Sigma detection rules, expert-reviewed

Suspicious PlushDaemon EdgeStepper Configuration File Creation

This rule detects creation of the EdgeStepper configuration file bioset.conf under etc, the encrypted settings store dropped by PlushDaemon on compromised routers. The filename masquerades as a legitimate system component while holding the AES-CBC keyed C2 configuration, so its appearance indicates implant deployment.

Suspicious Renamed GRUB Bootloader grubx64-real Creation via File System

This rule detects creation of grubx64-real.efi under the EFI system partition, the artifact Bootkitty produces by displacing the genuine GRUB bootloader so its malicious bootloader can chainload the real one after patching the kernel. A grubx64-real.efi file indicates that the boot chain has been hijacked by a UEFI bootkit.

Suspicious FireWood Autostart Desktop Entry gnome-control Creation via File System

This rule detects creation of an autostart desktop entry named gnome-control.desktop, the persistence mechanism of the FireWood backdoor associated with the WolfsBane intrusion set. The name imitates the GNOME Control Center to appear legitimate while relaunching the implant at login. This indicates XDG autostart persistence on a compromised Linux desktop.

Suspicious Masquerading systemd Unit display-managerd Creation via File System

This rule detects creation of a systemd unit file named display-managerd.service, a masquerading name WolfsBane uses to persist by imitating the legitimate display-manager service. The trailing d makes it resemble a normal daemon unit while providing boot persistence for the backdoor. This indicates systemd service persistence by the Gelsemium Linux implant.

Malicious XMRig GhostRider Coinminer Execution with Mining Pool Arguments

This rule detects execution of an XMRig based miner using the ghostrider algorithm and a zpool mining endpoint, the resource hijacking payload deployed on the compromised Tomcat server. Mining command line flags for algorithm and pool are a reliable indicator of unauthorized cryptomining consuming host resources.

Suspicious Remote Script Download Piped to Shell via Wget or Curl on Linux

This rule detects wget or curl output piped directly into a shell interpreter on Linux, the initial execution used to deliver a coinminer after exploiting a vulnerable Tomcat server. Piping a downloaded script straight into sh runs attacker code in memory without ever writing an inspectable file to disk.

Suspicious AI Agent Compromise via Web Worker Spawning Shell or Network Tool

This rule detects an application worker such as gunicorn, uvicorn, celery or a python or node runtime spawning curl, wget or a shell which mirrors the AI agent abuse seen in the Hugging Face breach. Attackers who reach an exposed AI service pivot to shell and network utilities to pull tooling and exfiltrate data. Web worker parents launching these processes warrant investigation for server-side compromise.

Malicious wp2shell WordPress RCE via Web Server Spawning Shell Recon

This rule detects a web server process spawning a shell that runs identity and host reconnaissance which is the post-exploitation step of the wp2shell pre-auth WordPress RCE. After dropping a malicious plugin the attacker executes id, whoami and hostname to orient on the compromised server. A web daemon parenting these recon commands strongly indicates code execution through the vulnerability.

Suspicious GitHub CLI Token Extraction With Secret Scanner in CI Pipeline

This rule detects use of the GitHub CLI to print an authentication token alongside execution of a secret scanning tool inside a runner as described in Elastic CI CD pipeline abuse research. Pairing gh auth token with TruffleHog indicates an actor mining the pipeline for reusable credentials and repository secrets.

Suspicious Remote Script Piped Directly to Interpreter in CI Pipeline

This rule detects curl fetching a remote payload and piping it straight into bash or node as observed in CI CD pipeline abuse research by Elastic. Executing untrusted remote code without staging is a common supply chain and pipeline compromise technique that bypasses review controls.

Suspicious Environment Variable Dump Piped to Base64 for CI Credential Exfil

This rule detects a process reading the full environment and piping it through base64 encoding to stage secrets for exfiltration as seen in CI CD pipeline abuse research by Elastic. Dumping env with null separators and double base64 encoding is a hallmark of automated credential harvesting inside build runners.

Suspicious Shell History and Log Clearing on Linux

This rule detects commands that clear shell history or truncate and shred system logs as used by Linux rootkit operators to remove traces of activity in Elastic detection research. Clearing history and wiping auth or utmp logs after intrusion is a common anti forensic action indicating hands on keyboard cleanup.

Suspicious Kernel Module Load From World Writable Directory on Linux

This rule detects insmod or modprobe loading a kernel object from tmp or shared memory paths as used to install Linux rootkits described in Elastic rootkit detection engineering research. Loading a ko file from a world writable staging directory rather than the module tree is a strong indicator of kernel level implant deployment.

Malicious Node Runtime Spawning Shell to Download Python Payload via Axios Compromise

This rule detects a Node or Bun runtime spawning a shell that uses curl to fetch a Python loader into tmp and launches it with nohup as observed in the Axios npm supply chain compromise. A JavaScript package executing curl and python3 in sequence indicates malicious postinstall behavior staging a backdoor on the developer host.

Suspicious Systemd Service Unit Written to System Directory (via process_creation)

This rule detects writing a systemd service unit into the system service directory from a shell, a Linux persistence technique. Observed in the Elastic Security Labs TeamPCP scenario where a service file is dropped into /etc/systemd/system to survive reboots and relaunch the miner or tunneling tooling.