Sigma detection rules, expert-reviewed

Possible AF_ALG Privilege Escalation via algif_aead Module Load

This rule detects loading of the algif_aead kernel crypto module through modprobe or insmod, an autoload step abused by the CVE-2026-31431 Copy Fail local privilege escalation. The exploit drives an AF_ALG splice chain that requires the algif_aead module to reach the vulnerable kernel path. On hosts that do not use userspace crypto the on-demand load of this module is a suspicious precursor to privilege escalation.

Malicious Destructive Recursive Delete of Home Directory

This rule detects a recursive forced deletion targeting the user home directory, the destructive payload triggered by the Shai-Hulud gh-token-monitor daemon. After exfiltrating credentials the framework wipes the developer home directory to destroy evidence and disrupt the victim. A rm -rf against the home path is almost never intentional interactive behavior and signals a wiper action.

Suspicious Process Memory Secret Dump via proc mem

This rule detects a process reading another process address space through the proc mem interface, the credential harvesting technique used by the Shai-Hulud framework to scrape secrets from memory. The malware walks proc pid mem to lift tokens and keys that never touch disk. Direct reads of proc mem outside of debuggers are rare and indicate in-memory secret theft.

Suspicious Exfiltration of Environment File via wget POST

This rule detects reading a dotenv secrets file and posting its contents to a remote host using wget post-data, an exfiltration pattern observed after React2Shell RCE. Attackers grab application secrets from the .env file to pivot into connected cloud and database services. The combination of the .env path and an outbound HTTP post argument reflects deliberate credential theft rather than routine tooling.

Malicious Node.js Process Spawning Unix Shell or Network Client

This rule detects a Node.js server process spawning a Unix shell, curl, or wget, a strong indicator of remote code execution against a web application. This behavior was central to CVE-2025-55182 React2Shell exploitation of React Server Components where the crafted Next-Action request drove child_process execution. Web application runtimes should not normally launch interactive shells or downloaders, so this lineage signals hands-on-keyboard post-exploitation.

Malicious Immutable Attribute Set on SSH Authorized Keys via chattr on Linux

This rule detects the chattr command applying the append only or immutable attribute to an SSH authorized_keys file which cryptomining actors abusing container APIs use to lock in their backdoor SSH key and prevent defenders or competing miners from removing it.

Suspicious Internet Scanning for Docker and Kubelet Ports via masscan

This rule detects the masscan tool being run against the Docker API and kubelet ports which threat actors use to discover exposed container orchestration services across the internet before deploying cryptomining payloads.

Suspicious Cron Reboot Persistence Pointing to Hidden User Directory on Linux

This rule detects a crontab entry using the reboot schedule to launch a binary from a hidden path under a user local bin directory which the opportunistic Log4j campaign uses to persist its componist implant across system restarts.

Malicious Encrypted Reverse Shell via Netcat and GPG on Linux

This rule detects a command pipeline that reads from a netcat listener decrypts the traffic with gpg and pipes it into a shell which the opportunistic Log4j campaign uses to run an encrypted reverse shell that evades network content inspection.

Malicious Systemd Service Persistence via ExecStartPost Hidden Path on Linux

This rule detects modification of a systemd unit that adds an ExecStartPost directive pointing to a payload under /var/tmp which the chkstart tool from the exposed Docker API campaign uses to inject a malicious loader into legitimate services for persistence.

Suspicious Shell History Disabling via HISTFILE Redirection on Linux

This rule detects a command line that redirects the shell history file to /dev/null which the ar.sh script from the exposed Docker API campaign runs alongside flushing the firewall to prevent command logging and hinder incident response on compromised systems.

Suspicious File Download to Shared Memory Directory on Linux

This rule detects curl or wget writing a payload into the /dev/shm shared memory directory on Linux which the TeamTNT Doppelganger campaign uses to stage the gsocket backdoor in memory and evade disk based detection on compromised Docker hosts.

Suspicious Reverse Shell via Dev TCP or Netcat

This rule detects Linux reverse-shell construction using bash /dev/tcp redirection or netcat with command execution, techniques used to obtain remote access after ActiveMQ CVE-2023-46604 exploitation. Attackers open these outbound shells to control the compromised broker interactively. These reverse-shell patterns are hallmark hands-on-keyboard command-and-control indicators.

Suspicious Base64 Decoded Payload Piped to Shell

This rule detects an echoed base64 blob being decoded and piped directly into an interactive shell on Linux, an obfuscated execution technique used after ActiveMQ CVE-2023-46604 exploitation. Attackers use this to hide payload contents and run commands without dropping a file. Chaining base64 decode into bash is rarely legitimate and indicates obfuscated code execution.

Suspicious Shell Spawned by ActiveMQ Java Process

This rule detects a Linux shell being spawned as a child of an Apache ActiveMQ Java process, the exploitation pattern of CVE-2023-46604 remote code execution. Attackers trigger the deserialization flaw to run shell commands and fetch second-stage payloads. A Java broker process launching an interactive shell is a clear post-exploitation signal.