Sigma detection rules, expert-reviewed

Possible F5 TMUI Directory Traversal Exploitation Attempt

This rule detects requests to the F5 BIG-IP TMUI interface containing the dot dot semicolon traversal sequence used to bypass authentication in CVE-2020-5902 as described in NCC Group RIFT F5 TMUI intelligence. Adversaries chain this traversal against the tmui path to reach protected endpoints and achieve remote code execution so matching requests indicate exploitation attempts.

Possible Log4Shell JNDI Exploitation Attempt in Web Request

This rule detects Log4Shell exploitation attempts where a JNDI lookup expression is embedded in the request URI or headers including LDAP RMI and DNS callbacks and URL encoded variants as described in NCC Group Log4Shell detection research. Adversaries inject these strings to trigger CVE-2021-44228 remote code execution in vulnerable Log4j components so matching requests indicate active exploitation.

Possible Shellshock Exploitation Attempt via Web Request

This rule detects Shellshock (CVE-2014-6271) exploitation attempts where the Bash function-definition prefix appears inside HTTP request fields such as the User-Agent, URI query or Referer against CGI endpoints. Observed in NCC Group research capturing Shellshock payloads that deliver shell download commands. Detecting these requests helps identify attempts to gain unauthenticated remote code execution on exposed servers.

Possible F5 BIG-IP TMUI Exploitation via hsqldb Path Traversal Request

This rule detects HTTP requests targeting the F5 BIG-IP TMUI hsqldb servlet using directory traversal characteristic of CVE-2020-5902 exploitation. NCC Group honeypot data recorded attackers reaching the hsqldb endpoint to achieve unauthenticated remote code execution. Successful exploitation grants full administrative control of the appliance.

Suspicious Malicious WAR Deployment via GlassFish Admin Console

This rule detects requests referencing a cmd.war archive against the GlassFish server, the web-shell deployment step performed after the administration console authentication bypass to gain command execution. Deployment of an attacker WAR named cmd.war is a strong indicator of post-exploitation web shell installation.

Possible Oracle GlassFish Authentication Bypass via HTTP TRACE to Admin Console

This rule detects an HTTP TRACE request to the GlassFish administration console manageUserNew.jsf endpoint, the request pattern that exploits CVE-2011-1511 to bypass authentication on the admin interface. A TRACE method against this administrative resource indicates an attempt to gain unauthorized administrative access.

Suspicious Double-Extension Web Shell Upload via Nagios XI Custom Includes

This rule detects requests to a double-extension .jpg.php file, the upload-filter bypass used against Nagios XI to plant a PHP web shell in the custom-includes directory while posing as an image. Access to such a masqueraded script is a strong indicator of web shell deployment and interaction.

Possible Nagios XI Path Traversal via Graphtemplates Directory Parameter

This rule detects requests to the Nagios XI graphtemplates.php endpoint carrying a directory-traversal sequence in the dir parameter, the vulnerability used to read or include arbitrary files outside the intended template directory. A traversal payload against this endpoint indicates active exploitation of the Nagios XI local file inclusion flaw.

Possible Qlik Sense Unauthenticated Path Probe via TTF Extension Bypass

This rule detects an unauthenticated request that appends a bogus .ttf extension to the Qlik Sense product-info.json endpoint, a request-shaping trick used to bypass authentication and fingerprint vulnerable Qlik Sense builds prior to Cactus ransomware exploitation. The crafted extension query indicates reconnaissance against the CVE-2023-41265 style authentication bypass.

Malicious RBCD Delegation Attribute Modification

This rule detects modification of the msDS-AllowedToActOnBehalfOfOtherIdentity directory attribute, the write that configures resource-based constrained delegation and grants an attacker-controlled account the ability to impersonate users to a target host. Changes to this attribute outside sanctioned delegation management are a high-fidelity indicator of RBCD privilege escalation.

Malicious Anonymous NTLM Network Logon (via security)

This rule detects Event ID 4624 network logons authenticated as ANONYMOUS LOGON using the NTLM package, a footprint of coerced authentication and NTLM relay activity such as PetitPotam. Anonymous NTLM network logons are unusual in a healthy environment. This pattern accompanies relay attacks that lead to credential compromise and lateral movement.

Malicious APT15 Persistence via Nwsapagent Service or Run Key Registry Value

This rule detects registry modifications that register APT15 persistence under the Nwsapagent name in either a service key or an autorun Run key. Observed in NCC Group research on APT15 RoyalCli and RoyalDNS which persist via a Nwsapagent service and Run key. Masquerading persistence under a plausible service name is a hallmark of this espionage group.

Suspicious Winlogon Userinit Hijack for Persistence

This rule detects modification of the Winlogon Userinit value to a path other than the legitimate system userinit.exe, a logon persistence technique used by the Team9 malware family. Chaining an attacker binary into the Userinit key causes it to execute automatically during every interactive logon.

Malicious Team9 Persistence via BackUp Mgr Run Key

This rule detects creation of a Run key value named BackUp Mgr, a masquerading autostart entry used by the Team9 malware family to gain persistence at user logon. The benign-looking value name in an autorun location combined with a non-standard payload path is a strong indicator of Team9 persistence.

Malicious NetHealth Run Key Persistence

This rule detects creation of a NETHEALTH autorun value under the CurrentVersion Run key pointing to a NetHealth executable in AppData Roaming, the persistence mechanism used in the Rapid Breach intrusion to relaunch the implant at logon. A masqueraded health-monitor name running from a user profile path indicates malicious persistence.