Sigma detection rules, expert-reviewed

Possible Oracle GlassFish Authentication Bypass via HTTP TRACE to Admin Console

This rule detects an HTTP TRACE request to the GlassFish administration console manageUserNew.jsf endpoint, the request pattern that exploits CVE-2011-1511 to bypass authentication on the admin interface. A TRACE method against this administrative resource indicates an attempt to gain unauthorized administrative access.

Suspicious Double-Extension Web Shell Upload via Nagios XI Custom Includes

This rule detects requests to a double-extension .jpg.php file, the upload-filter bypass used against Nagios XI to plant a PHP web shell in the custom-includes directory while posing as an image. Access to such a masqueraded script is a strong indicator of web shell deployment and interaction.

Possible Nagios XI Path Traversal via Graphtemplates Directory Parameter

This rule detects requests to the Nagios XI graphtemplates.php endpoint carrying a directory-traversal sequence in the dir parameter, the vulnerability used to read or include arbitrary files outside the intended template directory. A traversal payload against this endpoint indicates active exploitation of the Nagios XI local file inclusion flaw.

Possible .NET Remoting Deserialisation Exploitation via REM Endpoint

This rule detects POST or M-POST requests to a .rem endpoint used by .NET Remoting over HTTP, the transport abused to deliver serialized gadget payloads for remote code execution through insecure deserialisation. Requests to these remoting endpoints, especially with the rare M-POST verb, indicate probing or exploitation of an exposed .NET Remoting service.

Possible Qlik Sense Unauthenticated Path Probe via TTF Extension Bypass

This rule detects an unauthenticated request that appends a bogus .ttf extension to the Qlik Sense product-info.json endpoint, a request-shaping trick used to bypass authentication and fingerprint vulnerable Qlik Sense builds prior to Cactus ransomware exploitation. The crafted extension query indicates reconnaissance against the CVE-2023-41265 style authentication bypass.

Possible FluBot C2 Polling via Known Malware URI Paths

This rule detects HTTP requests to the short polling endpoints used by the FluBot Android banking malware to reach its command-and-control server. Repeated beaconing to these fixed URI paths indicates an infected device polling for tasks and reporting stolen data.

Malicious Dropbox Cloud C2 via Spoofed Googlebot User Agent

This rule detects web traffic to the Dropbox content API using a spoofed Googlebot user agent which the RokRat implant used for command and control as analysed by NCC Group. Abusing a legitimate cloud storage API with a crawler user agent lets the malware blend exfiltration and tasking into normal web traffic.

Suspicious Hydra Android Banking Trojan C2 Mirror List Retrieval via Proxy

This rule detects HTTP requests to the Hydra Android banking trojan command-and-control mirror-list endpoint which returns a base64-encoded JSON list of fallback C2 servers. Observed in NCC Group Threat Spotlight research on Hydra which retrieves mirror lists over HTTP as well as from onion and code-hosting services. Identifying this retrieval helps surface infected mobile devices reaching out for updated C2 infrastructure.

Malicious MetaStealer C2 via cpp-httplib User-Agent (via proxy)

This rule detects outbound web requests presenting the cpp-httplib user-agent to the MetaStealer tasking endpoints such as api/client/new and tasks/get_worker. The combination of the library user-agent and these fixed URIs is a specific C2 fingerprint. Matching it surfaces hosts beaconing to MetaStealer infrastructure to register and receive stealer tasks.

Possible Cobalt Strike Beacon URI Pattern via Web C2

This rule detects outbound HTTP requests to Cobalt Strike malleable profile URIs observed in Blister post-exploitation traffic, including the /safebrowsing/ and /rest/2/meetings beacon paths often paired with Fastly domain fronting. These structured C2 URIs indicate beaconing to an attacker-controlled team server masquerading as benign web services.

Possible SharePoint ToolShell Exploitation via ToolPane POST with SignOut Referer

This rule detects HTTP POST requests to the SharePoint ToolPane.aspx endpoint carrying a Referer header pointing to the SignOut page. Microsoft identified this request signature as the ToolShell exploit chain against on-premises SharePoint. The crafted Referer bypasses authentication to reach the vulnerable endpoint, so this combination indicates active exploitation.

Suspicious Diamond Sleet Anomalous Microsoft Internet Explorer User Agent (via proxy)

This rule detects outbound requests carrying the literal user agent string Microsoft Internet Explorer, which does not match any genuine Internet Explorer user agent. Diamond Sleet LambLoad used this hardcoded user agent when fetching PNG-disguised second-stage payloads.

Suspicious Diamond Sleet C2 via LambLoad Addon PHP URI Pattern (via proxy)

This rule detects outbound web requests to the LambLoad command and control URI structure using the bluemantis addon PHP endpoints. Diamond Sleet used these URIs during the CyberLink supply chain compromise to retrieve second-stage payloads and receive commands.

Suspicious Oracle EBS Web Shell Access via X-ORACLE-DMS-ECID Header

This rule detects web requests carrying the X-ORACLE-DMS-ECID header used as an activation trigger by the SAGEWAVE servlet-filter web shell deployed against Oracle E-Business Suite. Requiring this uncommon header gates the malicious filter so only the operator can invoke it, indicating covert post-exploitation access.

Malicious Oracle EBS Exploitation via SyncServlet and TemplatePreviewPG

This rule detects web requests to the Oracle E-Business Suite /OA_HTML/SyncServlet and TemplatePreviewPG endpoints carrying the TMP or DEF template codes abused in CVE-2025-61882 exploitation. This request pattern drives injection of a malicious XSL template that leads to remote code execution in the widespread extortion campaign.