proxy log source Sigma rules

Detects Baby Shark C2 Framework default communication patterns

Detects exploitation attempt of the OWASSRF variant targeting exchange servers using publicly available POC. It uses the OWA endpoint to access the powershell backend endpoint

Detects a unique pattern seen being used by RomCom potentially exploiting CVE-2023-36884

Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity

Detects potential C2 communication related to Small Sieve malware

Detects Ursnif C2 traffic.

Detects suspicious user agent strings used in APT malware in proxy logs

Detects suspicious user agent string of APT40 Dropbox tool

Detects Bitsadmin connections to IP addresses instead of FQDN names

Detects Bitsadmin connections to domains with uncommon TLDs

Detects HTTP request used by Chafer malware to receive data from its C2.

Detects suspicious requests to Cisco ASA WebVpn via proxy logs associated with CVE-2025-20333 and CVE-2025-20362 exploitation.

Detects Turla ComRAT network communication.

Detects suspicious user agent strings used by crypto miners in proxy logs

Detects exploitation activity of CVE-2023-46747 an unauthenticated remote code execution vulnerability in F5 BIG-IP.

Detects exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via proxy logs by looking for a very long host header string.

Detects potential C2 communication related to Devil Bait malware

Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs

Detects a flashplayer update from an unofficial location

Detects potential C2 communication related to Goofy Guineapig backdoor

Detects suspicious user agent strings user by hack tools in proxy logs

Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).

Detects user agent and URI paths used by empire agents

Detects suspicious user agent strings used by malware in proxy logs

Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

Detects potential malicious .ICO files download from a compromised 3CXDesktopApp via web requests to the the malicious Github repository

Detects a unique URL marker seen being used by RomCom potentially exploiting CVE-2023-36884

Detects a specific URL pattern containing a specific extension and parameters pointing to an IP address. This pattern was seen being used by RomCOM potentially exploiting CVE-2023-36884

Detects exploitation attempts of CVE-2023-43261 and information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 that allows attackers to access sensitive router components in proxy logs.

Detects potential beaconing activity to domains used in 0day attacks on iOS devices and revealed by Kaspersky and the FSB

Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint

Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form

Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.

Detects suspicious malformed user agent strings in proxy logs

Detects download of Ursnif malware done by dropper documents.

Detects WebDav DownloadCradle

Detects requests to URI ending with the ".class" extension in proxy logs. This could rules can be used to hunt for potential downloads of Java classes as seen for example in Log4shell exploitation attacks against Log4j.

Detects potential exploitation attempt of CVE-2023-1389 an Unauthenticated Command Injection in TP-Link Archer AX21.

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Detects potential exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via proxy logs.

Detects download of certain file types from hosts with dynamic DNS names (selected list)

Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP

Detects a potentially suspicious empty user agent strings in proxy log. Could potentially indicate an uncommon request method.

Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.

Detects files seen being requested by RomCom while potentially exploiting CVE-2023-36884

Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string.

Detects potential C2 communication activity related to Peach Sandstorm APT

Detect the update check performed by Advanced IP/Port Scanner utilities.

Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string

Detects suspicious encoded User-Agent strings, as seen used by some malware.

Detects suspicious requests to Telegram API without the usual Telegram User-Agent

Detects Windows PowerShell Web Access

Detects download of certain file types from hosts in suspicious TLDs

Detects executable downloads from suspicious remote systems

Detects outbound web proxy requests to URLs matching the EvilTokens Phishing-as-a-Service (PhaaS) kit infrastructure. Specifically Cloudflare Workers and Railway.app domains used in OAuth device code authorization phishing attacks. This indicates a user has clicked a phishing link.

Detects connections to interplanetary file system (IPFS) containing a user's email address which mirrors behaviours observed in recent phishing campaigns leveraging IPFS to host credential harvesting webpages.