Sigma detection rules, expert-reviewed

Web Server GET Requests Containing SSTI Payload Strings (Server-Side Template Injection)

Flags GET requests containing SSTI probe strings in web access logs when the response is not 404.

Microsoft BITS Proxy Requests to Uncommon Server IP Hosts

Identifies Microsoft BITS proxy connections where the destination host ends with a single-digit, indicating uncommon IP-style addressing.

Webserver: Suspicious Windows Path Strings in URI Query

Alerts when a web URI query contains encoded or plain Windows path strings indicative of possible exfiltration or webshell behavior.

Java Payload Indicators in Web Server Logs

Alerts when web access logs contain Java payload-like strings indicating possible injection or runtime execution attempts.

Webserver JNDI-Exploit-Kit Exploitation Indicators via Known Payload Paths

Flags webserver requests whose URL paths match known JNDI-Exploit-Kit exploit, deserialization, and memshell pattern strings.

Webserver: Successful IIS shortname fuzzing scan using "~1" parameter

Alerts on successful IIS probing requests containing ~1 and ending with a.aspx using GET/OPTIONS.

Web Path Traversal Exploitation Attempts via Encoded Traversal in URL Query

Alerts on web requests with URL query path traversal patterns targeting /etc/ and other sensitive filesystem paths.

Webserver GET requests containing XSS-related payload strings

Finds likely XSS injection attempts in webserver GET requests by matching script, tag, and JS payload strings while excluding 404s.

BabyShark HackTool Proxy C2 URL Pattern via momyshark?key=

Alerts on proxy URIs containing the BabyShark agent default "momyshark?key=" query pattern.

Nginx service core dump after worker crash (signal 6)

Flags Nginx worker crashes that end with signal 6 core dumps, which may indicate serious issues or exploitation.

Webserver logs: Webshell ReGeorg indicators in POST URI query with null Referer/User-Agent

Flags HTTP POST requests with null referer/user-agent and ReGeorg-like URI query parameters in web logs.

Empire C2 Proxy Requests with Specific User-Agent and POSTed PHP URIs

Flags proxy HTTP POSTs using an Empire-like user agent to specific admin/login PHP endpoints.

Proxy Downloads Containing /pwndrop/ (PwnDrp Web Server)

Alerts on proxy requests to URIs containing '/pwndrop/', consistent with PwnDrp-style web delivery.

Detect Potential SQL Injection Payloads in GET URIs via Webserver Access Logs

Flags HTTP GET URIs containing SQL injection indicator strings in webserver access logs, excluding 404 responses.

Proxy access to raw paste endpoints on paste.ee and Pastebin-style services

Alerts on proxy requests for raw paste service URLs that can be used to stage or fetch malicious payloads.