Sigma detection rules, expert-reviewed

Suspicious vCenter VAMI SSH Enable via appliance access API

This rule detects an HTTP PUT to the vCenter VAMI endpoint /rest/appliance/access/ssh on management port 5480, matching BRICKSTORM activity that re-enables SSH on the appliance to gain shell access. Turning on this remote-access channel supports stealthy lateral movement and backdoor deployment across the virtualization estate.

Malicious WIREFIRE Webshell Access on Ivanti Connect Secure API Path (via webserver)

This rule detects HTTP requests to the Ivanti Connect Secure /api/v1/cav/client/visits endpoint that WIREFIRE trojanizes into a webshell. Suspected APT actors modified this component to accept encrypted commands and payloads through crafted requests to that URI. Traffic to this specific tampered API path signals interaction with the WIREFIRE backdoor.

Possible C2 via Google Sheets API Using Formula Render Option by GRIDTIDE

This rule detects requests to the Google Sheets API using the valueRenderOption set to FORMULA which the GRIDTIDE backdoor abuses to read tasking hidden inside spreadsheet formulas. Attackers use this legitimate cloud service as a covert command and control and exfiltration channel.

Possible Proxyware SDK Beacon With Telemetry Parameters

This rule detects HTTP requests carrying the proxyware SDK telemetry parameter string with n set to tlaunch alongside tag and key parameters used by PacketSDK and related residential proxy clients. This pattern indicates a device is reporting in as a monetized proxy node.

Suspicious Salesforce Data Access via Spoofed Automation User-Agents

This rule detects Salesforce API traffic carrying the distinctive spoofed user-agent strings Salesforce-Multi-Org-Fetcher/1.0 or python-requests used by UNC6395 after stealing Drift OAuth tokens. These clients drove SOQL enumeration and bulk extraction of User and Case records, indicating automated mass data theft rather than normal integration traffic.

Malicious BRICKSTORM C2 over WebSocket to Cloudflare Workers Domain (via proxy)

This rule detects WebSocket connections to a workers.dev subdomain used by the BRICKSTORM backdoor for command-and-control. Following Ivanti exploitation the actor tunneled BRICKSTORM traffic through Cloudflare Workers infrastructure to reach compromised vCenter hosts. Outbound wss traffic to attacker-registered workers.dev endpoints is a distinctive C2 indicator.

Suspicious UNC1549 Azure C2 Beacon to News Notifications URI Pattern (via proxy)

This rule detects HTTP requests to Azure-hosted command-and-control paths matching a /news/notifications/ prefix followed by a numeric identifier. UNC1549 tunneled MINIBIKE traffic through Azure cloud infrastructure using this structured URI scheme to blend with legitimate cloud services. The consistent notifications URI layout is a usable network fingerprint for the campaign.

Possible ToolShell SharePoint Exploitation via ToolPane.aspx (via webserver)

This rule detects POST requests to the SharePoint ToolPane.aspx endpoint carrying the crafted parameters and SignOut.aspx referer used in the ToolShell exploit chain. ToolShell abused a set of SharePoint vulnerabilities to reach unauthenticated remote code execution on internet-facing servers. This request pattern is an early indicator of exploitation before any implant is dropped.

Possible GhostContainer Exchange Backdoor C2 Request via OWA (via webserver)

This rule detects HTTP requests to Exchange OWA carrying the custom control header and crafted VIEWSTATE prefix used by the GhostContainer backdoor. GhostContainer is an IIS/Exchange module backdoor deployed against high-value organizations in Asia. Operators tunnel commands through legitimate OWA endpoints which lets malicious traffic blend into normal Exchange usage and evade perimeter controls.

Malicious TBK DVR Command Injection via device.rsp Endpoint

This rule detects HTTP requests to the device.rsp endpoint carrying the ___S_O_S_T_R_E_A_MAX___ marker and a shell command which exploits CVE-2024-3721 on TBK DVR devices. A Mirai botnet variant uses this injection to download and run its ARM payload on vulnerable DVRs. The distinctive marker string in the request is a reliable exploitation signal.

Possible Apache Struts2 OGNL Content-Type Exploitation CVE-2017-5638 (via webserver)

This rule detects HTTP requests carrying an OGNL injection payload in the Content-Type header. The NKAbuse intrusion begins by exploiting the Struts2 vulnerability CVE-2017-5638, which smuggles an OGNL expression through a malformed Content-Type to run commands on the server, so this header content indicates attempted remote code execution against a public-facing web application.

Possible FakeWallet Wallet Exfiltration via Structured POST Parameters (via proxy)

This rule detects POST requests carrying the FakeWallet specific parameters ciyu, ciyuType and wallet used to transmit stolen cryptocurrency wallet material to the operator. This parameter layout is unique to the FakeWallet iOS stealer campaign. Detecting the structured parameters surfaces exfiltration even when the destination domain changes.

Malicious FakeWallet Crypto Stealer C2 via Rsakey Endpoints (via proxy)

This rule detects requests to the FakeWallet server endpoints containing the distinctive Rsakeycatch and Rsakeyword paths used by the iOS crypto stealer to exfiltrate wallet data. FakeWallet spread through App Store applications to harvest cryptocurrency wallet secrets. Detecting these fixed endpoint paths exposes active data exfiltration to attacker infrastructure.

Malicious AdaptixC2 Beacon via X-Beacon-Id Header and Default User Agent (via proxy)

This rule detects HTTP traffic carrying the AdaptixC2 specific X-Beacon-Id header or the framework default Firefox 20.0 user agent string. AdaptixC2 is a post-exploitation command-and-control framework used for beaconing and tunneling. Detecting either the custom header or the anachronistic user agent exposes agent check-ins to an AdaptixC2 listener.

Possible JanelaRAT C2 Beacon via Structured HTTP Query (via proxy)

This rule detects outbound HTTP requests carrying the structured beacon query parameters VS, PL and AN that JanelaRAT appends when checking in to its command-and-control server. This behavior is associated with the JanelaRAT financial trojan operating over daily-rotating dynamic DNS infrastructure in Latin America. Identifying the fixed parameter layout reveals active C2 communication independent of the rotating domain.