deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Shai-Hulud Malicious GitHub Workflow Creation
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-09-24
ATT&CK techniques: T1552.001, T1119
Log source: linux/file_event

Description:
Detects creation of shai-hulud-workflow.yml file associated with Shai Hulud worm targeting NPM supply chain attack that exfiltrates GitHub secrets

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      ".github/workflows/shai-hulud-workflow.yaml",
      ".github/workflows/shai-hulud-workflow.yml",
      ".github/workflows/shai-hulud.yaml",
      ".github/workflows/shai-hulud.yml"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.safetycli.com/blog/shai-hulud-npm-attack-runs-malicious-github-action
Sigma Detection Rule: DNS Query To Katz Stealer Domains - Network
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-05-22
ATT&CK techniques: T1071.004
Log source: /dns

Description:
Detects DNS queries to domains associated with Katz Stealer malware.
Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems.
In Enterprise environments, DNS queries to these domains may indicate potential malicious activity or compromise.


Detection logic:
{
  "selection": {
    "query|contains": [
      "katz-panel.com",
      "katz-stealer.com",
      "katzstealer.com",
      "twist2katz.com"
    ]
  },
  "condition": "selection"
}

References:
  - Internal research
Sigma Detection Rule: DNS Query To Katz Stealer Domains
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-05-22
ATT&CK techniques: T1071.004
Log source: windows/dns_query

Description:
Detects DNS queries to domains associated with Katz Stealer malware.
Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems.
In Enterprise environments, DNS queries to these domains may indicate potential malicious activity or compromise.


Detection logic:
{
  "selection": {
    "QueryName|contains": [
      "katz-panel.com",
      "katz-stealer.com",
      "katzstealer.com",
      "twist2katz.com"
    ]
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: Katz Stealer Suspicious User-Agent
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-05-22
ATT&CK techniques: T1071.001
Log source: zeek/

Description:
Detects network connections with a suspicious user-agent string containing "katz-ontop", which may indicate Katz Stealer activity.


Detection logic:
{
  "selection": {
    "user_agent|contains": "katz-ontop"
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: Katz Stealer DLL Loaded
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-05-22
ATT&CK techniques: T1129
Log source: windows/image_load

Description:
Detects loading of DLLs associated with Katz Stealer malware 2025 variants.
Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems.
The process that loads these DLLs are very likely to be malicious.


Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": [
      "\\katz_ontop.dll",
      "\\AppData\\Local\\Temp\\received_dll.dll"
    ]
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Nisarg Suthar
Date: 2025-08-01
ATT&CK techniques: T1059.001, T1059.003, T1068, T1190
Log source: windows/process_creation

Description:
Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\crushftp.exe"
  },
  "selection_child_powershell": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\powershell_ise.exe",
      "\\pwsh.exe"
    ],
    "CommandLine|contains|all": [
      "IEX",
      "enc",
      "Hidden",
      "bypass"
    ]
  },
  "selection_child_cmd": {
    "Image|endswith": "\\cmd.exe",
    "CommandLine|contains": [
      "/c powershell",
      "whoami",
      "net.exe",
      "net1.exe"
    ]
  },
  "selection_child_others": {
    "Image|endswith": [
      "\\bitsadmin.exe",
      "\\certutil.exe",
      "\\mshta.exe",
      "\\cscript.exe",
      "\\wscript.exe"
    ]
  },
  "condition": "selection_parent and 1 of selection_child_*"
}

References:
  - https://reliaquest.com/blog/threat-spotlight-cve-2025-54309-crushftp-exploit/
  - https://pwn.guide/free/web/crushftp
  - https://firecompass.com/crushftp-vulnerability-cve-2025-54309-securing-file-transfer-services/
Sigma Detection Rule: Suspicious Creation of .library-ms File — Potential CVE-2025-24054 Exploit
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Gene Kazimiarovich
Date: 2025-04-20
ATT&CK techniques: T1187
Log source: windows/file_event

Description:
Detects creation of '.library-ms' files, which may indicate exploitation of CVE-2025-24054. This vulnerability allows an attacker to trigger an automatic outbound SMB or WebDAV authentication request to a remote server upon archive extraction.
If the system is unpatched, no user interaction is required beyond extracting a malicious archive—potentially exposing the user's NTLMv2-SSP hash to the attacker.


