Sigma detection rules, expert-reviewed

Suspicious sshpass Noninteractive SSH Password Authentication (via process_creation)

This rule detects use of sshpass to supply an SSH password on the command line, the method ShinyHunters used for credential spraying across PeopleSoft nodes listed in /etc/hosts during the education sector campaign. Adversaries rely on sshpass to automate password-based lateral movement, and passing credentials inline is rarely legitimate in enterprise environments, so this behavior deserves scrutiny.

Malicious Akira ESXi Encryptor Execution

This rule detects execution of the Akira ESXi encryptor identified by its distinctive virtual-machine targeting arguments. Akira operators ran the Linux ESXi encryptor with flags such as --stopvm --vmonly and --ep to shut down and encrypt virtual machines. These combined VM-control encryptor arguments indicate active hypervisor-level ransomware deployment against an ESXi host.

Suspicious Linux Log Sanitization via sed In-Place Edit

This rule detects sed being used to edit web and appliance log files in place, matching OVERSTEP anti-forensic behavior that strips attacker artifacts from SonicWall SMA logs. Selective log tampering conceals exploitation and backdoor activity from responders.

Suspicious SD-WAN Compromise Reverse Tunnel via gsocket

This rule detects execution of the gsocket or gs-netcat tunneling utilities, matching the Cisco Catalyst SD-WAN exploitation where operators deploy gsocket to establish an outbound relay through firewalls. The Global Socket toolkit provides resilient encrypted access that bypasses inbound restrictions on compromised network devices. Presence of these tools on an appliance indicates covert remote access.

Malicious PAM Configuration Tampering for Passwordless su via pam_rootok (via process_creation)

This rule detects modification of a PAM configuration file to insert the pam_rootok module, granting passwordless su to root. This technique was reported in the Group-IB XMRig covert Linux PAM abuse campaign as a stealthy privilege and persistence mechanism. Abusing pam_rootok lets an attacker escalate to root without credentials while evading authentication logging, making it a high fidelity indicator of compromise.

Malicious Backdoored liblzma Loaded by sshd (CVE-2024-3094)

This rule detects the sshd process loading the backdoored liblzma shared object versions 5.6.0 or 5.6.1 associated with the XZ Utils supply chain compromise. Wiz Research described how this library hooks RSA_public_decrypt to grant remote code execution, so loading these specific versions indicates a compromised host.

Malicious Remote Payload Piped to Shell via Curl or Wget

This rule detects download utilities piping fetched content directly into a shell interpreter, the loader pattern the agentic container-escape actor used to stage its second-stage payload from an attacker server. Piping remote content into sh or bash executes untrusted code without touching disk. This is a common ingress tool transfer and execution technique.

Suspicious Access to Kubernetes Service Account Token via Curl or Wget (via process_creation)

This rule detects curl or wget accessing the mounted Kubernetes service account token path, a credential theft technique observed in current threats to Kubernetes environments. The service account token grants API access with the pod's privileges, so reading it with a download tool indicates an attacker harvesting cluster credentials from a compromised container.

Malicious Immutable Flag on SSH authorized_keys via chattr

This rule detects use of chattr to set or clear the immutable attribute on an SSH authorized_keys file. Linux intrusion actors inject a backdoor key and then mark authorized_keys immutable so defenders and competing actors cannot remove their persistent access.

Suspicious Cron Job Persistence Creation on Linux (via process_creation)

This rule detects editing of a user crontab or writing into system cron directories, the scheduled-execution mechanism adversaries abuse on Linux to persist and re-run payloads on a timer. Cron-based persistence is a durable technique across the Linux threats summarized in the Red Canary Threat Detection Report. Detecting crontab edits and cron-directory writes surfaces persistence as it is established.

Suspicious Outlaw Payload Download via wget dota Archive

This rule detects wget or curl retrieving the Outlaw botnet staging script or the dota.tar.gz archive that unpacks the miner and SSH brute-force components. This download step bootstraps the full infection after initial access on a Linux host. The specific script and archive names are consistent Outlaw distribution artifacts.

Malicious Linux XorDDoS gcc.pid Device Marker File via file_event

This rule detects creation of the /var/run/gcc.pid device-identifier file that the Linux XorDDoS trojan reads and writes to track infected hosts. This hardcoded artifact path is a distinctive marker of the XorDDoS campaign delivering DDoS malware, so its appearance indicates an active infection.

Suspicious XDG Autostart Desktop Entry Persistence via DISGOMOJI

This rule detects creation of a .desktop autostart entry under the user config autostart directory as used by DISGOMOJI malware for Linux persistence. The malware placed a desktop entry to relaunch itself at login. Autostart entries are a common Linux user-level persistence mechanism.

Malicious Perl Reverse Shell Execution on Linux

This rule detects a perl one liner that opens a network socket and connects back to a remote host and hands it to a shell which the opportunistic Log4j campaign uses to spawn an interactive reverse shell after exploiting a vulnerable server.

Suspicious ESXi Virtual Machine Enumeration via esxcli Process List

This rule detects esxcli enumerating running virtual machine processes on an ESXi host. RTM Locker collects the output of esxcli vm process list into a temporary file to build a target list before force-killing and encrypting the VMs. VM process enumeration through esxcli immediately preceding termination is an early ransomware staging behavior.