Sigma

Stories with published Sigma detection rules, reproduced exactly as written, ready to convert for your SIEM.

2 stories match your filters.

HighCVE-2023-30799CVE-2023-32315 6 Hunt LeadsSigma IOCs Remote Attacker Doorway CloudSEK

Doorway Botnet Walks Into MikroTik Routers With Blank Passwords

CloudSEK says the Doorway botnet compromised 11,363 routers, cameras and servers in a month, mostly via blank or default passwords on MikroTik routers plus old RouterOS and Openfire bugs.

Oct 30, 2026

CriticalCVE-2026-109618CVE-2026-109619 5 Hunt LeadsYARA Sigma IOCs Remote Attacker Lazarus Group CYFIRMA

A Korean-Speaking Crew Is Building a PHP2Shell Hit List

CYFIRMA says Korean-speaking operators are quietly scanning 216 unpatched PHP hosts at governments, banks and logistics firms, with a moderate-confidence Lazarus link.

Oct 27, 2026