Gold SSRF via core render baseUrl (via webserver)

This rule detects PUT requests to the Progress WhatsUp Gold NmConsole core render API, abused as a server-side request forgery primitive through its baseUrl parameter. Attackers chained this SSRF to reach internal services and escalate impact on WhatsUp Gold deployments. Detecting it surfaces attempts to pivot into internal infrastructure via the monitoring server.