deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Raw Paste Service Access
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-12-05
ATT&CK techniques: T1071.001, T1102.001, T1102.003
Log source: /proxy

Description:
Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form

Detection logic:
{
  "selection": {
    "c-uri|contains": [
      ".paste.ee/r/",
      ".pastebin.com/raw/",
      ".hastebin.com/raw/",
      ".ghostbin.co/paste/*/raw/",
      "pastetext.net/",
      "pastebin.pl/",
      "paste.ee/"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.virustotal.com/gui/domain/paste.ee/relations
Sigma Detection Rule: Bitsadmin to Uncommon TLD
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Tim Shelton
Date: 2019-03-07
ATT&CK techniques: T1071.001, T1197
Log source: /proxy

Description:
Detects Bitsadmin connections to domains with uncommon TLDs

Detection logic:
{
  "selection": {
    "c-useragent|startswith": "Microsoft BITS/"
  },
  "falsepositives": {
    "cs-host|endswith": [
      ".com",
      ".net",
      ".org",
      ".scdn.co",
      ".sfx.ms"
    ]
  },
  "condition": "selection and not falsepositives"
}

References:
  - https://twitter.com/jhencinski/status/[PII_REDACTED]55349248
  - https://isc.sans.edu/forums/diary/Investigating+Microsoft+BITS+Activity/23281/
Sigma Detection Rule: HackTool - Empire UserAgent URI Combo
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-07-13
ATT&CK techniques: T1071.001
Log source: /proxy

Description:
Detects user agent and URI paths used by empire agents

Detection logic:
{
  "selection": {
    "c-useragent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
    "cs-uri": [
      "/admin/get.php",
      "/news.php",
      "/login/process.php"
    ],
    "cs-method": "POST"
  },
  "condition": "selection"
}

References:
  - https://github.com/BC-SECURITY/Empire
Sigma Detection Rule: PUA - Advanced IP/Port Scanner Update Check
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Axel Olsson
Date: 2022-08-14
ATT&CK techniques: T1590
Log source: /proxy

Description:
Detect the update check performed by Advanced IP/Port Scanner utilities.

Detection logic:
{
  "selection": {
    "c-uri|contains": "/checkupdate.php",
    "c-uri-query|contains|all": [
      "lng=",
      "ver=",
      "beta=",
      "type=",
      "rmode=",
      "product="
    ]
  },
  "condition": "selection"
}

References:
  - https://www.advanced-ip-scanner.com/
  - https://www.advanced-port-scanner.com/
Sigma Detection Rule: Windows WebDAV User Agent
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2018-04-06
ATT&CK techniques: T1071.001
Log source: /proxy

Description:
Detects WebDav DownloadCradle

Detection logic:
{
  "selection": {
    "c-useragent|startswith": "Microsoft-WebDAV-MiniRedir/",
    "cs-method": "GET"
  },
  "condition": "selection"
}

References:
  - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html
Sigma Detection Rule: Bitsadmin to Uncommon IP Server Address
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-06-10
ATT&CK techniques: T1071.001, T1197
Log source: /proxy

Description:
Detects Bitsadmin connections to IP addresses instead of FQDN names

Detection logic:
{
  "selection": {
    "c-useragent|startswith": "Microsoft BITS/",
    "cs-host|endswith": [
      "1",
      "2",
      "3",
      "4",
      "5",
      "6",
      "7",
      "8",
      "9"
    ]
  },
  "condition": "selection"
}

References:
  - https://isc.sans.edu/diary/Microsoft+BITS+Used+to+Download+Payloads/21027
Sigma Detection Rule: F5 BIG-IP iControl Rest API Command Execution - Proxy
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo
Date: 2023-11-08
ATT&CK techniques: T1190
Log source: /proxy

Description:
Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP

Detection logic:
{
  "selection": {
    "cs-method": "POST",
    "c-uri|endswith": "/mgmt/tm/util/bash"
  },
  "condition": "selection"
}

References:
  - https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash
  - https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029
  - https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516
Sigma Detection Rule: Exploit Framework User Agent
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-07-08
ATT&CK techniques: T1071.001
Log source: /proxy