Detection logic:
{
  "selection": {
    "TargetFilename|endswith": ".library-ms",
    "Image|endswith": [
      "\\7z.exe",
      "\\winrar.exe",
      "\\explorer.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054
  - https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/
Sigma Detection Rule: Potential SAP NetViewer Webshell Command Execution
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-05-14
ATT&CK techniques: T1505.003, T1190
Log source: /webserver

Description:
Detects potential command execution via webshell in SAP NetViewer through JSP files with cmd parameter.
This rule is created to detect exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution via a webshell.


Detection logic:
{
  "selection_uri": {
    "cs-uri-stem|contains|all": [
      "/irj/",
      ".jsp"
    ]
  },
  "selection_query": [
    {
      "cs-uri-query|startswith": [
        "cmd=",
        "command=",
        "exec_cmd=",
        "exec="
      ]
    },
    {
      "cs-uri-query|contains": [
        "/dev/tcp",
        "/etc/passwd",
        "%2fdev%2ftcp",
        "%2fetc%2fpasswd",
        "=uname",
        "=whoami",
        "ifconfig",
        "ping",
        "pwd"
      ]
    },
    {
      "cs-uri-query|contains|all": [
        "echo",
        "base64"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures
Sigma Detection Rule: Potential SAP NetWeaver Webshell Creation
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-04-28
ATT&CK techniques: T1190, T1059.003
Log source: windows/file_event

Description:
Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories,
which may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324.


Detection logic:
{
  "selection_path": {
    "TargetFilename|contains": [
      "\\j2ee\\cluster\\apps\\sap.com\\irj\\servlet_jsp\\irj\\work",
      "\\j2ee\\cluster\\apps\\sap.com\\irj\\servlet_jsp\\irj\\root"
    ]
  },
  "selection_ext": {
    "TargetFilename|endswith": [
      ".jsp",
      ".java",
      ".class"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31324
  - https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
  - https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
Sigma Detection Rule: Suspicious Child Process of SAP NetWeaver - Linux
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-04-28
ATT&CK techniques: T1190, T1059.003
Log source: linux/process_creation

Description:
Detects suspicious child processes spawned by SAP NetWeaver on Linux systems that could indicate potential
exploitation of vulnerability that allows arbitrary execution via webshells such as CVE-2025-31324.


Detection logic:
{
  "selection_parent_img": {
    "ParentImage|contains": [
      "/j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/work",
      "/j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/root"
    ]
  },
  "selection_current_dict": {
    "CurrentDirectory|contains": [
      "/j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/work",
      "/j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/root"
    ]
  },
  "selection_child": {
    "Image|endswith": [
      "/ash",
      "/bash",
      "/csh",
      "/dash",
      "/ksh",
      "/sh",
      "/tcsh",
      "/zsh",
      "/python",
      "/python2",
      "/python3",
      "/perl",
      "/ruby",
      "/curl",
      "/wget",
      "/nc",
      "/netcat",
      "/ncat",
      "/socat",
      "/nmap",
      "/telnet",
      "/awk",
      "/sed"
    ]
  },
  "condition": "(selection_parent_img or selection_current_dict) and selection_child"
}

References:
  - https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
  - https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
Sigma Detection Rule: Suspicious Child Process of SAP NetWeaver
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-04-28
ATT&CK techniques: T1190, T1059.003
Log source: windows/process_creation

Description:
Detects suspicious child processes spawned by SAP NetWeaver that could indicate potential
exploitation of vulnerability that allows arbitrary execution via webshells such as CVE-2025-31324.


Detection logic:
{
  "selection_parent_img": {
    "ParentImage|contains": [
      "\\j2ee\\cluster\\apps\\sap.com\\irj\\servlet_jsp\\irj\\work",
      "\\j2ee\\cluster\\apps\\sap.com\\irj\\servlet_jsp\\irj\\root"
    ]
  },
  "selection_current_dict": {
    "CurrentDirectory|contains": [
      "\\j2ee\\cluster\\apps\\sap.com\\irj\\servlet_jsp\\irj\\work",
      "\\j2ee\\cluster\\apps\\sap.com\\irj\\servlet_jsp\\irj\\root"
    ]
  },
  "selection_child": {
    "Image|endswith": [
      "\\cmd.exe",
      "\\powershell.exe",
      "\\powershell_ise.exe",
      "\\pwsh.exe",
      "\\wscript.exe",
      "\\cscript.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\mshta.exe",
      "\\certutil.exe",
      "\\bitsadmin.exe",
      "\\python.exe"
    ]
  },
  "condition": "(selection_parent_img or selection_current_dict) and selection_child"
}

References:
  - https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
  - https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
Sigma Detection Rule: Potential Java WebShell Upload in SAP NetViewer Server
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-05-14
ATT&CK techniques: T1505.003
Log source: /webserver

Description:
Detects potential Java webshell uploads via HTTP requests with Content-Type 'application/octet-stream' and Java file extensions.
This behavior might indicate exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution through webshells in SAP NetViewer.


