Sigma detection rules, expert-reviewed

Possible Shellshock Exploitation Attempt via Web Request

This rule detects Shellshock (CVE-2014-6271) exploitation attempts where the Bash function-definition prefix appears inside HTTP request fields such as the User-Agent, URI query or Referer against CGI endpoints. Observed in NCC Group research capturing Shellshock payloads that deliver shell download commands. Detecting these requests helps identify attempts to gain unauthenticated remote code execution on exposed servers.

Possible Nagios XI Blind SQL Injection via chbActive Parameter Quote Injection

This rule detects requests to the Nagios XI nagiosql admin endpoints carrying quote injection in the chbActive parameter indicative of the blind SQL injection reported by NCC Group. Exploitation allows enumeration of the user table and extraction of credentials from the monitoring platform database.

Possible F5 BIG-IP TMUI Exploitation via hsqldb Path Traversal Request

This rule detects HTTP requests targeting the F5 BIG-IP TMUI hsqldb servlet using directory traversal characteristic of CVE-2020-5902 exploitation. NCC Group honeypot data recorded attackers reaching the hsqldb endpoint to achieve unauthenticated remote code execution. Successful exploitation grants full administrative control of the appliance.

Suspicious Malicious WAR Deployment via GlassFish Admin Console

This rule detects requests referencing a cmd.war archive against the GlassFish server, the web-shell deployment step performed after the administration console authentication bypass to gain command execution. Deployment of an attacker WAR named cmd.war is a strong indicator of post-exploitation web shell installation.

Possible Oracle GlassFish Authentication Bypass via HTTP TRACE to Admin Console

This rule detects an HTTP TRACE request to the GlassFish administration console manageUserNew.jsf endpoint, the request pattern that exploits CVE-2011-1511 to bypass authentication on the admin interface. A TRACE method against this administrative resource indicates an attempt to gain unauthorized administrative access.

Suspicious Double-Extension Web Shell Upload via Nagios XI Custom Includes

This rule detects requests to a double-extension .jpg.php file, the upload-filter bypass used against Nagios XI to plant a PHP web shell in the custom-includes directory while posing as an image. Access to such a masqueraded script is a strong indicator of web shell deployment and interaction.

Possible Nagios XI Path Traversal via Graphtemplates Directory Parameter

This rule detects requests to the Nagios XI graphtemplates.php endpoint carrying a directory-traversal sequence in the dir parameter, the vulnerability used to read or include arbitrary files outside the intended template directory. A traversal payload against this endpoint indicates active exploitation of the Nagios XI local file inclusion flaw.

Possible .NET Remoting Deserialisation Exploitation via REM Endpoint

This rule detects POST or M-POST requests to a .rem endpoint used by .NET Remoting over HTTP, the transport abused to deliver serialized gadget payloads for remote code execution through insecure deserialisation. Requests to these remoting endpoints, especially with the rare M-POST verb, indicate probing or exploitation of an exposed .NET Remoting service.

Possible Qlik Sense Unauthenticated Path Probe via TTF Extension Bypass

This rule detects an unauthenticated request that appends a bogus .ttf extension to the Qlik Sense product-info.json endpoint, a request-shaping trick used to bypass authentication and fingerprint vulnerable Qlik Sense builds prior to Cactus ransomware exploitation. The crafted extension query indicates reconnaissance against the CVE-2023-41265 style authentication bypass.

Possible noPac sAMAccountName Spoofing via Machine Account Rename

This rule detects a computer account whose sAMAccountName is renamed away from its trailing dollar sign, the core step of the noPac privilege-escalation chain abusing CVE-2021-42278 and CVE-2021-42287. Renaming a machine account to impersonate a domain controller lets an attacker request Kerberos tickets that escalate to Domain Admin.

Malicious RBCD Delegation Attribute Modification

This rule detects modification of the msDS-AllowedToActOnBehalfOfOtherIdentity directory attribute, the write that configures resource-based constrained delegation and grants an attacker-controlled account the ability to impersonate users to a target host. Changes to this attribute outside sanctioned delegation management are a high-fidelity indicator of RBCD privilege escalation.

Possible Kerberoasting via RC4 Service Ticket Requests

This rule detects Kerberos service ticket requests using weak RC4-HMAC encryption from non-machine accounts, the core telemetry of Kerberoasting where an attacker requests SPN tickets to crack service account passwords offline. Machine and krbtgt requests are excluded so the remaining user-driven RC4 requests highlight likely credential-access activity.

Malicious Anonymous NTLM Network Logon (via security)

This rule detects Event ID 4624 network logons authenticated as ANONYMOUS LOGON using the NTLM package, a footprint of coerced authentication and NTLM relay activity such as PetitPotam. Anonymous NTLM network logons are unusual in a healthy environment. This pattern accompanies relay attacks that lead to credential compromise and lateral movement.

Possible PetitPotam Coercion via IPC$ Named Pipe Access (via security)

This rule detects network share access in Event ID 5145 to the IPC$ share targeting sensitive RPC named pipes such as efsrpc and lsarpc used to coerce authentication. PetitPotam abuses the EFS RPC interface to force a host to authenticate to an attacker for NTLM relay. Coerced authentication relayed to ADCS or other services enables privilege escalation and domain takeover.

Possible Pass-the-Hash NTLM Network Logon (via security)

This rule detects network logons using the NTLM authentication package in Event ID 4624 with logon type 3, the pattern left behind by pass-the-hash lateral movement. Attackers reuse stolen NTLM hashes to authenticate to remote hosts without knowing the plaintext password. Hash reuse enables lateral movement and access to additional systems while blending with normal NTLM traffic.