Description:
Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs

Detection logic:
{
  "selection": {
    "c-useragent": [
      "Internet Explorer *",
      "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.2)",
      "Mozilla/4.0 (compatible; Metasploit RSPEC)",
      "Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)",
      "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)",
      "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)",
      "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)",
      "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0; SIMBAR={7DB0F6DE-8DE7-4841-9084-28FA914B0F2E}; SLCC1; .N",
      "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)",
      "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/4.0.221.6 Safari/525.13",
      "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MAAU)",
      "Mozilla/5.0",
      "Mozilla/4.0 (compatible; SPIPE/1.0",
      "Mozilla/5.0 (Windows NT 6.3; rv:39.0) Gecko/20100101 Firefox/35.0",
      "Sametime Community Agent",
      "X-FORWARDED-FOR",
      "DotDotPwn v2.1",
      "SIPDROID",
      "Mozilla/5.0 (Windows NT 10.0; Win32; x32; rv:60.0)",
      "Mozilla/6.0 (X11; Linux x86_64; rv:24.0) Gecko/20140205     Firefox/27.0 Iceweasel/25.3.0",
      "*wordpress hash grabber*",
      "*exploit*",
      "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36"
    ]
  },
  "condition": "selection"
}

References:
  - https://blog.didierstevens.com/2015/03/16/quickpost-metasploit-user-agent-strings/
Sigma Detection Rule: Download from Suspicious Dyndns Hosts
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-11-08
ATT&CK techniques: T1105, T1568
Log source: /proxy

Description:
Detects download of certain file types from hosts with dynamic DNS names (selected list)

Detection logic:
{
  "selection": {
    "c-uri-extension": [
      "exe",
      "vbs",
      "bat",
      "rar",
      "ps1",
      "doc",
      "docm",
      "xls",
      "xlsm",
      "pptm",
      "rtf",
      "hta",
      "dll",
      "ws",
      "wsf",
      "sct",
      "zip"
    ],
    "cs-host|endswith": [
      ".hopto.org",
      ".no-ip.org",
      ".no-ip.info",
      ".no-ip.biz",
      ".no-ip.com",
      ".noip.com",
      ".ddns.name",
      ".myftp.org",
      ".myftp.biz",
      ".serveblog.net",
      ".servebeer.com",
      ".servemp3.com",
      ".serveftp.com",
      ".servequake.com",
      ".servehalflife.com",
      ".servehttp.com",
      ".servegame.com",
      ".servepics.com",
      ".myvnc.com",
      ".ignorelist.com",
      ".jkub.com",
      ".dlinkddns.com",
      ".jumpingcrab.com",
      ".ddns.info",
      ".mooo.com",
      ".dns-dns.com",
      ".strangled.net",
      ".adultdns.net",
      ".craftx.biz",
      ".ddns01.com",
      ".dns53.biz",
      ".dnsapi.info",
      ".dnsd.info",
      ".dnsdynamic.com",
      ".dnsdynamic.net",
      ".dnsget.org",
      ".fe100.net",
      ".flashserv.net",
      ".ftp21.net",
      ".http01.com",
      ".http80.info",
      ".https443.com",
      ".imap01.com",
      ".kadm5.com",
      ".mysq1.net",
      ".ns360.info",
      ".ntdll.net",
      ".ole32.com",
      ".proxy8080.com",
      ".sql01.com",
      ".ssh01.com",
      ".ssh22.net",
      ".tempors.com",
      ".tftpd.net",
      ".ttl60.com",
      "

References:
  - https://www.alienvault.com/blogs/security-essentials/dynamic-dns-security-and-potential-threats
Sigma Detection Rule: Potential Base64 Encoded User-Agent
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Brian Ingram (update)
Date: 2022-07-08
ATT&CK techniques: T1071.001
Log source: /proxy

Description:
Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.

