Sigma detection rules, expert-reviewed

Malicious Foomatic-Rip Filter Spawning Shell via CUPS Exploitation

This rule detects the foomatic-rip print filter spawning a command shell such as bash sh or dash which is the exploitation primitive in the CUPS printing system vulnerability chain. Adversaries abuse a crafted printer PPD FoomaticRIPCommandLine to achieve remote command execution on the print host.

Suspicious Downloaded Shell Stager Made Executable Via Chmod 777

This rule detects a shell retrieving a remote script with wget and immediately granting it world writable and executable permissions using chmod 777 which is the KAIJI stager delivery pattern in the Betting on Bots campaign. Adversaries download and mark payloads executable in one step to bootstrap further malware on the compromised Linux host.

Malicious XMRig Cryptominer Connecting To C3Pool Stratum Pool

This rule detects a process connecting to the c3pool mining pool over the stratum protocol which is the resource hijacking behavior of the XMRIG miner deployed in the Betting on Bots Linux intrusions. Adversaries run XMRIG against public pools to monetize compromised hosts through unauthorized cryptocurrency mining.

Suspicious Udev Rule Reload After Rules Directory Modification

This rule detects udevadm being invoked to reload or trigger device manager rules which follows an attacker writing a malicious rule into the udev rules directory to gain event driven persistence. Adversaries register a udev rule that runs a payload when a device event fires giving them privileged execution outside standard autostart locations.

Suspicious SUID Binary Discovery via Find Perm 4000

This rule detects the find command searching the filesystem for setuid binaries using the perm 4000 predicate which is a common privilege escalation discovery step on Linux hosts. Adversaries enumerate SUID executables to locate misconfigured binaries that can be abused to elevate to root.

Suspicious kworker Masquerade Process Initiating Network Connection on Linux

This rule detects a process masquerading as a kernel kworker thread that initiates an outbound network connection as observed with Linux rootkit implants in Elastic research. Genuine kworker kernel threads never open network sockets, so a userland process using this name to beacon indicates a hidden implant.

Suspicious Modification of etc passwd Following Linux Kernel Exploit

This rule detects writes to etc passwd by a non package management process as seen in post exploitation of the Copy Fail and DirtyFrag Linux page cache bugs in Elastic research. Corrupting or appending to passwd is used to inject a privileged account after a kernel primitive grants arbitrary write, indicating successful escalation.

Suspicious APT Or YUM Package Manager Hook Configuration Created

This rule detects creation of configuration files in the APT or YUM package manager hook directories which adversaries abuse to execute arbitrary commands whenever the package manager runs. Planting a hook under apt.conf.d or the yum plugin configuration grants stealthy privileged persistence tied to routine system maintenance.

Suspicious Systemd Service Unit Creation In System Directory

This rule detects creation or modification of a systemd service unit file under the system unit directories which is a common Linux persistence mechanism where an ExecStart directive is pointed at a reverse shell or malicious payload. Adversaries install rogue systemd units so their code runs automatically at boot with elevated privileges.

Suspicious Meterpreter Host Discovery File Reads on Linux via file_event

This rule detects a process reading the host machine identifier together with the kernel network routing table, a discovery pattern exhibited by Meterpreter payloads on Linux during post-exploitation. This combination is used to fingerprint the host and enumerate network configuration before further action. Access to both of these uncommon paths by the same process is a strong indicator of in-memory implant activity.

Malicious C2 Domain Beacon To Akamaitechnologies Masquerade via DPRK Python Intrusion

This rule detects DNS resolution of the akamaitechnologies.online domain which is a masquerade command and control host used by DPRK actors in their Python-based intrusions against secured networks. The domain mimics a legitimate content delivery provider to blend beaconing traffic and evade network monitoring.

Suspicious FRP Proxy Download via wget to Temporary Directory (via process_creation)

This rule detects wget fetching the FRP fast reverse proxy binary into a temporary directory after Ivanti EPMM exploitation for tunneling and SOCKS proxying. Attackers staged frpc under hidden /tmp paths to establish covert network access. Downloading frpc to /tmp is a strong lateral movement and C2 indicator.

Suspicious Ivanti EPMM Database Dump via mysqldump with .mifpp Credentials (via process_creation)

This rule detects mysqldump invoked with the hardcoded Ivanti EPMM .mifpp credentials file to dump the mifs database after exploitation. Attackers abused these embedded MySQL credentials to exfiltrate LDAP and configuration data. Use of this defaults-extra-file with mysqldump indicates credential and data theft.

Suspicious Remote Payload Staging via curl Piped to Shell (via process_creation)

This rule detects curl silently fetching a remote script and piping it directly into a shell, the staging technique used to deploy the SNOWLIGHT loader after SAP NetWeaver exploitation. Downloading and executing remote content in a single pipeline bypasses on-disk inspection. This pattern is a common Linux post-exploitation loader behavior.

Suspicious Reverse Shell via bash to dev tcp (via process_creation)

This rule detects a bash interactive reverse shell using the /dev/tcp pseudo-device, executed post-exploitation of SAP NetWeaver to reach attacker infrastructure. This construct redirects an interactive shell over a raw TCP socket. Legitimate administrators almost never spawn shells this way.