Sigma detection rules, expert-reviewed

Masquerading Execution of Binary from Var Log Directory (via process_creation)

This rule detects execution of an executable located under the var log directory on Linux, the persistence staging behavior of the Kimsuky Gomir variant which copies its binary to var log rsyslogd and runs it through a systemd service. Adversaries leverage a log directory that normally holds only text logs to hide an executable while masquerading as the rsyslog daemon, making early detection critical for surfacing the implant before it beacons.

Malicious Cryptominer Masquerading as Kubernetes pause Container

This rule detects execution of a binary named pause from the /var/tmp directory. Wiz Research observed the DERO cryptojacking campaign disguising its miner as the legitimate Kubernetes pause container while writing it to /var/tmp, so this wrong path plus trusted name combination indicates masquerading and resource hijacking.

Malicious Akira Ransomware Encryptor Command Line Flags

This rule detects execution of a binary using the stopvm and vmonly flags characteristic of the Akira Rust ransomware encryptor targeting ESXi. These flags instruct the tool to shut down and encrypt only virtual machines. Detecting the flag combination exposes the ransomware payload at runtime.

Suspicious Cloud Security Agent Uninstallation via Shell (via process_creation)

This rule detects command lines that stop or uninstall cloud provider security agents such as Alibaba Aegis, Tencent YunJing, or BCM monitoring, a defense evasion step in malicious Linux shell scripts. Disabling these agents blinds cloud workload protection before the attacker deploys further payloads.

Suspicious Cron Persistence File Creation in System Cron Directories (via file_event)

This rule detects creation or modification of files under Linux system cron directories that adversaries use for scheduled task persistence. In the Group-IB XMRig covert Linux PAM abuse campaign the miner establishes persistence through cron entries. Because cron persistence survives reboots and blends with legitimate scheduling, monitoring these paths helps surface unauthorized recurring execution.

Malicious node Reverse Shell Spawned on FortiGate via Inline Code

This rule detects the node binary being executed with the -e flag to run inline JavaScript, matching the reverse shell payload delivered through the FortiGate CVE-2024-21762 exploitation described by Assetnote. Attackers use node -e to establish an outbound interactive shell from the appliance after triggering the memory corruption. Inline node execution on a network security appliance is highly abnormal and indicates post-exploitation activity.

Malicious VoidLink Pinned eBPF Map in BPF Filesystem (via file_event)

This rule detects creation of the VoidLink pinned eBPF map used to hide network connections from userspace tooling. Observed in Elastic Security Labs analysis where a pinned map at the bpf filesystem path vl_hide_tcp supports the rootkit's stealth and ICMP-based command and control.

Malicious Disabling of Linux Security Modules AppArmor and SELinux

This rule detects commands that disable the SELinux and AppArmor kernel security modules on Linux hosts. The RondoDox payload deployed after CVE-2025-55182 exploitation disables these protections to run unhindered as reported by Kaspersky. Tampering with mandatory access controls is a strong defense evasion indicator that precedes further malicious activity.

Malicious Iptables Drop of Syslog Forwarding Ports on Ivanti Connect Secure (via process_creation)

This rule detects iptables commands adding DROP rules for the syslog forwarding ports 514 and 6514 on Ivanti Connect Secure, an anti-forensics step observed during zero-day exploitation to sever remote log delivery. Blocking log egress on an appliance indicates active defense evasion by an intruder.

Malicious ShadowGuard eBPF Rootkit Control via Magic Kill Signal (via process_creation)

This rule detects the kill command issued with the out-of-range signals 900 and 901, the covert control channel used to command the ShadowGuard eBPF rootkit in the Shadow espionage campaigns. Real signals never exceed 64, so these magic values are interpreted only by the rootkit to toggle its process allow-list and hiding behavior.

Possible Linux Hardware Reconnaissance via Dmidecode Baseboard Query

This rule detects execution of dmidecode requesting baseboard information, a host-fingerprinting step used by the Prometei botnet alongside reads of /proc/cpuinfo. Malware profiles infected systems this way before cryptomining. While inventory tools may use dmidecode, its use by unexpected parents warrants review.

Suspicious Disabling of Linux Audit or System Logging (via process_creation)

This rule detects commands that stop or clear auditd or rsyslog, a defense-impairment technique used to blind host logging before further attacker activity on Linux. Disabling audit and system logging is tracked in the Red Canary Threat Detection Report. Detecting these commands surfaces telemetry being cut.

Malicious VoidLink Kernel Module Load via Insmod (via process_creation)

This rule detects loading of the VoidLink rootkit kernel modules via insmod or modprobe under masquerading and rootkit names. Observed in Elastic Security Labs analysis where vl_stealth.ko or a fake amd_mem_encrypt.ko module installs ftrace syscall hooks and eBPF-based hiding to conceal the framework.

Malicious ESXi Virtual Machine Termination and Snapshot Removal via esxcli and vim-cmd (via process_creation)

This rule detects the ESXi shell loops used by Lynx ransomware to force-kill running virtual machines with esxcli vm process kill and to remove all snapshots with vim-cmd snapshot.removeall as described by Group-IB. Adversaries stop VMs and delete snapshots to enable datastore encryption and inhibit recovery on hypervisors, making this a strong pre-encryption signal.

Malicious EdgeStepper iptables DNS Redirection for Adversary-in-the-Middle

This rule detects iptables NAT PREROUTING rules that redirect outbound DNS traffic on destination port 53, a technique used by the PlushDaemon EdgeStepper implant on compromised network devices. Hijacking DNS at the gateway lets the actor perform adversary-in-the-middle interception and reroute update lookups to attacker infrastructure.