Sigma detection rules, expert-reviewed

In-Memory VShell Downloader Piping curl and wget Fallback Into Shell (via process_creation)

This rule detects a single command line that combines curl and a wget fallback and pipes the retrieved payload directly into a shell, the download-and-execute pattern used by VShell to fetch its second stage from the C2 server. Adversaries leverage the dual-tool fallback to survive missing utilities and run code without touching disk, making detection of this construct useful for catching in-memory staging on Linux.

Malicious Named Pipe Netcat Reverse Shell via Shell (via process_creation)

This rule detects a reverse shell built from a named pipe relayed through netcat on Linux hosts. The marimo blockchain botnet campaign used mkfifo and nc to relay an interactive shell back to attacker infrastructure. This combination of a fifo and netcat is a well known reverse shell construct that warrants immediate investigation.

Suspicious Remote Payload Download Piped to Shell on Linux

This rule detects curl or wget output piped directly into a shell, the download-and-execute technique used by the PeerBlight Linux backdoor after exploiting React2Shell CVE-2025-55182. Piping a remote script straight to bash runs attacker code without touching disk for review. This one-line fetch-to-shell pattern is a common Linux initial execution indicator.

Malicious LD_PRELOAD Rootkit Persistence via ld.so.preload

This rule detects a command writing the OVERSTEP shared object into /etc/ld.so.preload to hook every dynamically linked process on a SonicWall SMA appliance. This LD_PRELOAD rootkit hides attacker files and processes while capturing credentials, cementing long-term stealthy access after public-facing exploitation.

Suspicious Cron Job Executing Binary From var tmp via Process Creation

This rule detects a cron daemon spawning a process from the /var/tmp directory. The trojanized Free Download Manager installs an /etc/cron.d/collect job that runs /var/tmp/crond every ten minutes, using cron to persist and periodically launch its reverse-shell payload from a world-writable path.

Suspicious Bash Reverse Shell via /dev/tcp

This rule detects Bash command lines that redirect a shell to a /dev/tcp socket, a fileless reverse-shell technique. This was used against Linux and SAP hosts following CVE-2025-31324 exploitation to obtain interactive remote access. Legitimate administrative use of /dev/tcp is uncommon and warrants investigation.

Malicious Auto-Color Backdoor Self-Copy on Linux (via process_creation)

This rule detects references to the /var/log/cross/auto-color path where the Auto-Color Linux backdoor copies itself for persistence while masquerading inside a log directory. Placing an executable under /var/log is an evasive persistence technique meant to avoid scrutiny of typical binary locations.

Malicious Netcat Reverse Shell with Command Execution Flag (via process_creation)

This rule detects netcat launched with the -e flag to pipe a shell to a remote endpoint. Actors exploiting F5 BIG-IP and ScreenConnect used nc -e /bin/bash to obtain interactive reverse shells on compromised hosts. The -e execution flag combined with a shell path is a well-established reverse-shell indicator.

Suspicious TruffleHog Secret Scanner Spawned by Node Package Manager on Linux

This rule detects the TruffleHog secret scanning tool being launched as a child of a node or npm process which the Shai-Hulud npm worm abuses during package install to locate GitHub npm and cloud credentials on the victim host. Running a credential scanner from within a package install lifecycle is anomalous and indicates automated secret theft rather than a developer audit.

Suspicious Proxyware Download to Hidden Tmp Path on Linux

This rule detects wget fetching a payload into the hidden /tmp/logs/.config/whatchdog location used to stage residential proxyware on compromised Linux hosts. Downloading an executable into a concealed tmp directory is a strong indicator of proxyware staging.

Suspicious Payload Download and Execution via curl chmod 777 (via process_creation)

This rule detects a download-and-run chain that fetches a file with curl or wget and marks it world-executable with chmod 777 before running it, the delivery routine used after exploiting the React Server Components flaws to stage XMRig, Mirai and Cobalt Strike CrossC2. Chaining retrieval, permission change and execution stages a remote binary on the compromised host.

Suspicious Cloudflare Quick Tunnel Establishment via trycloudflare.com (via process_creation)

This rule detects establishment of a Cloudflare quick tunnel referencing trycloudflare.com, an anonymous tunneling channel abused after React2Shell exploitation to reach compromised servers without exposing attacker infrastructure. Adversaries use these ephemeral tunnels to proxy command and control and remote access through trusted Cloudflare domains, so their presence on a server signals covert external connectivity.

Suspicious WordPress Web Shell Drop in Plugins Directory (via file_event)

This rule detects creation of a PHP web shell file whose name contains shell inside the WordPress plugins directory, matching the compromised-container forensics case that recovered a rshell.php web shell. Attackers drop such files to keep code-execution access to a web application. A shell-named PHP file written under wp-content plugins is a strong web shell indicator.

Suspicious User and Network Namespace Creation via unshare on Linux

This rule detects use of unshare to create combined user and network namespaces as leveraged by the Copy Fail and DirtyFrag Linux page cache exploits in Elastic research. Unprivileged user namespace creation is a common precursor to kernel exploitation that grants capabilities inside the new namespace for privilege escalation.

Suspicious sshpass Noninteractive SSH Password Authentication (via process_creation)

This rule detects use of sshpass to supply an SSH password on the command line, the method ShinyHunters used for credential spraying across PeopleSoft nodes listed in /etc/hosts during the education sector campaign. Adversaries rely on sshpass to automate password-based lateral movement, and passing credentials inline is rarely legitimate in enterprise environments, so this behavior deserves scrutiny.