Sigma detection rules, expert-reviewed

Suspicious SharePoint ToolPane Endpoint Request via ToolShell (via webserver)

This rule detects HTTP requests to the SharePoint ToolPane.aspx endpoint carrying the DisplayMode Edit parameter, the exploitation vector for ToolShell (CVE-2025-53770). Attackers send crafted requests to this endpoint to bypass authentication and achieve remote code execution. Requests to this endpoint with an edit display mode are a strong indicator of exploitation attempts.

Suspicious Telegram Bot API C2 Beaconing (via network)

This rule detects outbound HTTP requests to the Telegram bot API using sendPhoto and sendDocument methods which the CoralRaider actor abuses for command and control and exfiltration of stolen social media data. Abusing a legitimate messaging platform lets attackers hide C2 inside allowed web traffic and defeat domain reputation controls.

Suspicious Hello-World Scraper Botnet User-Agent in Web Requests

This rule detects inbound web requests carrying the User-Agent string Hello-World/1.0, a hardcoded identifier used by a scraper botnet concentrated in Taiwan that issues evenly distributed GET floods across ports 80 through 85. Surfacing this fingerprint reveals automated reconnaissance and scraping activity that often precedes targeted follow-on abuse.

Possible PowerShell Empire Default User-Agent In HTTP Traffic

This rule detects outbound HTTP traffic carrying the default user-agent string shipped with the PowerShell Empire C2 framework. In the WithSecure C2 and Exfiltration Lab 1 the Empire agent beacons out with an unmodified Mozilla compatible MSIE user-agent that is characteristic of the framework default profile. Attackers rely on this static header for their staging and command channel unless an operator customizes it.

Proxy HTTP GET traffic using Hello-World/1.0 user-agent (possible scraper botnet)

Flags proxy GET requests using the Hello-World/1.0 user-agent, which may indicate automated scraping.

Proxy WebDAV MiniRedir Drives Execution from External Shares

Alert on external WebDAV MiniRedir GET requests for executable-like file extensions that may lead to execution.

Proxy Detection: Cobalt Strike Malleable C2 Profile HTTP URI/User-Agent/Method Patterns

Flags proxy HTTP requests whose URI, method, User-Agent, host, and cookie fragments match known Cobalt Strike malleable profile patterns.

F5 BIG-IP iControl REST Webserver POST to /mgmt/tm/util/bash Command Execution

Alerts on webserver POST requests to the BIG-IP iControl REST bash execution endpoint (/mgmt/tm/util/bash).

F5 BIG-IP iControl REST API Bash Endpoint Command Execution via Proxy POST

Alerts on POST requests to the BIG-IP iControl REST /mgmt/tm/util/bash endpoint that can execute shell commands.

Proxy User-Agent starts with Base64-like prefixes associated with encoded client strings

Identifies proxy requests with User-Agent values starting with known Base64-encoded prefixes.

Suspicious Proxy Requests to IPFS URLs Containing Email Address

Alerts when proxy request URIs target IPFS and include an email address.

Detect rclone CLI Activity via Proxy User-Agent Prefix

Flags proxy traffic with a user agent beginning with rclone/v, indicating rclone usage through the proxy.

PUA Tool Update Check to /checkupdate.php (Advanced IP/Port Scanner) via Proxy

Identifies proxy HTTP requests to /checkupdate.php from Advanced IP/Port Scanner with expected update-check query parameters.

Webserver User-Agent Identifies Known Recon and Scanning Tool Strings

Alerts on web requests with User-Agent values containing known recon/scanner tool identifiers.

Proxy Log User-Agent Ending with '=' Suggesting Base64 Encoding

Alerts on proxy requests with User-Agent values ending in '=' that may indicate Base64-encoded content.