Sigma detection rules, expert-reviewed

Suspicious awk Character Generation Piped to Shell on VMware ESXi (via process_creation)

This rule detects awk being used to assemble command strings from numeric character codes on VMware ESXi. Actors abuse awk BEGIN blocks with printf and percent-c formatting to build obfuscated commands that are then piped into a shell. This construct rarely appears in legitimate ESXi administration.

Malicious Cryptominer Payload Retrieval into Temporary Directory

This rule detects a shell changing into a writable temporary directory before downloading a secondary payload, a staging pattern used by the Log4j XMRig campaign to fetch shell droppers such as 8UsA.sh. This behavior stages miner components in non-persistent locations to evade inspection and hijack compute resources.

Suspicious Shell Spawned by Gogs Git Server on Linux

This rule detects the Gogs Git service process spawning a command shell which indicates exploitation of the CVE-2025-8110 remote code execution used in the wild to deploy Supershell reverse-SSH C2 payloads. A Git hosting service launching an interactive shell is not expected behavior and signals active post-exploitation.

Suspicious Reverse Shell via socat EXEC Redirection

This rule detects socat invoked with an EXEC or SYSTEM redirection to a shell, a reverse shell pattern shown in Elastic Linux persistence research. Attackers pair a socat TCP endpoint with EXEC to pipe an interactive shell back to a listener for command and control. Socat spawning a shell process is uncommon in normal administration and points to remote-access tooling.

Malicious Process Memory Injection via dd Write to /proc/pid/mem by UNC3886 (via process_creation)

This rule detects the dd utility writing to a process memory file under /proc, the injection primitive UNC3886 used to load TINYSHELL backdoors into legitimate processes on Junos OS routers. Direct writes to another process memory are a strong indicator of code injection and defense evasion.

Malicious Interactive Reverse Shell on Linux (via process_creation)

This rule detects Linux command lines that establish an interactive reverse shell, including bash redirection to /dev/tcp, netcat with command execution, or a named-pipe backpipe. Reverse shells are a common execution and command-and-control behavior across the Linux intrusions summarized in the Red Canary Threat Detection Report. Detecting these constructs surfaces hands-on-keyboard access to the host.

Suspicious Cron Persistence File Created in System Cron Directories

This rule detects creation of a file named 0anacron inside the system cron directories which the DripDropper Linux malware uses to masquerade as a trusted periodic job and establish scheduled task persistence. Placing a script among legitimate cron jobs lets the malware re execute and survive reboots. Detecting this file write surfaces persistence establishment on compromised Linux hosts.

Linux Process Execution of Python Base64 Decode One-Liners

Alerts on Linux process creations running Python -c one-liners that import base64 and invoke decoding functions.

Linux setcap sets cap_setuid on a binary via setcap utility

Alerts on Linux executions of setcap configuring cap_setuid on a binary, indicating potential identity-manipulation and persistence risk.

Linux setcap sets cap_setgid on binaries (Setgid capability assignment)

Flags Linux setcap commands that set cap_setgid on binaries via process creation logs.

Linux Script Interpreters Spawning Credential Scanners (trufflehog, gitleaks)

Flags Linux cases where node or bun processes launch trufflehog or gitleaks to search for secrets.

Linux File Creation: Filename Contains Embedded Base64 Bash Fragments

Alerts on Linux file events for filenames that appear to embed Base64-decoding bash command patterns.

Kaspersky Endpoint Security Service Stopped via Command Line on Linux

Flags Linux commands using systemctl/bash/sh to stop Kaspersky (kesl) services, suggesting defense impairment or manual service shutdown.

Linux systemctl Mask Power Targets to Disable Suspend, Hibernate, Hybrid Sleep

Flags systemctl mask commands targeting suspend/hibernate/hybrid-sleep power management targets.

Linux Python CLI Web Server Execution via http.server or SimpleHTTPServer

Flags Linux processes running Python’s built-in HTTP server modules via command line.