Sigma detection rules, expert-reviewed

Malicious Fileless Execution via memfd Anonymous File on Linux Cloud Workload (via process_creation)

This rule detects a process whose executable path resolves to an in-memory memfd anonymous file, the fileless technique the PyLoose cryptomining attack used to run its XMRig payload from a Jupyter Notebook without touching disk. Attackers rely on memfd_create to evade file-based detection, so a process backed by a memfd descriptor on a cloud workload is highly suspicious.

Possible Bitbucket Pre-Auth RCE via git archive Spawning Shell (CVE-2022-36804) (via process_creation)

This rule detects the git process spawning a shell interpreter as a child on a Bitbucket server host. This maps to CVE-2022-36804 exploitation where git archive with an injected --exec argument executes /bin/bash. Such a parent-child relationship indicates unauthenticated command execution rather than normal repository operations.

Suspicious ShadowGuard Rootkit Hidden Artifacts via swsecret Files (via file_event)

This rule detects creation of the swsecret_config.txt and swsecret_data artifacts used by the ShadowGuard rootkit to store hidden configuration and data in the Shadow espionage campaigns. These named files back the rootkit hiding logic, so their appearance on disk indicates rootkit deployment.

Malicious setcap Assigning cap_sys_admin for GameOverlay Privilege Escalation (via process_creation)

This rule detects setcap granting effective inheritable and permitted file capabilities such as cap_sys_admin to an executable, the step the GameOverlay Ubuntu OverlayFS exploit CVE-2023-2640 and CVE-2023-32629 uses to smuggle privileged capabilities across a copy-up. Assigning powerful capabilities to non-root executables is a strong local privilege escalation indicator.

Suspicious Root Filesystem Remount as Writable on Appliance via Mount (via process_creation)

This rule detects the mount command remounting the root filesystem as read-write on Linux-based appliances. Actors exploiting Ivanti Connect Secure zero-days remounted the normally read-only appliance filesystem to tamper with installers and plant webshells. Making a hardened appliance root writable is an abnormal precursor to persistence and integrity tampering.

Suspicious Sudoers NOPASSWD Rule Written For Passwordless Privilege Escalation

This rule detects writes to the sudoers configuration that grant passwordless all-command access which adversaries use to establish persistent privilege escalation on Linux hosts. Granting NOPASSWD ALL to a controlled account lets an attacker reliably regain root without supplying credentials.

Suspicious Ivanti Dropper Hidden Files in /tmp During CVE-2025-22457 Exploitation (via file_event)

This rule detects creation of the hidden single-letter dropper files in /tmp used during CVE-2025-22457 exploitation to stage the TRAILBLAZE and BRUSHFIRE injection chain. These short hidden paths on the Ivanti appliance indicate active exploitation and payload staging.

Malicious Langflow Exploitation Marker File Creation

This rule detects creation of the lang_pwn marker file that the Langflow CVE-2026-55255 exploitation chain drops to confirm successful code execution. The file acts as a proof-of-exploitation beacon left in the temp directory. Its presence is a high-confidence indicator that the host was compromised through the Langflow vulnerability.

Suspicious Network Connection From CUPS Foomatic-Rip Child Process

This rule detects an outbound network connection initiated by a child of the foomatic-rip print filter which indicates post-exploitation activity following abuse of the CUPS printing vulnerability. Adversaries who gain execution through the print filter reach out to command and control or download additional tooling from the compromised host.

Malicious TeamPCP LiteLLM .pth Startup Hook and Payload Dropper (via file_event)

This rule detects the litellm_init.pth site-packages file and the p.py payload dropped by the trojanized LiteLLM PyPI releases 1.82.7 and 1.82.8 published by TeamPCP. The .pth mechanism forces arbitrary code execution during any Python interpreter startup so writing these files establishes a supply-chain backdoor that steals API keys SSH keys and cloud credentials.

Suspicious Web Service Spawning Bash Reverse Shell on Ivanti via Exploitation

This rule detects the Ivanti Connect Secure uwsgi web process spawning a Bash shell that reads a staged payload from a temporary path. This chain was uncovered through memory forensics of exploited Ivanti Connect Secure appliances. Web service processes launching interactive shells indicate successful remote code execution.

Suspicious Privileged Docker Container Launch With Host chroot

This rule detects a docker run command started with the privileged flag combined with a chroot into the host filesystem. Attackers abusing exposed Docker API port 2375 deploy Alpine containers with docker run --privileged and chroot to break out onto the host and execute malware. Privileged container launches that immediately chroot to the host are a strong container-escape indicator.

Linux Process Execution from /dev/shm Shared Memory Directory

Alerts on Linux processes executing binaries from /dev/shm, a common in-memory staging location.

Malicious Cryptominer Staging Files Dropped in tmp Directory

This rule detects references to hidden cryptominer staging files written under /tmp such as .solr, kdevtmpfsi, zzz and .ICEd-unix. These paths were used across the Summer 2023 cryptojacking campaigns tracked by Wiz Research to drop XMRig and CCminer payloads, and their presence indicates resource-hijacking activity on a compromised host.

Suspicious XMRig Cryptominer Execution on Linux

This rule detects execution of the XMRig Monero cryptominer identified by its characteristic mining pool and donate-level arguments which was deployed both UPX-packed and standard as post-exploitation payload following React2Shell CVE-2025-55182 compromises. Cryptominer execution on a workload host indicates resource hijacking for financial gain after successful exploitation.