Sigma detection rules, expert-reviewed

Malicious Velvet Ant Linux Backdoor and Credential Harvesting Artifacts (via file_event)

This rule detects creation of file artifacts tied to the Velvet Ant Operation Highland intrusion, including a renamed GS-Netcat backdoor and hidden logs written by backdoored SSH and PAM components to store harvested credentials and keystrokes. These specific paths are not part of a standard Linux installation.

Malicious Fire Ant Hypervisor Backdoor Artifacts on ESXi and vCenter (via file_event)

This rule detects creation of file artifacts associated with Fire Ant persistence on ESXi and vCenter systems, including a Python HTTP backdoor and a listening implant along with extracted trust certificates. These specific paths correspond to backdoors deployed beneath the hypervisor to maintain covert access and are not part of a standard VMware installation.

Suspicious Bash Decode Chain Using curl xxd and base64 Piped to eval via Linux Shell

This rule detects a Linux shell one-liner that pipes curl output through xxd and base64 into eval to decode and execute an in-memory payload. This behavior is used by TransparentTribe to deploy the DeskRAT implant against Indian military targets. Chaining hex and base64 decoding into eval lets the attacker run downloaded code without touching disk which frustrates static detection.

Malicious Cryptocurrency Miner Execution via XMRig and c3pool (via process_creation)

This rule detects execution of the XMRig cryptocurrency miner or connections to the c3pool mining pool. The Mimo campaign deploys XMRig against compromised Craft CMS servers to mine Monero using victim resources. Miner binaries and pool references indicate resource hijacking for financial gain.

Malicious Download Piped to Shell via curl or wget (via process_creation)

This rule detects a remote script being downloaded with curl or wget and piped directly into a shell for execution. The Mimo campaign exploiting Craft CMS fetches its loader script and pipes it to bash to run the payload without touching disk. Downloading and immediately executing a remote script through a pipe is a classic Linux compromise pattern.

Suspicious File Download via busybox ftpget (via process_creation)

This rule detects use of the busybox ftpget command to retrieve a remote archive on embedded and IoT devices. The PolarEdge ORB network uses busybox ftpget to fetch its payload archive after exploiting CVE-2023-20118. Downloading tooling over FTP with busybox on network appliances is characteristic of botnet staging.

Suspicious GobRAT Bulbature Infection Shell Scripts Execution

This rule detects execution of the distinctive bash infection and management scripts used by the Bulbature operation behind GobRAT, including zonesetup.sh, zoneController.sh, zoneupdate.sh, hold_by_bot.sh, sshdeny1.sh, zonedelete.sh and zoneRestart.sh. These uniquely named scripts orchestrate persistence, SSH access control and bot management on hijacked routers. Their filenames are specific enough to serve as reliable indicators.

Suspicious Process Masquerading as apached via GobRAT Bulbature Implant

This rule detects a running process named apached, the disguised name GobRAT uses to blend in with the legitimate Apache httpd daemon on compromised edge devices in the Bulbature operation. The extra character in the name is designed to survive casual process listing review. Because no standard Apache binary is named apached, this is a strong host indicator of GobRAT.

Suspicious lwp-download Retrieval of Remote File Masquerading as Image via 8220 Gang

This rule detects the Perl based lwp-download utility fetching a remote resource and saving it with a .gif image extension, a technique the 8220 gang uses in the Hadooken and K4Spreader campaigns to disguise downloaded shell scripts and payloads. Legitimate administrators rarely invoke lwp-download to write image files from the web. This pattern signals staging of second stage tooling on compromised Linux hosts.

Suspicious Proxyware Installation via accept-tos Flag on Linux

This rule detects a Linux binary being executed with the -accept-tos flag used by residential proxyware agents to silently accept terms and enroll the host. Attackers monetise compromised hosts by installing proxyware, and this non-interactive acceptance flag is characteristic of that abuse.

Suspicious Firewall Flush via iptables in Kinsing Intrusion

This rule detects iptables being run with the flush flag to clear all firewall rules. Kinsing flushes iptables to remove competing miner blocks and to keep its own C2 and mining traffic unimpeded, an impair-defenses action that can also occur during legitimate administration.

Malicious ActiveMQ CVE-2023-46604 Payload Download via curl or wget

This rule detects curl or wget fetching the Kinsing exploitation Spring context files poc.xml or linux-poc.xml. During ActiveMQ CVE-2023-46604 exploitation the broker is coerced into loading a remote XML that pulls the next stage, so these filenames in a download command indicate active exploitation.

Suspicious Autostart Desktop Entry Persistence via Linux File Creation

This rule detects creation of a system-backup.desktop autostart entry under the user config autostart directory on Linux. TransparentTribe uses this masqueraded desktop file together with a systemd unit and a per-minute crontab to persist the DeskRAT implant. A backup themed autostart entry is a low effort way to regain execution at every login which is why it warrants review.

Malicious PolarEdge QNAP Backdoor Dropper Script in Temp (via file_event)

This rule detects creation of the hidden dropper script used by the PolarEdge QNAP backdoor in the temp directory. After exploiting CVE-2023-20118 the implant writes a hidden qnax shell script to stage its components. A hidden script with this name in tmp is a specific artifact of the PolarEdge implant.

Suspicious Login Shell Assigned to Service Account games on Linux

This rule detects a command that assigns an interactive login shell to the built in games service account which DripDropper abuses to convert an unused system account into a usable backdoor. Service accounts normally have a nologin shell so granting one a real shell is a strong sign of account manipulation. Detecting this change surfaces persistence via a valid but repurposed account.