Sigma detection rules, expert-reviewed

Suspicious SD-WAN Compromise Nim Implant C2 Beacon

This rule detects HTTP requests to the Nim implant endpoints observed in the ongoing Cisco Catalyst SD-WAN exploitation, where the backdoor uses fixed URI paths for handshake and exfiltration. The dedicated /api/v1/handshake and /exfiltrate routes reveal the implant control channel used after webshell deployment. Matching traffic indicates an active Nim implant beaconing from a compromised appliance.

ValleyRat Beacon Sideloading via NtHandleCallback Loading log.dll (via image_load)

This rule detects the NtHandleCallback.exe process loading log.dll from its working directory, the DLL sideloading pair used to launch the ValleyRat beacon in the Silver Fox campaign. Adversaries leverage a masqueraded executable and a co-located malicious DLL to run the beacon under a benign-looking process, making detection valuable for surfacing command-and-control staging.

Malicious GachiLoader C2 Beacon via X-Secret gachifamily Header

This rule detects HTTP traffic carrying the custom header value gachifamily or the GachiLoader C2 URI patterns /log and /richfamily, structural markers of the malware's command-and-control channel. These fixed protocol artifacts identify GachiLoader beaconing and tasking regardless of the C2 host in use.

Possible Hive0051 GammaLoad C2 Beacon via Crafted User-Agent (via proxy)

This rule detects the distinctive User-Agent string used by Hive0051 GammaLoad implants for victim profiling during command-and-control. The agent appends a host token followed by an eight-character uppercase hex identifier and a keyword delimited by repeated semicolons and slash-dot sequences. This structure does not occur in standard browser traffic.

Suspicious UPDTAE Backdoor Reverse Shell HTTP Beacon via Quad7 Operators

This rule detects HTTP requests carrying the hardcoded User-Agent value IOT together with POST requests to the /iot/post URI, the reverse shell beaconing pattern of the UPDTAE backdoor deployed by the Quad7 operators. The implant polls its C2 roughly every thirty seconds using this fixed header and path. The unusual static User-Agent and endpoint make this a reliable network indicator.

Malicious OysterLoader C2 Beacon Using WordPressAgent User Agent

This rule detects outbound web requests carrying the distinctive WordPressAgent FingerPrint user agent used by OysterLoader. The loader beacons to its command server with this hardcoded agent and reaches encrypted endpoints. A non browser user agent of this exact form is a high confidence network indicator of OysterLoader activity.

MintsLoader Stage-Two C2 Beacon via htr.php Key and Campaign Parameters (via proxy)

This rule detects MintsLoader stage-two command-and-control beacons that request the htr.php endpoint with key, host id, and campaign parameters against DGA-generated domains. Adversaries leverage this structured request to fetch the next-stage payload keyed to the infected host, making the endpoint-and-parameter combination a strong C2 indicator.

Malicious Cobalt Strike C2 Beaconing via REST URI Paths and Legacy MSIE User-Agent (via proxy)

This rule detects HTTP command-and-control beaconing that combines the /rest/funcStatus and /rest/policy/3/ URI paths with a legacy MSIE 7.0 .NET CLR User-Agent, a Malleable C2 profile used by a multi-stage Cobalt Strike loader analyzed by Joe Sandbox. Adversaries craft these profiles to blend beacon traffic into ordinary web requests, making the combined URI and User-Agent pattern a reliable signal of an active beacon before hands-on-keyboard activity.

CastleLoader Stager HTTP Beacon via Misspelled GoogeBot User-Agent (via proxy)

This rule detects outbound HTTP requests carrying the misspelled GoogeBot user-agent used by the CastleLoader stager to retrieve follow-on TAG-150 payloads while masquerading as a search-engine crawler. Adversaries leverage crawler-like user-agents to blend malicious downloads into ordinary web traffic, making this distinctive typo a reliable delivery-stage indicator.

Suspicious HTTP Beacon Using Rare MyIE User Agent (via proxy)

This rule detects outbound HTTP traffic carrying the uncommon MyIE user agent string used by the MemFun implant in a suspected China-based espionage operation against military targets in Southeast Asia. The hardcoded user agent identifies the malware's beaconing channel, so matching traffic to external hosts indicates active command and control.

Malicious CR4T C2 Beacon via TroubleShooter User-Agent (via proxy)

This rule detects outbound HTTP requests carrying the distinctive TroubleShooter User-Agent string which the CR4T implant of the DuneQuixote campaign uses when communicating with its command-and-control server.

Suspicious Khmer Shadow C2 Beacon with Malformed Chrome User-Agent (via proxy)

This rule detects outbound requests carrying the malformed Chrome 131 on Windows 10 user-agent string used by the Khmer Shadow implant to blend its C2 traffic. Adversaries craft this non-standard agent value that does not match any real browser build. The exact malformed string provides a low-noise channel indicator for this espionage cluster.

Suspicious C2 Beacon via cpp-httplib User Agent

This rule detects outbound HTTP requests carrying the cpp-httplib user agent, matching the Potemkin loader command-and-control channel observed with the test_agent identifier. The loader is built on the cpp-httplib library and this user agent rarely appears in legitimate enterprise browsing. Its presence in proxy or web telemetry indicates loader check-in and tasking.

Malicious PeerBlight Command and Control Beacon to qtss.cc Domain

This rule detects DNS resolution of the qtss.cc domain, the ZinFoq command and control infrastructure contacted by the PeerBlight Linux backdoor for beaconing. Resolution of this domain indicates an infected host reaching out to attacker-controlled C2. The domain is a known PeerBlight indicator and has no legitimate business use.

Malicious Koi Loader C2 Check-in via Index PHP Beacon (via proxy)

This rule detects Koi Loader command-and-control beacons to an index.php endpoint carrying the campaign-specific subid=px8eIkut parameter used for host registration. This structured query pattern accompanies the pipe-delimited 101|GUID|VoYGkc5R check-in marker. Detecting it surfaces active Koi Loader C2 that precedes Koi Stealer deployment and credential exfiltration.