Sigma detection rules, expert-reviewed

Suspicious Telerik UI RadAsyncUpload Request Indicating CVE-2019-18935 Exploitation (via webserver)

This rule detects requests to the Telerik Web UI WebResource handler with the type rau parameter that drives the RadAsyncUpload component targeted by CVE-2019-18935. Threat actors send crafted requests to this endpoint to deserialize a malicious payload and drop a DLL on the server. Traffic to this specific handler and parameter is a strong exploitation signal for vulnerable Telerik deployments.

Suspicious BeaverTail C2 Download over Non-Standard Port 1224 (via proxy)

This rule detects HTTP requests to the BeaverTail command and control endpoint that serves the next stage over TCP port 1224 with a pdown download path. The Lazarus loader retrieves its encoded Python downloader from this fixed port and URI pattern. The combination of the unusual high port and the pdown resource distinguishes this beacon from ordinary web traffic.

Malicious FIN7 DiceLoader C2 via Placeholder User-Agent (via proxy)

This rule detects command-and-control traffic carrying the literal placeholder user-agent myUserAgentHere, left hardcoded in the FIN7 DiceLoader beacon to cdn*.space infrastructure. No legitimate software presents this developer placeholder string, making it a high-confidence C2 indicator. It surfaces active FIN7 post-exploitation communication.

Malicious D3f@ck Loader C2 via Java User-Agent Ready Beacon (via proxy)

This rule detects D3F@ck loader command-and-control traffic identified by the hardcoded Java/1.8.0_101 user-agent combined with an event=ready status parameter in the request URI. This loader reports staged status values such as ready, downloaded and finished to its C2. The fixed Java user-agent from a non-Java host is a strong indicator of the loader beacon.

Suspicious Telegraph-Hosted Encrypted Payload Retrieval (via proxy)

This rule detects retrieval of .gpg or .dat files from telegra.ph, the abused public publishing service used by the FakeBat Payk RunPE arsenal to host second-stage encrypted payloads. Legitimate Telegraph articles do not serve encrypted binary blobs, so this pattern indicates staged malware delivery. It follows MSIX-based malvertising infections.

Suspicious Tycoon Phishing-as-a-Service Credential Exfiltration Path (via proxy)

This rule detects HTTP POST requests to the /web6/info endpoint used by the Tycoon Phishing-as-a-Service platform to exfiltrate harvested credentials, cookies and MFA tokens from voicemail-themed phishing pages. The /web6/ path structure is served alongside XOR-obfuscated JavaScript and a Cloudflare Turnstile evasion prompt. This adversary-in-the-middle flow enables session and 2FA bypass.

Malicious wp2shell WordPress Exploitation via Batch Endpoint User Agent

This rule detects POST requests to the wp-json batch endpoint carrying a wp2shell or CVE-2026-63030 user agent which is the exploitation traffic of the pre-auth WordPress RCE. The bespoke user-agent strings identify the attacker tooling driving the plugin drop. Seeing this endpoint and marker together confirms active exploitation attempts.

Suspicious ffuf Fuzzing Requests Against Web Server

This rule detects web requests carrying the ffuf fuzzer user agent or its FUZZ placeholder marker as covered in Elastic research on detecting web server probing in Traefik. These requests represent active directory and parameter brute forcing used to enumerate hidden endpoints before exploitation.

Suspicious WordPress Path Probing Against Non WordPress Web Server

This rule detects requests to common WordPress administrative and plugin paths that indicate automated content discovery and probing as described in Elastic research on detecting web server fuzzing in Traefik. A burst of such requests against a server that does not host WordPress signals reconnaissance for exploitable endpoints.

Suspicious TOLLBOOTH Webshell URI Access

This rule detects HTTP requests to the /mywebdll endpoint exposed by the TOLLBOOTH IIS webshell. The operator authenticates to this path to issue commands through the malicious native module, making requests to this fixed URI a reliable compromise indicator.

Suspicious Contagious Interview Exfiltration via Axios Upload User Agent

This rule detects HTTP uploads carrying the pinned axios/1.18.1 user agent to an /upload endpoint which the Contagious Interview RAT uses to exfiltrate stolen data to its controller. The fixed client library version paired with the upload path distinguishes implant traffic from normal browsing. It flags collected developer credentials leaving the host.

Malicious MIMICRAT C2 HTTP Request Pattern (via proxy)

This rule detects the distinctive HTTP request URIs used by MIMICRAT to communicate with its HTTPS command and control fronted through a content delivery network. Observed in Elastic Security Labs analysis where GET intake organizations events and POST discover pcversion metrics with mimicked telemetry parameters carry beacon traffic.

Malicious NANOREMOTE C2 Beacon by User-Agent

This rule detects outbound HTTP traffic carrying the NanoRemote User-Agent string used by the NANOREMOTE backdoor when beaconing to its command-and-control server. The hardcoded agent value combined with the /api/client request path is a distinctive fingerprint of this implant.

Suspicious BLOODALCHEMY Command and Control URI Pattern via Proxy

This rule detects outbound HTTP requests carrying the Inform logger URI path used by the BLOODALCHEMY backdoor for command and control. The distinctive URI structure is a network side indicator of the backdoor checking in with its server.

Suspicious Malformed DONNECT HTTP Method in Proxy Logs via Proxy

This rule detects the malformed DONNECT HTTP verb observed in REF5961 command and control traffic which is a typographical artifact of the tooling rather than a valid HTTP method. Legitimate clients never emit DONNECT so its presence in proxy logs is a strong indicator of the intrusion set beaconing through a proxy.