Open-source Sigma detection rules and YARA signatures mapped to high-profile CVEs for SOC and SIEM deployment.
Detect Interactive Shell Spawned by Web Servers (Generic RCE)
Sigma
title: Web Server Spawning Interactive Shell
status: test
description: Detects Apache, Nginx, or IIS web processes initiating interactive command shells.
tags:
- attack.execution
- attack.t1059.003
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- '\w3wp.exe'
- '\httpd.exe'
- '\nginx.exe'
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
condition: selection
level: high
YARA: Generic Webshell One-Liner Detection
YARA
rule Generic_PHP_Webshell_Detection {
meta:
description = "Detects obfuscated PHP system execution directives commonly dropped via RCE"
author = "Security Operations Research"
date = "2026-09-01"
severity = "High"
strings:
$eval = "eval(" ascii nocase
$base64 = "base64_decode(" ascii nocase
$exec1 = "passthru(" ascii nocase
$exec2 = "shell_exec(" ascii nocase
$post = "$_POST[" ascii
condition:
filesize < 20KB and
($eval and $base64 and $post) or
($exec1 and $post) or
($exec2 and $post)
}
SIEM Rule Engineering with Sigma
Sigma abstracts detection logic from specific log analytic backends. Defenders formulate detection logic once and translate it into queries for Splunk, Elastic, Sentinel, or Sumo Logic.
YARA Deployments for Digital Forensics
YARA rules identify malware families, persistence implants, and webshell footprints by classifying raw textual patterns within target binary files and webroot structures.