Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
451 rules
Linux env Execution Spawning Common Shells
Flags Linux executions of /env that invoke common shells like /bin/bash, /bin/sh, /bin/zsh, /bin/dash, or /bin/fish.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh122Free2024-09-02Linux capsh Shell Execution via Shell-Spawn Command Line Ending With " --"
Alerts on Linux executions of /capsh with a command line ending in " --", consistent with shell invocation attempts.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh293Free2024-09-02Linux awk/gawk/mawk/nawk CommandLine invoking shell via system()
Flags awk/gawk/mawk/nawk command lines using BEGIN {system(...)} to spawn a shell on Linux.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh101Free2024-09-02Linux: SSH ProxyCommand Triggering Interactive Shell Execution
Flags Linux ssh invocations that embed shell execution and redirection via ProxyCommand/local command options.
Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule TeamLinuxprocess_creationHigh296Free2024-08-29Linux: Network connections initiated to LocaltoNet tunneling subdomains
Alerts when a Linux host initiates outbound connections to LocaltoNet (.localto.net/.localtonet.com) tunneling subdomains.
Andreas Braathen (mnemonic.io), Huntrule TeamLinuxnetwork_connectionHigh4810Free2024-06-17Linux network connections to known malware callback ports
Alerts on initiated Linux outbound connections to specific known suspicious destination ports, excluding local/private IP ranges.
hasselj, Huntrule TeamLinuxnetwork_connectionHigh186Free2024-05-10Linux Pnscan Binary Data Transfer via Command-Line
Flags Linux executions with Pnscan-like arguments indicating binary send/receive data transfer.
David Burkett (@signalblur), Huntrule TeamLinuxprocess_creationMedium102Free2024-04-16TeamViewer Remote Session Startup Command Execution on Linux
Flags Linux process launches of TeamViewer_Desktop with IPC port/module arguments under TeamViewer_Service, indicating remote session startup.
Josh Nickels, Qi Nan, Huntrule TeamLinuxprocess_creationLow3810Free2024-03-11Linux dd Process Memory Map Overwrite for Code Injection (proc/mem)
Alerts when dd is used to write to /proc/<pid>/mem, suggesting potential Linux process code injection.
Joseph Kamau, Huntrule TeamLinuxprocess_creationMedium131Free2023-12-01Linux ESXi esxcli VSAN Information Discovery via esxcli Command
Flags Linux executions of /esxcli with the vsan namespace and get/list subcommands to enumerate virtual storage.
Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium162Free2023-09-04Linux Process Creation: ESXi esxcli VM kill via vm process kill flags
Triggers when esxcli is executed with VM process kill arguments, indicating a potential ESXi VM termination.
Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium112Free2023-09-04Linux Process Execution of esxcli VM Listing Commands
Alerts on Linux process executions of /esxcli with command-line arguments indicating VM discovery (vm process ... list).
Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium123Free2023-09-04Linux Process Creation: ESXi esxcli system discovery via system namespace
Alert on esxcli system invocations using get/list subcommands to discover ESXi system component information.
Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium275Free2023-09-04Linux Process: ESXi syslog configuration changed via esxcli system syslog config set
Detects esxcli commands that set ESXi syslog configuration based on command-line terms.
Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium81Free2023-09-04Linux ESXi esxcli Storage Information Discovery via esxcli storage commands
Flags Linux process executions of esxcli with storage discovery subcommands like get/list.
Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon, Huntrule TeamLinuxprocess_creationMedium241Free2023-09-04