Sigma detection rules, expert-reviewed

Possible PHP Webshell Access After Malicious ZIP Upload (via webserver)

This rule detects requests to a PHP file named workdone.php served from a work directory, the webshell dropped by extracting a malicious ZIP into /www/work/ during the Mozilla AWS code-execution research. Access to this out-of-place PHP file indicates a planted webshell being used for remote command execution. Detecting it surfaces post-exploitation control of the compromised host.

Suspicious Fastly Client IP Header Spoofed to Localhost (via webserver)

This rule detects inbound requests where the Fastly client IP header is set to a loopback address such as 127.0.0.1, a spoofing technique used to bypass IP-based access controls on Fastly-fronted applications. During the Mozilla AWS research this trust in the client-supplied header let an attacker reach protected functionality. Detecting it surfaces attempts to forge trusted-source access to internal endpoints.

Possible Progress WhatsUp Gold Path Traversal and UNC Coercion via core API (via webserver)

This rule detects requests to the WhatsUp Gold AlarmCustomizer and WebContent core API endpoints that carry directory traversal sequences or UNC paths such as backslash-backslash host references and administrative shares. This pattern was used to read arbitrary files and coerce the server into authenticating to attacker SMB shares to capture NTLM credentials. Detecting it exposes file read and forced-authentication attacks against the monitoring server.

Possible SolarWinds Web Help Desk Arbitrary HQL Evaluation via rawHQL (via webserver)

This rule detects POST requests to the SolarWinds Web Help Desk assetReport rawHQL endpoint, the injection point for the arbitrary HQL evaluation flaw CVE-2021-35232. Attackers submit attacker-controlled HQL queries to this endpoint, often reusing the hardcoded Basic credentials shipped with the product, to read or manipulate backend data. Detecting it surfaces exploitation of the vulnerable help desk instance.

Possible Sitecore Pre-Auth RCE via Report.ashx Insecure Deserialization (via webserver)

This rule detects POST requests to the Sitecore Reporting Report.ashx handler carrying serialized .NET gadget markers such as NetDataContractSerializer, DelegateSerializationHolder or System.Diagnostics.Process. This is the exploitation pattern for the Sitecore pre-auth insecure deserialization RCE CVE-2021-42237, where a crafted XML payload triggers process execution on the server. Detecting it exposes attempts to gain code execution on internet-facing Sitecore instances.

Possible Jamf Pro SSRF Exploitation via eduFeatureSettingsTest imageUrl (via webserver)

This rule detects requests to the Jamf Pro eduFeatureSettingsTest AJAX endpoint carrying the imageUrl parameter together with the ACTION_AJAX_REQUEST_PHOTO action. This pattern was used to exploit the Jamf Pro full-read SSRF tracked as CVE-2021-39303 and CVE-2021-40809, letting an attacker coerce the server into fetching arbitrary internal URLs and returning their contents. Detecting it surfaces attempts to reach internal services or cloud metadata through the vulnerable server.

Possible WebSphere Portal SSRF via Proxy Servlet targeting Cloud Metadata (CVE-2021-27748) (via webserver)

This rule detects requests to the IBM WebSphere Portal proxy servlets combined with an internal or cloud metadata IP target in the URI. This maps to CVE-2021-27748 where the ajax/docpicker proxy endpoints are abused for server-side request forgery. An attacker leverages this to reach internal services and the 169.254.169.254 metadata endpoint to steal cloud credentials.

Possible SSRF via WebSphere Portal docpicker internal_proxy CVE-2021-27748

This rule detects HTTP requests to the WebSphere Portal docpicker internal_proxy and wps proxy passthrough endpoints. CVE-2021-27748 exposes these proxy paths to server-side request forgery as described by Assetnote, which attackers use to reach internal-only services from the portal server.

Possible SSRF to AWS Metadata via Workspace One UEM BlobHandler CVE-2021-22054

This rule detects HTTP requests to the VMware Workspace One UEM Catalog or AirWatch BlobHandler.ashx endpoint that reference the AWS instance metadata service. Assetnote documented CVE-2021-22054 as a pre-auth server-side request forgery through this handler, letting attackers reach 169.254.169.254 and harvest cloud credentials.

Possible SSRF via VMware Workspace One Access instanceHealth CVE-2021-22056

This rule detects HTTP requests to the VMware Workspace One Access instanceHealth REST endpoint that inject an at-sign into the hostName parameter. CVE-2021-22056 abuses this health-check path for server-side request forgery as detailed by Assetnote, which can leak an admin JWT and reach internal services.

Possible WatchGuard Pre-Auth RCE via agent login XML-RPC CVE-2022-26318

This rule detects POST requests to the WatchGuard /agent/login endpoint that carry an XML-RPC agent.login method call. CVE-2022-26318 is a pre-authentication buffer overflow reached through an oversized gzip-encoded XML methodCall to this endpoint as shown by Assetnote, enabling remote code execution on the firewall.

Possible Yellowfin BI Authentication Bypass via StoryBody Endpoint

This rule detects HTTP requests to the Yellowfin BI /StoryBody.i4 endpoint carrying the identity parameters abused for authentication bypass. Assetnote exploited hardcoded keys and this endpoint with ipPerson and ipOrg parameters to forge sessions, a first step toward JNDI-injection remote code execution.

Possible Oracle Opera CGI Webshell Command Execution via operabin

This rule detects HTTP requests to CGI scripts under the Oracle Opera /operabin/ path that pass a cmd parameter. Following a FileReceiver webshell drop described by Assetnote, attackers invoke the planted CGI script with a cmd argument to run operating system commands on the Opera host.

Possible Pre-Auth Webshell Upload via Oracle Opera FileReceiver Servlet

This rule detects HTTP requests to the Oracle Opera FileReceiver servlet used to drop a CGI webshell into the operabin cgi-bin directory. Assetnote research chains an order-of-operations bug to reach pre-auth remote code execution via this servlet, which attackers use to plant a webshell for persistent command execution.

Possible Reflected XSS via cPanel cpanelwebcall Endpoint CVE-2023-29489

This rule detects HTTP requests to the cPanel /cpanelwebcall/ path that contain reflected cross-site scripting payload markers. CVE-2023-29489 allows unauthenticated reflected XSS on cPanel management ports as documented by Assetnote, which attackers use to hijack sessions and pivot into hosting infrastructure.