Query: Sigma YAML for webserver
Matching passage: Sigma rule: Detects known suspicious (default) user-agents related to scanning/recon tools. Logsource: webserver. Rule: title: Suspicious User-Agents Related To Recon Tools id: 19aa4f58-94ca-45ff-bc34-92e533c0994a status: test description: Detects known suspicious (default) user-agents related to scanning/recon tools references: - https://github.com/commixproject/commix/blob/c7f1447371524427bb30abe731235acc7386153b/src/utils/settings.py#L281 - https://github.com/epi052/feroxbuster/blob/ffdf871abe0a358a1531ba4135e208d4dbe8fc31/src/config/utils.rs#L100 - https://github.com/ffuf/ffuf/blob/ce3cf6bd733a24d3a9f024305234c1a6298198eb/pkg/runner/simple.go#L130 - https://github.com/lanmaster53/recon-ng/blob/9e907dfe09fce2997f0301d746796408e01a60b7/recon/core/base.py#L92 - https://github.com/nmap/nmap/blob/2e47fa87469fd358ef64689d2d2de7294e385eb8/nselib/http.lua#L160 - https://github.com/OJ/gobuster/blob/d20300cc46096984565e82fb73a45bf8d281b990/libgobuster/helpers.go#L124 - https://github.com/sqlmapproject/sqlmap/blob/be216041e2f255ae43b050d466bd5bf92681e665/lib/core/settings.py#L29 - https://github.com/sullo/nikto/blob/999670cb6a939b6c93840ce666941756e4c5dcf5/program/plugins/nikto_core.plugin#L3515 - https://github.com/urbanadventurer/WhatWeb/blob/d279d93042d034f3fd29d5a893d44ccc0595d3f8/lib/whatweb.rb#L68 - https://github.com/wpscanteam/wpscan/blob/4f1ce142b9768044be3e35bd0cddf1052e35efe8/lib/wpscan/browser.rb#L32 - https://github.com/xmendez/wfuzz/blob/2263cd0932fef333118cd197656f709141bab615/src/wfuzz/facade.py#L43 - https://github.com/zmap/zgrab2/blob/e91fc9860ca6611eb7c6fe7d2fe2be70212a37ba/modules/http/scanner.go#L54 author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton date: 2022-07-19 modified: 2026-06-11 tags: - attack.initial-access - attack.t1190 logsource: category: webserver detection: selection: cs-user-agent|contains: - commix/ - feroxbuster/ - Fuzz Faster U Fool - GIS - AppSec Team - Project Vision - gobuster/ - Nikto/ - Nmap Scripting Engine - Recon-ng/v - sqlmap/ - WhatWeb/ - Wfuzz/ - WPScan v - zgrab/ condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects uncommon processes creating remote threads.. Logsource: windows / create_remote_thread. Rule: title: Rare Remote Thread Creation By Uncommon Source Image id: 02d1d718-dd13-41af-989d-ea85c7fab93f related: - id: 66d31e5f-52d6-40a4-9615-002d3789a119 type: derived status: test description: Detects uncommon processes creating remote threads. references: - Personal research, statistical analysis - https://lolbas-project.github.io author: Perez Diego (@darkquassar), oscd.community date: 2019-10-27 modified: 2025-12-08 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: product: windows category: create_remote_thread detection: selection: SourceImage|endswith: - \bash.exe - \cscript.exe - \cvtres.exe - \defrag.exe - \dialer.exe - \dnx.exe - \esentutl.exe - \excel.exe - \expand.exe - \find.exe - \findstr.exe - \forfiles.exe - \gpupdate.exe - \hh.exe - \installutil.exe - \lync.exe - \makecab.exe - \mDNSResponder.exe - \monitoringhost.exe - \msbuild.exe - \mshta.exe - \mspaint.exe - \outlook.exe - \ping.exe - \provtool.exe - \python.exe - \regsvr32.exe - \robocopy.exe - \runonce.exe - \sapcimc.exe - \smartscreen.exe - \spoolsv.exe - \tstheme.exe - \userinit.exe - \vssadmin.exe - \vssvc.exe - \w3wp.exe - \winscp.exe - \winword.exe - \wmic.exe - \wscript.exe filter_main_conhost: SourceImage: - C:\Windows\System32\Defrag.exe - C:\Windows\System32\makecab.exe TargetImage: C:\Windows\System32\conhost.exe filter_main_provtol_svchost: SourceImage: C:\Windows\System32\provtool.exe TargetImage: C:\Windows\System32\svchost.exe filter_main_provtool_system: SourceImage: C:\Windows\System32\provtool.exe TargetImage: System filter_main_userinit: SourceImage: C:\Windows\System32\userinit.exe TargetImage: C:\Windows\explorer.exe filter_main_winword: SourceImage|endswith: \WINWORD.EXE TargetImage|startswith: - C:\Program Files (x86)\ - C:\Program Files\ filter_main_ms_office: SourceImage|startswith: - C:\Program Files\Microsoft Office\ - C:\Program Files (x86)\Microsoft Office\ TargetImage: System filter_optional_explorer_vmtools: SourceImage|endswith: \SysWOW64\explorer.exe TargetImage: - C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe - C:\Program Files\VMware\VMware Tools\vmtoolsd.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - This rule is best put in testing first in order to create a baseline that reflects the data in your environment. level: high