Sigma detection rules, expert-reviewed

Possible Next.js Middleware Auth Bypass via X-Middleware-Subrequest Header (CVE-2025-29927)

This rule detects HTTP requests carrying the X-Middleware-Subrequest header, which Next.js internally uses to prevent middleware recursion and which attackers forge to bypass middleware-based authentication in CVE-2025-29927 as analyzed by Assetnote. A client-supplied value for this header causes the framework to skip auth middleware and return protected content. Because legitimate external clients never send this internal header, its presence strongly indicates an exploitation attempt.

Possible Ivanti Pulse Connect Secure Auth Bypass via TOTP Backup Code Path Traversal (via webserver)

This rule detects requests to the Pulse Connect Secure TOTP user backup code API containing directory traversal sequences. This maps to the authentication bypass where traversal from the totp endpoint reaches restricted admin and system functions. An attacker uses this to bypass authentication and pivot toward remote code execution.

Possible Citrix ShareFile Unauthenticated Upload Path Traversal Webshell (CVE-2023-24489) (via webserver)

This rule detects unauthenticated POST requests to the ShareFile storage controller upload endpoints carrying a traversal uploadid and archive extraction flags. This maps to CVE-2023-24489 where a cryptographic flaw allows uploading and unzipping an ASPX webshell outside the intended directory. An attacker uses this to achieve remote code execution and persistence.

Possible Magento XXE via guest-carts estimate-shipping-methods (CVE-2024-34102)

This rule detects POST requests to the Magento guest-carts estimate-shipping-methods REST endpoint whose body contains XML external entity syntax such as DOCTYPE, ENTITY, SYSTEM, or a php filter wrapper, matching the nested deserialization XXE for CVE-2024-34102 documented by Assetnote. Attackers abuse this to read sensitive files like app/etc/env.php and harvest secrets. The endpoint combined with XXE markers indicates targeted exploitation rather than normal shipping estimation.

Possible Progress WS_FTP Ad Hoc Deserialization via AHT_DEFAULT_UPLOAD_PARAMETER Marker

This rule detects multipart form-data uploads to WS_FTP Ad Hoc that carry the AHT_DEFAULT_UPLOAD_PARAMETER marker, matching the .NET BinaryFormatter deserialization exploit for CVE-2023-40044 documented by Assetnote. The marker delimits a base64 serialized object that the IIS module deserializes into code execution. Presence of this internal marker in a request body indicates targeted exploitation of the WS_FTP HTTP module.

Possible Sitecore SPEAK Bundle Arbitrary File Read via Path Traversal

This rule detects requests to the Sitecore SPEAK bundle endpoint with an absolute path traversal in the f parameter terminated by an encoded fragment, matching the arbitrary file read of web.config described in the Assetnote Sitecore RCE research. Attackers use this primitive to read sensitive configuration and harvest secrets for further exploitation. The combination of the bundle path and traversal markers indicates targeted file disclosure rather than normal asset loading.

Possible Craft CMS RCE via Query-String CLI Option Injection

This rule detects HTTP requests that inject Yii/Craft CLI options such as --templatesPath or --configPath through the query string, abusing PHP register_argc_argv on Craft CMS. This technique matches the Assetnote Craft CMS PHP footgun research where attacker-controlled argv values point to remote FTP or PHP stream wrappers to achieve remote code execution. Detecting these option strings early surfaces exploitation of the underlying command-line parsing footgun before code execution.

Possible Bitbucket Pre-Auth RCE via git archive exec Null-Byte Injection (CVE-2022-36804) (via webserver)

This rule detects requests to the Bitbucket archive REST endpoint carrying a null-byte encoded prefix and a git archive exec directive. This maps to CVE-2022-36804 where the prefix parameter is abused to inject arguments into the git archive command. An attacker uses this to spawn a shell and achieve unauthenticated remote command execution on the server.

Possible Unauthenticated Admin Creation in Dynamicweb CVE-2022-25369

This rule detects HTTP requests to the Dynamicweb setup Default.aspx page invoking the createadministrator action with supplied credentials. CVE-2022-25369 is a logic flaw allowing unauthenticated administrator creation as documented by Assetnote, which attackers chain into a webshell upload for remote code execution.

Possible Avaya Aura Device Services WebDAV PHP Webshell Upload via PhoneBackup (via webserver)

This rule detects WebDAV PUT requests writing a PHP file into the Avaya Aura Device Services PhoneBackup directory, optionally with the User-Agent AVAYA seen in the exploit. This is the RCE path where an attacker uploads a PHP webshell and then requests it for command execution. Detecting it surfaces webshell deployment against Avaya Aura Device Services.

Possible Aspera Faspex Pre-Auth RCE via YAML Deserialization in package_relay (via webserver)

This rule detects POST requests to the Aspera Faspex package_relay relay_package endpoint, the injection point for a pre-auth RCE where the external_emails field carries a serialized YAML payload deserialized by YAML.load. Attackers abuse this Ruby on Rails unsafe deserialization to execute arbitrary commands. Detecting it surfaces exploitation attempts against internet-facing Faspex servers.

Possible DotCMS Arbitrary File Upload and JSP Webshell Drop via api content (via webserver)

This rule detects multipart POST or PUT requests to the DotCMS content API whose filename carries path traversal sequences aimed at the webapps ROOT html directory. This is the 0day exploitation path that drops a .jsp webshell outside the intended upload location for remote code execution. Detecting it surfaces webshell installation against internet-facing DotCMS instances.

Possible PHP Webshell Access After Malicious ZIP Upload (via webserver)

This rule detects requests to a PHP file named workdone.php served from a work directory, the webshell dropped by extracting a malicious ZIP into /www/work/ during the Mozilla AWS code-execution research. Access to this out-of-place PHP file indicates a planted webshell being used for remote command execution. Detecting it surfaces post-exploitation control of the compromised host.

Possible Progress WhatsUp Gold Path Traversal and UNC Coercion via core API (via webserver)

This rule detects requests to the WhatsUp Gold AlarmCustomizer and WebContent core API endpoints that carry directory traversal sequences or UNC paths such as backslash-backslash host references and administrative shares. This pattern was used to read arbitrary files and coerce the server into authenticating to attacker SMB shares to capture NTLM credentials. Detecting it exposes file read and forced-authentication attacks against the monitoring server.

Possible SolarWinds Web Help Desk Arbitrary HQL Evaluation via rawHQL (via webserver)

This rule detects POST requests to the SolarWinds Web Help Desk assetReport rawHQL endpoint, the injection point for the arbitrary HQL evaluation flaw CVE-2021-35232. Attackers submit attacker-controlled HQL queries to this endpoint, often reusing the hardcoded Basic credentials shipped with the product, to read or manipulate backend data. Detecting it surfaces exploitation of the vulnerable help desk instance.