Sigma detection rules, expert-reviewed

Suspicious PAM Backdoor via pam_exec Configuration Change

This rule detects modification of a PAM configuration file to load pam_exec.so, a pluggable authentication module backdoor described in Elastic Linux persistence research. By adding a pam_exec directive to an sshd PAM stack the attacker runs an arbitrary script on each authentication for persistence and credential capture. Edits to files under /etc/pam.d that introduce pam_exec are highly suspicious.

Suspicious Hidden Directory configrc for Bandwidth SDK Abuse

This rule detects references to the hidden .configrc directory used to stage tooling. In the campaign monetizing victim bandwidth via proxyware SDKs the attackers hide stager scripts z593 z401 and z402 inside a .configrc directory. Use of this hidden directory helps conceal the proxyware installation footprint.

Malicious ESXi Snapshot Removal Loop Inhibiting Recovery (via process_creation)

This rule detects vim-cmd removing all snapshots across virtual machines, the recovery-inhibition step used by Cicada3301 ransomware on ESXi hosts prior to encryption. Adversaries delete snapshots so encrypted guests cannot be rolled back, making a snapshot removeall operation a strong pre-encryption recovery-tampering signal.

Possible CI Runner Memory Scraping via Python Process Memory Read (tj-actions Supply Chain)

This rule detects a Python interpreter reading another process memory through /proc maps and mem, the technique the compromised tj-actions/changed-files GitHub Action used to dump CI runner memory. It is important because this behavior harvests secrets and tokens from the runner and leaks them into build logs.

Suspicious utmpdump Usage for wtmp Log Manipulation

This rule detects the utmpdump utility referencing the wtmp utmp or btmp accounting files. Operators infiltrating global telecom networks use utmpdump to dump edit and reload login records to erase evidence of their sessions. Interactive use of utmpdump against these files is a strong anti-forensics signal.

Suspicious Clearing of hosts.deny Access Restrictions on Linux

This rule detects shell activity that clears or overwrites the etc hosts.deny file. Automated SSH intrusion actors wipe host based access controls immediately after login to guarantee continued reachability before injecting their own authorized keys.

Malicious Container Escape via core_pattern Hijack (via process_creation)

This rule detects a process writing to the kernel core_pattern handler under proc sys kernel, a technique used in the BrokenSesame research to break out of a container by having a crash trigger execution on the host. Attackers set core_pattern to a pipe handler and then force a segfault to run code with host privileges. Modification of this kernel path from a workload is a strong escape signal.

Malicious PHP Webshell Dropped in PAN-OS Unauthenticated Web Root

This rule detects a PHP file being written under the PAN-OS management web root path /var/appweb/htdocs/unauth/ which Wiz observed attackers using to drop webshells while exploiting CVE-2024-0012 and CVE-2024-9474 in the wild. This is important because the unauth directory should never contain attacker PHP scripts so a new PHP file there is a high confidence indicator of authentication bypass followed by webshell installation on the firewall.

Malicious Privileged Container Launch With Host Root Mount via Docker

This rule detects a docker run command that starts a privileged container while bind mounting the host root filesystem which threat actors abusing exposed Docker and Kubernetes APIs use to escape the container and gain full control of the underlying node for cryptomining.

Malicious TeamPCP Trivy C2 Beacon to ICP Canister and Cloudflare Tunnel (via dns_query)

This rule detects DNS resolution of the Internet Computer canister fallback host the Cloudflare tunnel and the aquasecurtiy typosquat domain used as command-and-control by the TeamPCP implant embedded in the compromised Trivy v0.69.4 release. These hosts serve payloads and receive exfiltrated credentials so a lookup indicates an infected build or developer host beaconing out.

Suspicious Execution of freenode Linux Backdoor Helper Binary

This rule detects execution of the helper binary used by the Linux backdoor from the freenode IRC network compromise. Observed in NCC Group research analyzing that Linux backdoor which deploys a helper at /bin/dh. Detecting this uncommon helper path helps surface rootkit-supported backdoor activity on Linux hosts.

Suspicious Dero Miner Binaries nginx and cloud Execution

This rule detects execution of the Dero campaign binaries planted as usr bin nginx for propagation and usr bin cloud as the Dero miner. Naming the miner and worm after benign system tools hides them from operators reviewing running processes inside containers. The specific paths combined with these names are strong campaign indicators.

Suspicious chmod 777 on Dropped Payload in Temp Directory

This rule detects a process granting world-writable and executable permissions to a file staged under /tmp, a step used to make a downloaded exploit payload runnable. During React2Shell exploitation the actor dropped an architecture-specific binary into /tmp and made it executable before running it. Broad chmod 777 on temp payloads is a common post-compromise action that precedes execution of second-stage tooling.

Suspicious MOTD Or Git Hook Script Creation For Linux Persistence

This rule detects creation of executable scripts in the dynamic message-of-the-day directory or a git hooks directory which are persistence locations abused to run attacker code on login or developer workflow events. Adversaries drop scripts into update-motd.d or git hooks so their payload executes automatically with the privileges of the triggering process.

Suspicious Node Payload Drop in Local Share Directory (via file_event)

This rule detects creation of a sync.js payload under a hidden NodeJS local-share directory. The M-Red-Team AsyncAPI supply-chain compromise dropped this file after a GitHub Actions pwn-request to stage its second stage. A JavaScript payload written to this unusual location is a strong indicator of implant staging.