Sigma detection rules, expert-reviewed

Suspicious PHP Webshell in Netscaler VPN Theme Directory

This rule detects requests to PHP files under the Netscaler /vpn/themes/ path, where the actor planted webshells following Netscaler exploitation. The theme image directories serve static assets and should not host PHP, so PHP execution there indicates a webshell used for post-exploitation access.

Suspicious AstarionRAT HTTP Beacon Cookie Values

This rule detects outbound HTTP requests carrying the distinctive cookie tokens AFUAK, BLA or HFK used by the AstarionRAT command and control beacon observed in the analyzed intrusion. These structured cookie values are protocol-specific constants of the RAT rather than incidental strings, making them reliable network indicators. Traffic bearing these cookies signals an active RAT check-in and should be investigated as a compromise.

Possible Apache ActiveMQ RCE via Jolokia addNetworkConnector (via webserver)

This rule detects HTTP requests to the ActiveMQ Jolokia API that invoke the addNetworkConnector broker operation with a remote xbean configuration URI. This corresponds to CVE-2026-34197 remote code execution where the broker loads an attacker hosted Spring bean. Administrators rarely add network connectors that reference external HTTP xbean configs.

Possible LiteLLM Unauthenticated Command Execution via MCP Test Endpoints (via webserver)

This rule detects unauthenticated HTTP POST requests to the LiteLLM MCP test connection and tools list endpoints which accept a server configuration whose command is spawned as a subprocess. This corresponds to CVE-2026-42271 chained with a Host header authentication bypass. External access to these administrative endpoints warrants review.

Possible osTicket PHP Filter Chain Injection via Anonymous Ticket Endpoints (via webserver)

This rule detects HTTP requests to the anonymous osTicket open, view, or account endpoints that carry a PHP filter chain such as a php filter wrapper with base64 or iconv conversions. This corresponds to CVE-2026-22200 which abuses filter chains for arbitrary file read and code execution. Ordinary ticket submissions do not contain filter wrappers.

Possible Oracle Identity Manager Authentication Bypass via WADL Suffix (via webserver)

This rule detects HTTP requests to Oracle Identity Manager iam REST endpoints that append a metadata suffix such as a WADL or WSDL marker to bypass authentication. This corresponds to CVE-2025-61757 which grants unauthenticated access to privileged REST services. Normal clients do not append these suffixes to governance paths.

Possible SolarWinds Web Help Desk Deserialization via JNDIConnectionPool Gadget (via webserver)

This rule detects HTTP requests to the SolarWinds Web Help Desk WebObjects handler that carry the JSONRPC whitelist bypass parameter or a JNDIConnectionPool deserialization gadget referencing an LDAP path. This corresponds to CVE-2025-40551 exploitation. Legitimate help desk traffic does not include these gadget markers.

Possible Langflow Unauthenticated Code Execution via validate code Endpoint (via webserver)

This rule detects HTTP POST requests to the Langflow validate code API that contain Python execution markers such as exec or import decorators. This corresponds to CVE-2025-3248 which allows unauthenticated remote code execution. Routine validation traffic does not embed decorator based exec payloads.

Possible Ivanti Cloud Services Appliance Command Injection via datetime.php (via webserver)

This rule detects HTTP POST requests to the Ivanti Cloud Services Appliance datetime.php endpoint that carry the TIMEZONE parameter together with shell metacharacters. This pattern corresponds to exploitation of CVE-2024-8190 where attacker input reaches an operating system command. Benign timezone configuration does not include command separators.

Suspicious HTTP Beacon with Java Agent User-Agent (via proxy)

This rule detects outbound HTTP requests carrying the anomalous Java/Agent User-Agent string associated with the Group-IB XMRig covert Linux PAM abuse campaign command and control channel. The value mimics a legitimate Java runtime User-Agent but is malformed and specific to the tooling. Flagging this string helps surface miner command and control or payload retrieval traffic on the network.

Suspicious AdaptixC2 Beacon Status Request by JadeProx TriBack Loader (via proxy)

This rule detects HTTP POST requests to the AdaptixC2 status endpoint used by the JadeProx TriBack loader for command-and-control beaconing, distinguished by the X-Beacon-Id header on the api/v1/status path. The framework tags each implant with a beacon id in that header. Detecting the endpoint and beacon header exposes AdaptixC2 command-and-control traffic.

Malicious RedHook Android RAT C2 REST Endpoint Access (via proxy)

This rule detects HTTP requests to the RedHook Android RAT command-and-control REST endpoints addDevicePassword and addsKeyboardInput used to upload stolen device credentials and keylogged input. These distinctive server paths identify infected mobile devices beaconing to attacker infrastructure. Detection reveals active data theft from compromised Android hosts.

Suspicious Telegram Bot API getUpdates Polling for C2 by Millenium RAT (via proxy)

This rule detects requests to the Telegram Bot API getUpdates method, the command-and-control channel Millenium RAT uses to poll operator instructions through api.telegram.org. Abusing Telegram bot infrastructure lets the RAT blend C2 traffic with legitimate services. Repeated polling from workstation processes warrants investigation.

Malicious Phishing Data Exfiltration to SheetBest API by GitBait Campaign (via proxy)

This rule detects HTTP POST requests to the api.sheetbest.com sheets endpoint used by the GitBait phishing campaign to exfiltrate stolen banking credentials from GitHub Pages lures. The campaign abuses the SheetBest Google Sheets API as a low-cost data drop for harvested victim data. Detecting these calls surfaces active credential exfiltration.

Malicious GTFire Phishing Credential Exfiltration to All-in-1.php Backend (via proxy)

This rule detects credential-harvesting requests to the GTFire phishing backend script All-in-1.php carrying the user and pass parameters used to capture victim logins, as documented by Group-IB. Adversaries transmit stolen credentials to this fixed backend URI over HTTP, so requests matching the path and parameter structure indicate active credential theft.