Detection logic:
{
  "selection": {
    "c-useragent|endswith": "="
  },
  "condition": "selection"
}

References:
  - https://blogs.jpcert.or.jp/en/2022/07/yamabot.html
  - https://deviceatlas.com/blog/list-of-user-agent-strings#desktop
Sigma Detection Rule: Telegram API Access
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2018-06-05
ATT&CK techniques: T1071.001, T1102.002
Log source: /proxy

Description:
Detects suspicious requests to Telegram API without the usual Telegram User-Agent

Detection logic:
{
  "selection": {
    "cs-host": "api.telegram.org"
  },
  "filter": {
    "c-useragent|contains": [
      "Telegram",
      "Bot"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/
  - https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/
  - https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/
Sigma Detection Rule: HackTool - CobaltStrike Malleable Profile Patterns - Proxy
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Markus Neis, Florian Roth (Nextron Systems)
Date: 2024-02-15
ATT&CK techniques: T1071.001
Log source: /proxy

Description:
Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).

Detection logic:
{
  "selection_amazon_1": {
    "c-useragent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
    "cs-method": "GET",
    "c-uri": "/s/ref=nb_sb_noss_1/[PII_REDACTED]-0262949/field-keywords=books",
    "cs-host": "www.amazon.com",
    "cs-cookie|endswith": "=csm-hit=s-24KU11BB82RZSYGJ3BDK|[PII_REDACTED]96"
  },
  "selection_amazon_2": {
    "c-useragent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
    "cs-method": "POST",
    "c-uri": "/N4215/adj/amzn.us.sr.aps",
    "cs-host": "www.amazon.com"
  },
  "selection_generic_1": {
    "c-useragent": [
      "Mozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.1)",
      "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E )",
      "Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2) Java/1.5.0_08"
    ]
  },
  "selection_generic_2": {
    "c-useragent|endswith": "; MANM; MANM)"
  },
  "selection_oscp": {
    "c-uri|contains": "/oscp/",
    "cs-host": "ocsp.verisign.com"
  },
  "selection_onedrive": {
    "cs-method": "GET",
    "c-uri|endswith": "\\?manifest=wac",
    "cs-host": "onedrive.live.com"
  },
  "filter_main_onedrive": {
    "c-uri|startswith": "http",
    "c-uri|contains": "://onedrive.live.com/"
  },
  "condition": "1 of selection_* and not 1 of filter_main_*"
}

References:
  - https://github.com/rsmudge/Malleable-C2-Profiles/blob/[PII_REDACTED]2913923d20c5a638c6ca79459e8529/normal/amazon.profile
  - https://www.hybrid-analysis.com/sample/ee5eca8648e45e2fea9dac0d920ef1a1792d8690c41ee7f20343de1927cc88b9?environmentId=100
  - https://github.com/rsmudge/Malleable-C2-Profiles/blob/[PII_REDACTED]2913923d20c5a638c6ca79459e8529/normal/ocsp.profile
  - https://github.com/yeyintminthuhtut/Malleable-C2-Profiles-Collection/
  - https://github.com/rsmudge/Malleable-C2-Profiles/blob/[PII_REDACTED]2913923d20c5a638c6ca79459e8529/normal/onedrive_getonly.profile
Sigma Detection Rule: Download From Suspicious TLD - Whitelist
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-03-13
ATT&CK techniques: T1566, T1203, T1204.002
Log source: /proxy

Description:
Detects executable downloads from suspicious remote systems

Detection logic:
{
  "selection": {
    "c-uri-extension": [
      "exe",
      "vbs",
      "bat",
      "rar",
      "ps1",
      "doc",
      "docm",
      "xls",
      "xlsm",
      "pptm",
      "rtf",
      "hta",
      "dll",
      "ws",
      "wsf",
      "sct",
      "zip"
    ]
  },
  "filter": {
    "cs-host|endswith": [
      ".com",
      ".org",
      ".net",
      ".edu",
      ".gov",
      ".uk",
      ".ca",
      ".de",
      ".jp",
      ".fr",
      ".au",
      ".us",
      ".ch",
      ".it",
      ".nl",
      ".se",
      ".no",
      ".es"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - Internal Research
Sigma Detection Rule: Crypto Miner User Agent
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-10-21
ATT&CK techniques: T1071.001
Log source: /proxy

Description:
Detects suspicious user agent strings used by crypto miners in proxy logs

Detection logic:
{
  "selection": {
    "c-useragent|startswith": [
      "XMRig ",
      "ccminer"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/xmrig/xmrig/blob/da22b3e6c45825f3ac1f208255126cb8585cd4fc/src/base/kernel/Platform_win.cpp#L65
  - https://github.com/xmrig/xmrig/blob/427b6516e0550200c17ca28675118f0fffcc323f/src/version.h
Sigma Detection Rule: Potential Hello-World Scraper Botnet Activity
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Joseph A. M.
Date: 2025-08-02
ATT&CK techniques: T1595
Log source: /proxy

Description:
Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string.


