Sigma detection rules, expert-reviewed

Malicious Remote Script Piped to Shell via Curl (via process_creation)

This rule detects curl fetching a remote script and piping it directly into a shell interpreter, a common Linux and container compromise technique. Observed in the Elastic Security Labs TeamPCP container attack scenario where curl -fsSL of proxy.sh piped to bash bootstraps the intrusion and downloads further tooling.

Possible Log4Shell Exploitation via Java Spawning Shell or Download Utility

This rule detects a Java process spawning a shell or file-download utility, a post-exploitation pattern following Log4Shell (CVE-2021-44228) JNDI injection where the vulnerable Java application executes attacker commands to retrieve secondary payloads such as Mozi. Java processes launching wget, curl, or a shell warrant investigation for remote code execution.

Suspicious Process Execution from Hidden Outlaw Config Directory

This rule detects execution of binaries or scripts from a hidden .configrc directory in a user home path, the staging location used by the Outlaw Linux malware for its miner and SHELLBOT components. Execution from a hidden dotfile directory indicates malware masquerading its payloads within user configuration folders.

Suspicious File Immutability via chattr

This rule detects use of the chattr utility to set the immutable or append-only attribute on files, a technique used by the Outlaw Linux malware to protect its persistence components such as SSH authorized_keys and cron entries from removal. Attacker use of chattr locks defensive tooling out of remediating implanted files.

Malicious Cryptocurrency Miner Masquerading as kswapd0

This rule detects a userland process named kswapd0 executing from disk, a masquerade used by the Outlaw Linux malware to hide XMRig cryptocurrency mining under the name of a legitimate Linux kernel thread. Because kswapd0 is a kernel thread that never appears as an on-disk executable, such a process strongly indicates cryptojacking for resource hijacking.

Possible GTFOBins Shell Breakout via Unix Utilities

This rule detects common Unix utilities such as env, awk, busybox, and mysql spawning an interactive shell, a GTFOBins pattern used to break out of restricted environments or abuse sudo privileges. These utilities spawning /bin/sh or /bin/bash is atypical and indicates a shell-evasion attempt by an insider or intruder.

Suspicious GRUB Bootloader Script Modification for Bootkit Persistence

This rule detects shell modification of GRUB bootloader scripts under /etc/grub.d, a pre-OS persistence technique from the Elastic Linux persistence grand finale. Injecting commands into GRUB configuration lets an attacker gain execution before the operating system loads for stealthy and resilient persistence. Direct edits to these scripts outside of kernel or bootloader updates should be examined.

Suspicious D-Bus System Service Persistence File Creation

This rule detects writing of a D-Bus system service definition under the dbus-1 system-services directory, a persistence technique from the Elastic Linux persistence grand finale. A malicious service file causes D-Bus to launch attacker code on demand with elevated privileges. New service definitions created through shell tooling rather than package managers warrant review.

Suspicious NetworkManager Dispatcher Script Persistence

This rule detects creation of a script under the NetworkManager dispatcher directory, a persistence technique covered in the Elastic Linux persistence grand finale. Scripts placed in dispatcher.d run automatically on network state changes giving an attacker recurring code execution as root. Writes to this directory outside of package installation are worth investigating.

Malicious Container Escape via Privileged Docker Host PID Namespace

This rule detects a Docker container launched with both privileged mode and the host PID namespace, a container escape primitive documented in Elastic Linux persistence research. Combining these flags lets an attacker use nsenter to break out into the host namespaces and gain full node control. Legitimate workloads rarely require both flags together making this a strong escape indicator.

Suspicious SSH authorized_keys Modification for Persistence

This rule detects append or redirect operations against an SSH authorized_keys file, an account persistence technique highlighted in Elastic Linux persistence research where an attacker adds their own key to a system user home directory. Planting a controlled public key grants durable password-less remote access that survives credential changes. Writes to authorized_keys through shell redirection outside provisioning workflows should be reviewed.

Suspicious Dynamic Linker Hijacking via ld.so.preload Modification

This rule detects command line activity that writes to the /etc/ld.so.preload file, a dynamic linker hijacking mechanism detailed in Elastic Linux persistence research. By adding a malicious shared object to ld.so.preload the attacker forces it to load into every dynamically linked process for stealthy persistence and privilege abuse. Modifications to this global preload file are rarely legitimate and warrant investigation.

Suspicious Web Shell Spawned via Python or PHP Built-in Server

This rule detects launch of a lightweight web server through the Python http.server CGI mode or the PHP built-in development server, a persistence and remote-access technique covered in Elastic Linux persistence research. Attackers stand up these one-line servers to expose a web shell for command execution and file transfer on a compromised host. Such servers spawned outside a development context deserve scrutiny.

Suspicious Kernel Module Load Or Unload For Rootkit Deployment via PUMAKIT

This rule detects invocation of module management utilities that insert or remove Linux kernel modules which the PUMAKIT rootkit relies on to load its kernel component and manipulate the running kernel. Adversaries load a malicious LKM to gain kernel level control and conceal processes files and network activity.

Suspicious Fileless Execution From Memory File Descriptor via PUMAKIT

This rule detects a process executing from an in-memory file descriptor path such as memfd or dev fd which is the fileless execution technique used by the PUMAKIT rootkit loader to run payloads without touching disk. Adversaries use memfd_create and execveat to evade file based detection and forensic recovery on Linux hosts.