Sigma detection rules, expert-reviewed

Malicious SD-WAN Compromise Credential Theft via loot_run.sh

This rule detects execution of the loot_run.sh script used in the Cisco Catalyst SD-WAN exploitation to harvest credentials from compromised appliances. The named script automates collection of secrets for follow-on access and lateral movement across the network. Any invocation of this campaign-specific script indicates active credential theft.

Suspicious UAT-10608 Hidden Credential Harvesting Script Execution via nohup

This rule detects a hidden dot-prefixed shell script under /tmp being launched via nohup, matching the UAT-10608 automated credential harvesting operation against web applications. The operators detach a shell script staged as /tmp/.<random> so it survives session termination while iterating credential-theft phases. Backgrounded execution of hidden temporary scripts indicates hands-on-keyboard compromise and warrants immediate triage.

Suspicious Container Environment Reconnaissance in Serverless Build

This rule detects container-awareness reconnaissance that reads /proc/self/cgroup, the /.dockerenv marker file or /etc/passwd from inside a serverless build environment. In this Cloud Functions abuse chain a malicious package.json runs during the build and fingerprints the container before pivoting with the attached Cloud Build service account, so this recon precedes privilege escalation and Ngrok-based exfiltration.

Suspicious SSH Service on Non Standard Port 57722

This rule detects network connections on TCP port 57722 which Salt Typhoon operators used to run a custom SSH daemon for covert remote access to compromised network infrastructure. SSH activity on this uncommon high port is anomalous and can indicate a backdoored SSH service or persistent operator access.

Possible Akira Ransomware VM Shutdown via vim-cmd

This rule detects use of vim-cmd to power off virtual machines on an ESXi host, a step the Akira Rust ransomware performs before encrypting VM files. The encryptor enumerates guests with getallvms and forces them off to release locked disks. Detecting it can stop the attack before mass encryption begins.

Possible Ransomware Pre-Encryption VM Termination via esxcli

This rule detects use of esxcli to force kill running virtual machines, a step ransomware performs on ESXi hosts to unlock VM disk files before encryption. Multiple studied families run vm process kill with type force to stop guests prior to mass encryption. Detecting it can interrupt the attack before data is locked.

Possible Akira Ransomware Note or Encrypted Extension Creation

This rule detects creation of files with the akiranew extension or the akiranew.txt ransom note produced by the Akira Rust ransomware variant. Both artifacts appear only after files have been encrypted on the host. Detecting them confirms an active Akira encryption event for rapid isolation.

Malicious Koske Persistence via Systemd Service and Shell Profile Hijack (via process_creation)

This rule detects Koske establishing persistence by registering the shellkoske systemd service and by deploying a hijacked shell profile named .bashrc.koske that beacons to command and control. These named artifacts are unique to the Koske campaign and do not appear in legitimate software.

Suspicious Automated SSH Lateral Movement with Batch Mode (via process_creation)

This rule detects non interactive SSH connection attempts that disable host key checking and use batch mode with a short connect timeout, the pattern the Tomcat campaign uses to spread across hosts with harvested keys. Configuration management tooling can produce similar commands so validate the source process.

Malicious Multi Layer Base64 Decoded Payload Execution via Bash (via process_creation)

This rule detects the Apache Tomcat cryptomining campaign fetching a payload and piping it through several chained base64 decode passes before executing it with bash. Repeated base64 decode stages in a single command line indicate deliberate obfuscation and are not typical of legitimate administration.

Malicious Sobolan Payload Download from Jupyter Compromise (via process_creation)

This rule detects retrieval of the Sobolan archive from the hidden .sobo path on the attacker download server using wget or curl after an unauthenticated JupyterLab instance is compromised. The .sobo/temp.tar path is specific to this campaign.

Malicious TeamTNT Docker Gatling Gun Initialization Script (via process_creation)

This rule detects execution of the TeamTNT Docker Gatling Gun initialization scripts TDGGinit.sh and TDGG.sh that are deployed inside compromised containers to harvest cloud credentials, add hosts to an attacker Docker Swarm and deploy cryptominers. These script names are specific to the campaign.

Malicious Hadooken Cryptominer Execution via Masqueraded Binaries (via process_creation)

This rule detects execution of the Hadooken cryptominer components crondr and bprofr that are dropped into system binary paths and later renamed to blend in with legitimate processes on compromised Weblogic servers. These binary names are unique to the Hadooken campaign.

Suspicious Shell Spawned by PostgreSQL Server Process (via process_creation)

This rule detects a shell interpreter spawned as a child of the postgres server process, the behavior used by the PG_MEM malware to run operating system commands through the COPY FROM PROGRAM SQL feature after brute forcing database credentials. Legitimate archive commands and extensions can also spawn shells so context is required.

Suspicious Payload Download from Filebin via wget (via process_creation)

This rule detects use of wget or curl to fetch an archive from the filebin.net file sharing service, the delivery method used by the Panamorfi campaign to stage its DDoS toolkit onto compromised Jupyter servers. Filebin has legitimate uses so review the fetched content and host role.