Detection logic:
{
  "selection": {
    "c-useragent": "Hello-World/1.0",
    "cs-method": "GET"
  },
  "condition": "selection"
}

References:
  - https://www.greynoise.io/blog/new-scraper-botnet-concentrated-in-taiwan
  - https://viz.greynoise.io/tags/hello-world-scraper-botnet?days=30
Sigma Detection Rule: Windows PowerShell User Agent
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-03-13
ATT&CK techniques: T1071.001
Log source: /proxy

Description:
Detects Windows PowerShell Web Access

Detection logic:
{
  "selection": {
    "c-useragent|contains": " WindowsPowerShell/"
  },
  "condition": "selection"
}

References:
  - https://msdn.microsoft.com/powershell/reference/5.1/microsoft.powershell.utility/Invoke-WebRequest
Sigma Detection Rule: Malware User Agent
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2017-07-08
ATT&CK techniques: T1071.001
Log source: /proxy

Description:
Detects suspicious user agent strings used by malware in proxy logs

Detection logic:
{
  "selection": {
    "c-useragent": [
      "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:53.0) Gecko/20100101 Chrome /53.0",
      "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)",
      "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)",
      "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR  1.1.4322)",
      "HttpBrowser/1.0",
      "*<|>*",
      "nsis_inetc (mozilla)",
      "Wget/1.9+cvs-stable (Red Hat modified)",
      "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322)",
      "*zeroup*",
      "Mozilla/5.0 (Windows NT 5.1 ; v.*",
      "* adlib/*",
      "* tiny",
      "* BGroom *",
      "* changhuatong",
      "* CholTBAgent",
      "Mozilla/5.0 WinInet",
      "RookIE/1.0",
      "M",
      "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)",
      "Mozilla/4.0 (compatible;MSIE 7.0;Windows NT 6.0)",
      "backdoorbot",
      "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731)",
      "Opera/8.81 (Windows NT 6.0; U; en)",
      "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30729)",
      "Opera",
      "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)",
      "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)",
      "MSIE",
      "*(Charon; Inferno)",
      "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0)",
      "Mozilla/4.0 (compatible; MSIE 6.1; Windows N

References:
  - http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules
  - http://www.botopedia.org/search?searchword=scan&searchphrase=all
  - https://networkraptor.blogspot.com/2015/01/user-agent-strings.html
  - https://perishablepress.com/blacklist/ua-2013.txt
  - https://www.bluecoat.com/en-gb/security-blog/2015-05-05/know-your-agents
Sigma Detection Rule: Apache Threading Error
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-01-22
ATT&CK techniques: T1190, T1210
Log source: /

Description:
Detects an issue in apache logs that reports threading related errors

Detection logic:
{
  "keywords": [
    "__pthread_tpp_change_priority: Assertion `new_prio == -1 || (new_prio >= fifo_min_prio && new_prio <= fifo_max_prio)"
  ],
  "condition": "keywords"
}

References:
  - https://github.com/hannob/apache-uaf/blob/da40f2be3684c8095ec6066fa68eb5c07a086233/README.md
Sigma Detection Rule: Apache Segmentation Fault
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-02-28
ATT&CK techniques: T1499.004
Log source: /

Description:
Detects a segmentation fault error message caused by a crashing apache worker process

Detection logic:
{
  "keywords": [
    "exit signal Segmentation Fault"
  ],
  "condition": "keywords"
}

References:
  - http://www.securityfocus.com/infocus/1633
Sigma Detection Rule: Nginx Core Dump
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-05-31
ATT&CK techniques: T1499.004
Log source: /

Description:
Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.

