Inferlume

title: WHIPSHOT Web Shell HTTP Header Command Execution
id: 9f2c1a77-6f70-4a11-9a6b-1d5f5f7c9d31
status: experimental
description: Detects HTTP requests containing long Base64 encoded payload strings within custom headers, characteristic of WHIPSHOT web shell communication on Citrix NetScaler appliances.
logsource:
  category: webserver
  product: citrix_netscaler
detection:
  selection_header:
    http_header_name|contains:
      - 'X-'
      - 'X-Forwarded'
      - 'X-Custom'
      - 'X-Auth'
  selection_payload:
    http_header_value|re: '^[A-Za-z0-9+/]{80,}={0,2}$'
  condition: selection_header and selection_payload
fields:
  - client_ip
  - http_method
  - http_uri
  - http_header_name
  - http_header_value
falsepositives:
  - Legitimate enterprise API gateways transmitting Base64 encoded security tokens
level: high

title: Cisco Catalyst SD WAN Controller Authentication Bypass (CVE-2026-20127)
id: 5a8e2b14-3c91-4e7a-8f22-1b6d9a4c5e33
status: experimental
description: Detects unauthorized API access attempts and rogue peer registration requests targeting Cisco Catalyst SD WAN Controllers.
logsource:
  category: network
  product: cisco
  service: sdwan
detection:
  selection_api:
    destination_port: 8443
    http_uri|contains:
      - '/sdwan/api'
      - '/dataservice'
    http_method: POST
    http_status: 200
  selection_source:
    source_ip_type: external
  condition: selection_api and selection_source
fields:
  - source_ip
  - destination_ip
  - http_uri
  - http_user_agent
  - sdwan_peer_id
falsepositives:
  - Authorized SD WAN branch router onboarding from newly deployed external circuits
level: critical

title: Ivanti Connect Secure Unauthenticated Access and Staged File Write
id: 7f2c1b34-11a2-4f7e-9d31-5b7f6b1f9c11
status: experimental
description: Detects unauthenticated HTTP requests targeting sensitive administrative paths followed by file creation in web accessible directories on Ivanti Connect Secure gateways.
logsource:
  category: webserver
  product: ivanti_connect_secure
detection:
  selection_auth_bypass:
    cs_uri_stem|contains:
      - '/dana-na/auth/url_default/'
      - '/api/v1/'
      - '/dana/html5acc/'
    authentication_state: unauthenticated
    http_status:
      - 200
      - 302
  selection_file_write:
    file_path|contains:
      - '/dana/html5acc/gui/'
      - '/runtime/'
      - '/tmp/'
  condition: selection_auth_bypass or selection_file_write
fields:
  - source_ip
  - cs_uri_stem
  - http_method
  - file_path
  - user_agent
falsepositives:
  - Firmware update routines executed through approved maintenance consoles
level: critical

title: Synology DSM Mass File Encryption and Ransom Note Generation
id: 9d4a1f22-77bb-4d2e-9f10-3b6d8a5c22e4
status: experimental
description: Detects high volume file modification operations appending encrypted extensions and generating ransom instruction text files across Synology storage volumes.
logsource:
  category: file_event
  product: synology_dsm
detection:
  selection_extension:
    file_path|contains:
      - '/volume1/'
      - '/volume2/'
    file_name|endswith:
      - '.c3rb3r'
      - '.encrypted'
      - '.locked'
  selection_note:
    file_name|contains:
      - 'README'
      - 'RECOVER'
      - 'RESTORE'
      - 'C3RB3R'
    file_name|endswith: '.txt'
  condition: selection_extension or selection_note
fields:
  - device_id
  - user_account
  - process_name
  - file_path
  - event_action
falsepositives:
  - Legitimate mass file migration or backup archival scripts
level: critical

rule NetScaler_WHIPSHOT_SLAPSHOT_Behavioral_Tooling
{
    meta:
        description = "Detects code patterns and string indicators associated with WHIPSHOT web shell and SLAPSHOT proxy utility"
        author = "CTI Research Team"
        reference = "Mandiant / GTIG NetScaler Intrusions 2026"
        confidence = "high"
    strings:
        $whipshot_str1 = "WHIPSHOT" nocase ascii wide
        $whipshot_header = "HTTP_X_" ascii
        $whipshot_b64 = "base64_decode" ascii
        $slapshot_str1 = "SLAPSHOT" nocase ascii wide
        $slapshot_lock = "/tmp/.uxdlock" ascii
        $slapshot_port = "/tmp/.uxdport" ascii
        $php_handler = "AddType application/x-httpd-php" ascii
    condition:
        uint16(0) == 0x5A4D or uint16(0) == 0x3F3C or uint16(0) == 0x2123
        and (
            2 of ($whipshot_*) or
            2 of ($slapshot_*) or
            ($php_handler and any of ($whipshot_header, $slapshot_port))
        )
}

rule MAL_KeyDrift_LittleFilch_Memory_Scraper
{
    meta:
        description = "Detects binary strings and memory scraping logic associated with KeyDrift LittleFilch implants"
        author = "CTI Research Team"
        reference = "Cisco Talos UAT-11473 Research October 2026"
        confidence = "high"
    strings:
        $s1 = "LittleFilch" ascii
        $s2 = "vdaemon" ascii
        $s3 = "AES-256" ascii wide
        $pattern = { 48 89 5C 24 08 48 89 6C 24 10 8B 45 00 89 45 04 8B 45 08 }
    condition:
        uint16(0) == 0x457F and (2 of ($s*) or $pattern)
}

-- SIEM Correlation: Network Gateway Credential Access followed by Active Directory Abuse
SELECT
  gateway.event_time AS gateway_compromise_time,
  gateway.source_ip AS attacker_ip,
  gateway.device_hostname AS gateway_host,
  directory.event_time AS directory_query_time,
  directory.account_name AS abused_service_account,
  directory.destination_ip AS domain_controller_ip,
  directory.event_action AS directory_action
FROM enterprise_gateway_logs gateway
JOIN active_directory_audit_logs directory
  ON directory.account_name = gateway.associated_account
 AND directory.event_time BETWEEN gateway.event_time AND gateway.event_time + INTERVAL '2 hours'
WHERE gateway.device_product IN ('Ivanti Connect Secure', 'Citrix NetScaler ADC', 'Cisco Catalyst SD WAN')
  AND gateway.event_action IN ('authentication_bypass', 'credential_dump', 'config_export')
  AND directory.event_action IN ('ldap_directory_query', 'kerberos_ticket_request', 'privileged_group_enumeration')
ORDER BY gateway.event_time DESC;

-- SIEM Detection: Exposed GitLab CE/EE vulnerable version access and CI configuration change
SELECT
  event_time,
  source_ip,
  destination_ip,
  http_uri,
  gitlab_version,
  user_username,
  ci_configuration_path,
  action_type
FROM gitlab_audit_events
WHERE gitlab_deployment_type = 'self_managed'
  AND is_internet_facing = TRUE
  AND (
       (version_major = 19 AND version_minor = 4 AND version_patch < 2)
    OR (version_major = 19 AND version_minor = 3 AND version_patch < 5)
    OR (version_major = 19 AND version_minor = 2 AND version_patch < 8)
  )
  AND (
       http_uri LIKE '%/.gitlab-ci.yml%'
    OR action_type IN ('runner_registered', 'ci_variable_created', 'pipeline_created')
  );