Sigma detection rules, expert-reviewed

Suspicious Tomcat Session Deserialization Trigger via Crafted JSESSIONID

This rule detects HTTP requests whose JSESSIONID value begins with a dot followed by a filename, the trigger for the Tomcat CVE-2025-24813 partial-PUT deserialization chain. The crafted session identifier forces Tomcat to deserialize an attacker-uploaded session file. This pattern indicates active exploitation.

Malicious Tomcat Partial PUT of Session File via Content-Range Header

This rule detects HTTP PUT requests targeting a .session file while carrying a Content-Range header, the upload step of the Tomcat CVE-2025-24813 partial-PUT deserialization exploit. Attackers write a serialized Java session file that is later deserialized for remote code execution. This upload pattern is a strong pre-exploitation indicator.

Suspicious PHP Webshell Access with Hardcoded Key

This rule detects POST requests containing the hardcoded key iUqPd tied to the PHP webshell deployed after PAN-OS exploitation. This behavior matches Operation Lunar Peek where operators executed system commands through a webshell parameter guarded by a static key. Webshell interaction on a firewall or web-facing host indicates active post-exploitation command execution.

Malicious Ivanti Connect Secure Path Traversal Exploitation of CVE-2024-21887

This rule detects HTTP requests to the Ivanti Connect Secure totp user-backup-code endpoint containing path traversal sequences, matching exploitation of CVE-2023-46805 and CVE-2024-21887 described by Unit 42. Attackers chain authentication bypass and command injection through this traversal path to gain unauthenticated remote code execution on the appliance.

Malicious MOVEit moveitisapi Exploitation Request via webserver

This rule detects HTTP requests to moveitisapi.dll carrying the action=m2 parameter associated with the MOVEit Transfer CVE-2023-34362 SQL injection exploitation flow. These crafted requests drive the injection and web shell interaction, so matching this endpoint and parameter reveals attempted or successful exploitation at the web tier.

Suspicious Salesforce Bulk API Export via aiohttp User Agent

This rule detects Salesforce Bulk API or large query events originating from a Python aiohttp user agent. Actors abusing compromised Salesloft Drift OAuth tokens use aiohttp to mass export Salesforce data through the Bulk API. Automated aiohttp access to bulk export events indicates token abuse and data theft rather than normal user activity.

Malicious Run Key Persistence Named SystemAgentService

This rule detects a registry autorun value named SystemAgentService being written under the current user Run key. The Vidar stealer campaign creates this value to survive reboots while impersonating a Microsoft service name. Catching the run key write reveals user-level persistence established by the stealer loader.

Suspicious Run Key Persistence Pointing to ProgramData Executable (via registry_set)

This rule detects a Run key registry value referencing ProgramData\wt.exe, the autostart persistence used in the Axios supply chain attack to relaunch the masqueraded PowerShell payload at logon. A Run key pointing to an executable in ProgramData reflects malware ensuring survival across reboots.

Suspicious ClickFix Command Execution via RunMRU Registry Key

This rule detects commands written to the Explorer RunMRU registry key that reference LOLBins such as mshta powershell curl or cscript. Adversaries running the ClickFix social engineering attack trick users into pasting attacker-supplied commands into the Windows Run dialog which persists them in RunMRU. Catching this reveals the initial user-executed loader stage before the second-stage payload runs.

Suspicious Run Key Persistence Executing VBScript as WindowsSecurityCheck

This rule detects a Run key named WindowsSecurityCheck whose value launches a .vbs script. The KimJongRAT stealer sets this entry to run a VBScript at logon while masquerading as a security component. A security-themed autorun name pointing to a script indicates malicious persistence.

Suspicious Logon Script Persistence via UserInitMprLogonScript

This rule detects modification of the HKCU Environment UserInitMprLogonScript value, which registers a script that runs at each user logon. The Blitz malware abuses this rarely-used key for persistence. Because few legitimate applications set this value, changes are a high-confidence persistence indicator.

Malicious SnipBot COM Hijack via InprocServer32 CLSID (via registry_set)

This rule detects registry writes to the InprocServer32 subkey of CLSID 2155fee3-2419-4373-b102-6843707eb41f, the COM object SnipBot hijacks to persist and execute its payload. COM hijacking gives the RomCom operator stealthy persistence triggered by normal application activity.

Malicious FalseFont Backdoor Run Key Persistence from AppData (via registry_set)

This rule detects a Run key persistence value pointing to a host.exe or broker.exe binary under an AppData path, the autostart mechanism the FalseFont backdoor uses to survive reboots. FalseFont is attributed to the Curious Serpens espionage actor, and running these implants from a user writable directory via a Run key is a clear sign of established backdoor persistence.

Malicious Registry Run Key Persistence via AHealthDB by Stately Taurus

This rule detects creation of a Run key value named AHealthDB that launches SmadavProtect32.exe, matching the persistence mechanism used by Stately Taurus in cyberespionage against the Philippines government reported by Unit 42. The actor masquerades a Run entry to auto-start a sideloading host at logon which maintains footholds for espionage.

Suspicious PowerShell Shellcode Loader via Function Pointer Delegate

This rule detects PowerShell that fetches remote content and invokes GetDelegateForFunctionPointer to execute shellcode. The AdaptixC2 framework uses Invoke-RestMethod to retrieve a beacon and this delegate call to run it in memory. Combining a network fetch with function pointer delegation is a hallmark of in-memory shellcode loaders.