Detection logic:
{
  "keywords": [
    "exited on signal 6 (core dumped)"
  ],
  "condition": "keywords"
}

References:
  - https://docs.nginx.com/nginx/admin-guide/monitoring/debugging/#enabling-core-dumps
  - https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/
Sigma Detection Rule: F5 BIG-IP iControl Rest API Command Execution - Webserver
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo
Date: 2023-11-08
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP

Detection logic:
{
  "selection": {
    "cs-method": "POST",
    "cs-uri-query|endswith": "/mgmt/tm/util/bash"
  },
  "condition": "selection"
}

References:
  - https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash
  - https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029
  - https://community.f5.com/t5/technical-forum/running-bash-commands-via-rest-api/td-p/272516
Sigma Detection Rule: Suspicious User-Agents Related To Recon Tools
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton
Date: 2022-07-19
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects known suspicious (default) user-agents related to scanning/recon tools

Detection logic:
{
  "selection": {
    "cs-user-agent|contains": [
      "Wfuzz/",
      "WPScan v",
      "Recon-ng/v",
      "GIS - AppSec Team - Project Vision"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/wpscanteam/wpscan/blob/196fbab5b1ce3870a43515153d4f07878a89d410/lib/wpscan/browser.rb
  - https://github.com/xmendez/wfuzz/blob/1b695ee9a87d66a7d7bf6cae70d60a33fae51541/docs/user/basicusage.rst
  - https://github.com/lanmaster53/recon-ng/blob/9e907dfe09fce2997f0301d746796408e01a60b7/recon/core/base.py#L92
Sigma Detection Rule: Java Payload Strings
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Harjot Singh, "@cyb3rjy0t" (update)
Date: 2022-06-04
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects possible Java payloads in web access logs

Detection logic:
{
  "keywords": [
    "%24%7B%28%23a%3D%40",
    "${(#a=@",
    "%24%7B%40java",
    "${@java",
    "u0022java",
    "%2F%24%7B%23",
    "/${#",
    "new+java.",
    "getRuntime().exec(",
    "getRuntime%28%29.exec%28"
  ],
  "condition": "keywords"
}

References:
  - https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/
  - https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/
  - https://github.com/httpvoid/writeups/blob/62d[PII_REDACTED]d088ccfdf4d0ffbf61598a2cd7d/Confluence-RCE.md
  - https://twitter.com/httpvoid0x2f/status/[PII_REDACTED]35384832
  - https://medium.com/geekculture/text4shell-exploit-walkthrough-ebc02a01f035
Sigma Detection Rule: SQL Injection Strings In URI
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Saw Win Naung, Nasreddine Bencherchali (Nextron Systems), Thurein Oo (Yoma Bank)
Date: 2020-02-22
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects potential SQL injection attempts via GET requests in access logs.

Detection logic:
{
  "selection": {
    "cs-method": "GET"
  },
  "keywords": [
    "@@version",
    "%271%27%3D%271",
    "=select ",
    "=select(",
    "=select%20",
    "concat_ws(",
    "CONCAT(0x",
    "from mysql.innodb_table_stats",
    "from%20mysql.innodb_table_stats",
    "group_concat(",
    "information_schema.tables",
    "json_arrayagg(",
    "or 1=1#",
    "or%201=1#",
    "order by ",
    "order%20by%20",
    "select * ",
    "select database()",
    "select version()",
    "select%20*%20",
    "select%20database()",
    "select%20version()",
    "select%28sleep%2810%29",
    "SELECTCHAR(",
    "table_schema",
    "UNION ALL SELECT",
    "UNION SELECT",
    "UNION%20ALL%20SELECT",
    "UNION%20SELECT",
    "'1'='1"
  ],
  "filter_main_status": {
    "sc-status": 404
  },
  "condition": "selection and keywords and not 1 of filter_main_*"
}

References:
  - https://www.acunetix.com/blog/articles/exploiting-sql-injection-example/
  - https://www.acunetix.com/blog/articles/using-logs-to-investigate-a-web-application-attack/
  - https://brightsec.com/blog/sql-injection-payloads/
  - https://github.com/payloadbox/sql-injection-payload-list
  - https://book.hacktricks.xyz/pentesting-web/sql-injection/mysql-injection