Sigma detection rules, expert-reviewed

Suspicious FalseFont Backdoor C2 Command Endpoint Requests (via proxy)

This rule detects HTTP requests to the Core Command Init endpoint structure that the FalseFont backdoor uses to retrieve operator commands from its server. This distinctive URI layout maps to the backdoor tasking channel, so matching traffic indicates an active FalseFont command and control session.

Suspicious Payload Download from Transfer.sh After ScreenConnect Exploitation (via proxy)

This rule detects outbound HTTP requests to the transfer.sh file sharing service, an abused staging host from which ScreenConnect exploitation actors retrieve malicious installers and second stage tooling. Enterprise endpoints rarely fetch payloads from transfer.sh, so traffic to this service following suspected exploitation is a useful ingress tool transfer indicator.

Suspicious Mispadu Infostealer C2 Beacon URL Pattern (via proxy)

This rule detects HTTP requests to a Mispadu command and control endpoint that combines the it.php resource with the campaign specific f=2 and w= query parameters. Mispadu uses this structured beacon to exfiltrate stolen data and receive tasking, so matching traffic indicates an active infostealer infection.

Suspicious Spoofed Microsoft Host Header C2 by Stately Taurus

This rule detects outbound HTTP requests carrying a spoofed Host header of wcpstatic.microsoft.com toward destinations that are not Microsoft infrastructure, matching the command and control masquerading used by Stately Taurus per Unit 42. The actor forges a trusted Microsoft hostname to blend beacons with legitimate traffic which conceals its espionage channel.

Malicious Kazuar Backdoor C2 via Hardcoded HTTP Cookie by Pensive Ursa

This rule detects outbound HTTP traffic carrying the hardcoded Cookie value used by the upgraded Kazuar .NET backdoor attributed to Pensive Ursa (Turla). The backdoor beacons with a static cookie GUID that identifies its command and control channel which makes it a high fidelity indicator of an active Turla implant.

Possible Spectre Ops C2 Beacon via nico and yfat Query Parameters via proxy

This rule detects Spectre Ops stealer command and control traffic that posts to a PHP endpoint carrying the distinctive nico and yfat query parameters. These custom parameter names carry stolen data and bot identifiers to the panel. The parameter pairing uniquely fingerprints the exfiltration channel independent of the C2 host or the nonstandard port.

Possible ZharkBot C2 Beacon via socket Endpoint with Bot Parameters via proxy

This rule detects ZharkBot command and control beacons that request a /socket/ endpoint with the structured query parameters id, bld, os, mn and us reporting bot, build and host details. This fixed parameter layout encodes victim registration data to the panel. Matching the endpoint and its parameter set fingerprints the bot check-in regardless of the C2 domain in use.

Possible F5 TMUI Directory Traversal Exploitation Attempt

This rule detects requests to the F5 BIG-IP TMUI interface containing the dot dot semicolon traversal sequence used to bypass authentication in CVE-2020-5902 as described in NCC Group RIFT F5 TMUI intelligence. Adversaries chain this traversal against the tmui path to reach protected endpoints and achieve remote code execution so matching requests indicate exploitation attempts.

Possible Log4Shell JNDI Exploitation Attempt in Web Request

This rule detects Log4Shell exploitation attempts where a JNDI lookup expression is embedded in the request URI or headers including LDAP RMI and DNS callbacks and URL encoded variants as described in NCC Group Log4Shell detection research. Adversaries inject these strings to trigger CVE-2021-44228 remote code execution in vulnerable Log4j components so matching requests indicate active exploitation.

Possible Shellshock Exploitation Attempt via Web Request

This rule detects Shellshock (CVE-2014-6271) exploitation attempts where the Bash function-definition prefix appears inside HTTP request fields such as the User-Agent, URI query or Referer against CGI endpoints. Observed in NCC Group research capturing Shellshock payloads that deliver shell download commands. Detecting these requests helps identify attempts to gain unauthenticated remote code execution on exposed servers.

Possible Nagios XI Blind SQL Injection via chbActive Parameter Quote Injection

This rule detects requests to the Nagios XI nagiosql admin endpoints carrying quote injection in the chbActive parameter indicative of the blind SQL injection reported by NCC Group. Exploitation allows enumeration of the user table and extraction of credentials from the monitoring platform database.

Possible F5 BIG-IP TMUI Exploitation via hsqldb Path Traversal Request

This rule detects HTTP requests targeting the F5 BIG-IP TMUI hsqldb servlet using directory traversal characteristic of CVE-2020-5902 exploitation. NCC Group honeypot data recorded attackers reaching the hsqldb endpoint to achieve unauthenticated remote code execution. Successful exploitation grants full administrative control of the appliance.

Suspicious Malicious WAR Deployment via GlassFish Admin Console

This rule detects requests referencing a cmd.war archive against the GlassFish server, the web-shell deployment step performed after the administration console authentication bypass to gain command execution. Deployment of an attacker WAR named cmd.war is a strong indicator of post-exploitation web shell installation.

Possible Oracle GlassFish Authentication Bypass via HTTP TRACE to Admin Console

This rule detects an HTTP TRACE request to the GlassFish administration console manageUserNew.jsf endpoint, the request pattern that exploits CVE-2011-1511 to bypass authentication on the admin interface. A TRACE method against this administrative resource indicates an attempt to gain unauthorized administrative access.

Suspicious Double-Extension Web Shell Upload via Nagios XI Custom Includes

This rule detects requests to a double-extension .jpg.php file, the upload-filter bypass used against Nagios XI to plant a PHP web shell in the custom-includes directory while posing as an image. Access to such a masqueraded script is a strong indicator of web shell deployment and interaction.