Sigma detection rules, expert-reviewed

Possible Malicious MCP Server Credential Exfiltration via DevTools-Assistant Agent (via proxy)

This rule detects outbound HTTP requests carrying the DevTools-Assistant user agent or destined for the api.github-analytics.com host used by the trojanized MCP server to exfiltrate stolen developer credentials. The custom user agent string and attacker controlled domain are distinctive network markers of this supply-chain compromise. Such traffic represents active data theft from a developer workstation.

Suspicious SparkKitty Photo Exfiltration API Pattern

This rule detects network requests to the SparkKitty spyware image-collection API paths such as getImageStatus putImages and putDataInfo used to upload stolen photos from infected mobile devices. This Trojan spy embedded in App Store and Google Play apps harvests gallery images that may contain wallet seed phrases. The structured API endpoint set is a distinctive server-side indicator.

Suspicious StupidSandwichAgent User-Agent in C2 Traffic by StaryDobry

This rule detects outbound HTTP requests carrying the hardcoded StupidSandwichAgent User-Agent string used by the StaryDobry campaign loader. This unusual and unique agent value identifies command-and-control and payload retrieval traffic from the miner dropper. Presence of this User-Agent indicates StaryDobry C2 communication.

Suspicious CanesSpy WhatsApp Mod C2 Beacon to AllRequest Endpoint (via proxy)

This rule detects HTTP POST requests to the /api/v1/AllRequest endpoint used by the CanesSpy trojanized WhatsApp modification for command-and-control. The spyware polls this path roughly every 60 seconds to receive orders and exfiltrate device identifiers, so traffic to this structured URI indicates an infected client beaconing to its C2.

Suspicious FatalRAT C2 HTTP Initial Submission Request (via proxy)

This rule detects the FatalRAT command-and-control check-in, an HTTP GET to the initialsubmission path carrying windows_version and computer_name query parameters. This beacon pattern was observed in Operation SalmonSlalom against Chinese-speaking APAC targets. Detecting the structured check-in URI exposes active C2 communication from an infected host.

Malicious n8n Expression Sandbox Escape child_process Payload

This rule detects HTTP request content carrying an n8n expression sandbox escape that reaches the Node.js child_process module through process mainModule require, the exploitation payload for CVE-2025-68613 used by the Zerobot botnet. The chained references break out of the expression evaluation context to run arbitrary commands. These strings together in request data indicate an exploitation attempt against the n8n platform.

Malicious MOVEit Transfer Exploitation via X-siLock HTTP Headers (via webserver)

This rule detects inbound HTTP requests carrying the X-siLock-Step1 or X-siLock-Step3 headers used by the MOVEit Transfer exploit toolkit. These custom headers drive the CVE-2023-34362 exploitation flow and indicate an attacker interacting with the human2.aspx web shell to exfiltrate data.

Malicious Text4Shell Apache Commons Text Interpolation Payload in HTTP Request

This rule detects HTTP requests containing Apache Commons Text StringSubstitutor interpolation payloads such as script, dns or url lookups used to exploit CVE-2022-42889 (Text4Shell) for remote code execution. Attackers embed these interpolation strings to trigger arbitrary command execution on vulnerable servers. Presence of these lookup prefixes in request data is a strong exploitation indicator.

Malicious Bumblebee Loader User-Agent In Web Traffic

This rule detects the hardcoded User-Agent string Bumblebee Loader in outbound web traffic, the beacon signature of the Bumblebee loader as it contacts its command-and-control server. Bumblebee stages Cobalt Strike and hands off access to ransomware affiliates. The self-identifying User-Agent uniquely marks infected hosts checking in.

Suspicious FvncBot Device Registration Request Over HTTP

This rule detects HTTP POST requests to the FvncBot registration endpoint /api/v1/devices/register, the unencrypted enrollment call the Android banking trojan makes on first check-in. The request carries device metadata as cleartext JSON before the operator issues WebSocket control commands. The fixed URI path identifies the trojan family independent of the C2 host in use.

Possible Discord Webhook C2 or Data Exfiltration

This rule detects outbound requests to Discord webhook endpoints which threat actors repurpose as command and control channels and as a destination for exfiltrated data. Because webhooks blend into normal Discord traffic they provide a low cost covert channel for stealing information and receiving operator instructions.

Possible RD Web Access Brute Force via Repeated Login POST Requests

This rule detects HTTP POST requests to the Remote Desktop Web Access login endpoint, matching the RDWeb brute-force activity observed in a terminal server phishing intrusion. Adversaries automate large volumes of credential guesses against the RDWeb form where an HTTP 302 response indicates a successful authentication. High-volume POSTs to this endpoint signal password guessing against externally exposed remote access.

Suspicious SmarterMail Administrative API Access from Python Requests Client

This rule detects SmarterMail administrative API calls such as event-hook creation and domain-put arriving with the python-requests user agent, the automation fingerprint left by the actor as they added a recon hook on domain creation. Legitimate SmarterMail administration is performed through the web console rather than a raw Python client, so this combination of sensitive endpoint and scripted user agent points to hands-on abuse of the compromised account. Review the surrounding requests for follow-on command execution.

Suspicious SmarterMail Force Password Reset API Request Indicating Account Takeover

This rule detects HTTP POST requests to the SmarterMail force-reset-password API endpoint, the account takeover primitive Huntress observed being abused to seize administrator accounts before achieving remote code execution. Attackers call this authenticated endpoint to reset a target user password and hijack the session. Requests to this path, particularly from scripted clients, indicate exploitation of the account takeover weakness.

Possible CrushFTP CVE-2025-31161 Authentication Bypass via Webserver

This rule detects exploitation attempts against CrushFTP CVE-2025-31161 where a request to the getUserList API function carries a forged AWS4-HMAC-SHA256 authorization referencing the crushadmin account. Huntress observed this auth-bypass request used to impersonate the built-in administrator and enumerate accounts. Successful exploitation gives an unauthenticated attacker administrative control of the file transfer server enabling data theft and follow-on intrusion.