Detection logic:
{
  "selection": {
    "cs-content-type": "application/octet-stream",
    "cs-method": "POST",
    "cs-uri-stem|contains|all": [
      "/irj/",
      ".jsp"
    ],
    "cs-uri-stem|endswith": [
      ".class",
      ".java",
      ".jsp"
    ]
  },
  "condition": "selection"
}

References:
  - https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures
Sigma Detection Rule: Potential SAP NetWeaver Webshell Creation - Linux
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-04-28
ATT&CK techniques: T1190, T1059.003
Log source: linux/file_event

Description:
Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories,
which may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324.


Detection logic:
{
  "selection_path": {
    "TargetFilename|contains": [
      "/j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/work/",
      "/j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/root/"
    ]
  },
  "selection_ext": {
    "TargetFilename|endswith": [
      ".jsp",
      ".java",
      ".class"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31324
  - https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
  - https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
Sigma Detection Rule: Commvault QOperation Path Traversal Webshell Drop (CVE-2025-57790)
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-10-20
ATT&CK techniques: T1505.003
Log source: windows/process_creation

Description:
Detects the use of qoperation.exe with the -file argument to write a JSP file to the webroot, indicating a webshell drop.
This is a post-authentication step corresponding to CVE-2025-57790.


Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "qoperation",
      "exec",
      " -af ",
      ".xml ",
      "\\Apache\\webapps\\ROOT\\",
      ".jsp"
    ]
  },
  "condition": "selection"
}

References:
  - https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
Sigma Detection Rule: Potential Notepad++ CVE-2025-49144 Exploitation
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-06-26
ATT&CK techniques: T1574.008
Log source: windows/process_creation

Description:
Detects potential exploitation of CVE-2025-49144, a local privilege escalation vulnerability in Notepad++ installers (v8.8.1 and prior) where the installer calls regsvr32.exe without specifying the full path.
This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this Legitimate Notepad++ installer.
The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\regsvr32.exe",
    "CommandLine|startswith": "regsvr32 /s",
    "CommandLine|contains": "\\contextMenu\\NppShell.dll"
  },
  "filter_main_legit_regsvr32": {
    "Image": [
      "C:\\Windows\\System32\\regsvr32.exe",
      "C:\\Windows\\SysWOW64\\regsvr32.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49144
  - https://x.com/NullSecurityX/status/[PII_REDACTED]67029179
Sigma Detection Rule: Suspicious Process Spawned by CentreStack Portal AppPool
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Jason Rathbun (Blackpoint Cyber)
Date: 2025-04-17
ATT&CK techniques: T1059.003, T1505.003
Log source: windows/process_creation

Description:
Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406)


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\w3wp.exe",
    "ParentCommandLine|contains": "\\portal\\portal.config",
    "Image|endswith": "\\cmd.exe"
  },
  "condition": "selection"
}

References:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-30406
  - https://blackpointcyber.com/blog/racing-to-exploit-centrestacks-cve-2025-30406/
  - https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf
  - https://www.bleepingcomputer.com/news/security/centrestack-rce-exploited-as-zero-day-to-breach-file-sharing-servers/
Sigma Detection Rule: Suspicious Child Process of SolarWinds WebHelpDesk
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Huntress Team, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-02-11
ATT&CK techniques: T1190
Log source: windows/process_creation

Description:
Detects suspicious child processes spawned by SolarWinds WebHelpDesk (WHD) application, which may indicate exploitation activity leveraging RCE vulnerabilities such as CVE-2025-40551, CVE-2025-40536, or CVE-2025-26399


Detection logic:
{
  "selection_parent": {
    "ParentImage|contains": "\\WebHelpDesk\\bin\\",
    "ParentImage|endswith": [
      "\\java.exe",
      "\\javaw.exe"
    ],
    "ParentCommandLine|contains": "tomcat"
  },
  "selection_suspicious_child": {
    "CommandLine|contains": [
      "-enc",
      "base64",
      "bitsadmin",
      "certutil",
      "curl",
      "Invoke-RestMethod",
      "Invoke-WebRequest",
      "irm ",
      "iwr ",
      "mshta",
      "msiexec",
      "Net.WebClient",
      "Start-BitsTransfer",
      "wget",
      "wmic"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/
  - https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399
  - https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm
Sigma Detection Rule: Suspicious CrushFTP Child Process
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Craig Sweeney, Matt Anderson, Jose Oregon, Tim Kasper, Faith Stratton, Samantha Shaw, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-04-10
ATT&CK techniques: T1059.001, T1059.003, T1190
Log source: windows/process_creation

Description:
Detects suspicious child processes spawned by the CrushFTP service that may indicate exploitation of remote code execution vulnerabilities such as
CVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests.
The detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands.


Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\crushftpservice.exe"
  },
  "selection_child": {
    "Image|endswith": [
      "\\bash.exe",
      "\\cmd.exe",
      "\\cscript.exe",
      "\\mshta.exe",
      "\\powershell.exe",
      "\\powershell_ise.exe",
      "\\pwsh.exe",
      "\\sh.exe",
      "\\wscript.exe"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-2825
  - https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update
  - https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/
  - https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis
  - https://projectdiscovery.io/blog/crushftp-authentication-bypass
Sigma Detection Rule: Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Huntress Labs, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-10-31
ATT&CK techniques: T1190, T1203
Log source: windows/process_creation

Description:
Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe.
This behavior is a key indicator of exploitation for the critical remote code execution vulnerability such as CVE-2025-59287, where attackers spawn shells to conduct reconnaissance and further post-exploitation activities.


Detection logic:
{
  "selection_parent_wsusservice": {
    "ParentImage|endswith": "\\wsusservice.exe"
  },
  "selection_parent_w3wp_wsuspool": {
    "ParentImage|endswith": "\\w3wp.exe",
    "ParentCommandLine|contains": "WsusPool"
  },
  "selection_child": {
    "Image|endswith": [
      "\\cmd.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\powershell_ise.exe"
    ]
  },
  "condition": "1 of selection_parent_* and selection_child"
}

References:
  - https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/
  - https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability
  - https://hawktrace.com/blog/CVE-2025-59287-UNAUTH
Sigma Detection Rule: Exploitation Activity of CVE-2025-59287 - WSUS Deserialization
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-10-31
ATT&CK techniques: T1190, T1203
Log source: windows/

Description:
Detects cast exceptions in Windows Server Update Services (WSUS) application logs that highly indicate exploitation attempts of CVE-2025-59287, a deserialization vulnerability in WSUS.


Detection logic:
{
  "selection": {
    "Provider_Name": "Windows Server Update Services",
    "EventID": 7053,
    "Data|contains|all": [
      "System.InvalidCastException",
      "System.Windows.Data.ObjectDataProvider",
      "Unable to cast object of type",
      "System.Windows.Media.Brush"
    ]
  },
  "condition": "selection"
}

References:
  - https://unit42.paloaltonetworks.com/cve-2025-59287/
  - https://hawktrace.com/blog/CVE-2025-59287-UNAUTH
  - https://github.com/0xBruno/WSUSploit.NET/tree/e239bce9d6b5f46a346e1e4c4d5e0a2a20d5c639
  - https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability
Sigma Detection Rule: Commvault QLogin Argument Injection Authentication Bypass (CVE-2025-57791)
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-10-20
ATT&CK techniques: T1190
Log source: windows/process_creation

Description:
Detects the use of argument injection in the Commvault qlogin command - potential exploitation for CVE-2025-57791.
An attacker can inject the `-localadmin` parameter via the password field to bypass authentication and gain a privileged token.


Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "qlogin",
      " -cs ",
      " -localadmin",
      " -clp ",
      "_localadmin__"
    ]
  },
  "condition": "selection"
}

References:
  - https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
Sigma Detection Rule: Cisco ASA Exploitation Activity - Proxy
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-20
ATT&CK techniques: T1190
Log source: /proxy

Description:
Detects suspicious requests to Cisco ASA WebVpn via proxy logs associated with CVE-2025-20333 and CVE-2025-20362 exploitation.


Detection logic:
{
  "selection": {
    "cs-method": "GET",
    "cs-uri-stem": [
      "/+CSCOU+/MacTunnelStart.jar",
      "/+CSCOL+/csvrloader64.cab",
      "/+CSCOL+/csvrloader.jar"
    ]
  },
  "condition": "selection"
}

References:
  - https://x.com/defusedcyber/status/[PII_REDACTED]66598683