Sigma detection rules, expert-reviewed

Possible TP-Link Command Injection via WlanNetworkRpm Endpoint (via webserver)

This rule detects HTTP requests to the TP-Link WlanNetworkRpm configuration endpoint that carry shell metacharacters or download commands in the ssid1 parameter, matching exploitation of CVE-2023-33538 for unauthenticated command injection. Attackers abuse this router flaw to fetch and run Condi or Mirai IoT bot payloads.

Malicious SharePoint ToolPane Exploitation via SignOut Referer

This rule detects HTTP POST requests to ToolPane.aspx carrying a Referer header pointing at SignOut.aspx. This exact request pattern is the authentication bypass used to exploit the SharePoint ToolShell vulnerabilities. The crafted Referer combined with the ToolPane endpoint is a reliable exploitation signature.

Suspicious Tomcat Session Deserialization Trigger via Crafted JSESSIONID

This rule detects HTTP requests whose JSESSIONID value begins with a dot followed by a filename, the trigger for the Tomcat CVE-2025-24813 partial-PUT deserialization chain. The crafted session identifier forces Tomcat to deserialize an attacker-uploaded session file. This pattern indicates active exploitation.

Malicious Tomcat Partial PUT of Session File via Content-Range Header

This rule detects HTTP PUT requests targeting a .session file while carrying a Content-Range header, the upload step of the Tomcat CVE-2025-24813 partial-PUT deserialization exploit. Attackers write a serialized Java session file that is later deserialized for remote code execution. This upload pattern is a strong pre-exploitation indicator.

Suspicious PHP Webshell Access with Hardcoded Key

This rule detects POST requests containing the hardcoded key iUqPd tied to the PHP webshell deployed after PAN-OS exploitation. This behavior matches Operation Lunar Peek where operators executed system commands through a webshell parameter guarded by a static key. Webshell interaction on a firewall or web-facing host indicates active post-exploitation command execution.

Suspicious UPSTYLE Command Channel Pattern in Web Requests via CVE-2024-3400

This rule detects web requests carrying the base64 command pattern wrapped in img brackets used by the UPSTYLE backdoor deployed in Operation MidnightEclipse against CVE-2024-3400. The backdoor reads operator commands embedded in crafted requests that surface in the device error log. Detecting this pattern surfaces the covert command channel used to control the compromised firewall.

Malicious Ivanti Connect Secure Path Traversal Exploitation of CVE-2024-21887

This rule detects HTTP requests to the Ivanti Connect Secure totp user-backup-code endpoint containing path traversal sequences, matching exploitation of CVE-2023-46805 and CVE-2024-21887 described by Unit 42. Attackers chain authentication bypass and command injection through this traversal path to gain unauthenticated remote code execution on the appliance.

Malicious MOVEit moveitisapi Exploitation Request via webserver

This rule detects HTTP requests to moveitisapi.dll carrying the action=m2 parameter associated with the MOVEit Transfer CVE-2023-34362 SQL injection exploitation flow. These crafted requests drive the injection and web shell interaction, so matching this endpoint and parameter reveals attempted or successful exploitation at the web tier.

Suspicious dMSA Object Access with Migration AccessMask

This rule detects access to a delegated Managed Service Account object with the AccessMask 0x20 that corresponds to the dMSA migration operation. The BadSuccessor technique reads and manipulates dMSA objects to hijack privileges of a preceding account. This object access pattern helps surface abuse of the dMSA migration workflow.

Suspicious Salesforce Bulk API Export via aiohttp User Agent

This rule detects Salesforce Bulk API or large query events originating from a Python aiohttp user agent. Actors abusing compromised Salesloft Drift OAuth tokens use aiohttp to mass export Salesforce data through the Bulk API. Automated aiohttp access to bulk export events indicates token abuse and data theft rather than normal user activity.

Malicious Run Key Persistence Named SystemAgentService

This rule detects a registry autorun value named SystemAgentService being written under the current user Run key. The Vidar stealer campaign creates this value to survive reboots while impersonating a Microsoft service name. Catching the run key write reveals user-level persistence established by the stealer loader.

Suspicious Run Key Persistence Pointing to ProgramData Executable (via registry_set)

This rule detects a Run key registry value referencing ProgramData\wt.exe, the autostart persistence used in the Axios supply chain attack to relaunch the masqueraded PowerShell payload at logon. A Run key pointing to an executable in ProgramData reflects malware ensuring survival across reboots.

Suspicious BlackBeard Persistence via WDLP File Association (via registry_set)

This rule detects registration of the custom .wdlp file extension under the HKCU Classes key, a persistence mechanism used by the BlackBeard payload in Boggy Serpens operations alongside a startup Oregon.wdlp file. The bespoke file association triggers malicious code when the associated file type is opened, establishing user-level persistence.

Suspicious Run Key Persistence Pointing to WScript via PhantomVAI Loader (via registry_set)

This rule detects a Run registry key persistence entry whose value invokes WScript, the persistence mechanism used by the PhantomVAI loader to re-launch its script stage at logon. Registering a script host under Run ensures the loader survives reboots. Detecting this write surfaces persistent infostealer staging on the host.

Suspicious Run Key Persistence Named Updater

This rule detects a Run key value named Updater pointing at a binary in a user-writable directory such as AppData ProgramData or Temp. AdaptixC2 establishes autostart persistence by creating a Run key called Updater. An Updater autorun entry executing from a non-standard path is suspicious masquerading persistence.