Sigma detection rules, expert-reviewed

Suspicious Cloud Instance Metadata Access from Command Line (via process_creation)

This rule detects command line access to the cloud instance metadata service at 169.254.169.254 targeting the instance identity and IAM credential endpoints, the method the Kinsing actor used to steal temporary cloud credentials. Some SDKs and agents query metadata legitimately so filter known tooling.

Malicious Looney Tunables Privilege Escalation Exploit by Kinsing (via process_creation)

This rule detects the Kinsing actor running the gnu-acme.py exploit for CVE-2023-4911 Looney Tunables to escalate privileges through the glibc dynamic loader after gaining a foothold via PHPUnit. The gnu-acme.py filename is specific to this observed intrusion.

Malicious Container Runtime Tampering via chmod on runc (via process_creation)

This rule detects removal of the execute permission from the runc container runtime binary using chmod, an action the reemerged TeamTNT campaign performed to lock other actors out of a compromised Docker host after gaining control. Disabling the container runtime this way is not a legitimate administrative action.

Malicious Koske Userland Rootkit Installation via ld.so.preload (via file_event)

This rule detects installation of the Koske userland rootkit that hooks readdir through LD_PRELOAD to hide files and processes. It fires when the hideproc.so shared object is written to disk or when /etc/ld.so.preload is modified to load it globally. Modification of ld.so.preload is uncommon on most systems and is a strong rootkit indicator.

Suspicious Sobolan Staging Directory Creation in var tmp (via file_event)

This rule detects the Sobolan malware extracting its payloads into hidden staging directories under /var/tmp such as .lol11 and .loll1 that mimic the legitimate ICE temp folders. These dot prefixed paths are unique to the Sobolan cryptomining campaign against exposed JupyterLab servers.

Malicious TeamTNT prochider Rootkit Deployment as Shared Object (via file_event)

This rule detects the TeamTNT prochider rootkit being written to disk under the deceptive shared object names xmrig.so and systemd.so which are then loaded through the dynamic linker to hide the cryptominer process. These filenames are specific to the campaign tooling.

Malicious perfctl Rootkit Library Drop via ld.so.preload (via file_event)

This rule detects the perfctl malware dropping its LD_PRELOAD rootkit and fake system libraries that hook pam_authenticate and pcap_loop to hide activity and steal credentials. It fires when the libgcwrap.so rootkit or the decoy libpprocps.so and libfsnkdev.so libraries are written to disk. These filenames are specific to the perfctl campaign.

Suspicious Tomcat Campaign Command and Control Domain Resolution (via dns_query)

This rule detects resolution of the dbliker.top domain that the 2025 Apache Tomcat cryptomining campaign uses to host and deliver its multi stage payloads. This domain was registered shortly before the campaign and any resolution from a workload indicates compromise.

Suspicious TeamTNT Command and Control Domain Resolution (via dns_query)

This rule detects resolution of command and control and download domains tied to the TeamTNT Docker Gatling Gun campaign including the resurrected teamtnt.red domain and the solscan themed lookalike domains. Any workload resolving these domains should be treated as compromised.

Suspicious Proxyjacking Service Resolution Observed in perfctl Campaign (via dns_query)

This rule detects Linux hosts resolving bandwidth sharing and proxyjacking service domains that the perfctl malware abuses to monetize victim network connections alongside cryptomining. Resolution of these services from a server workload is unusual and warrants review.

Suspicious Lucifer Botnet Mining Pool Domain Resolution (via dns_query)

This rule detects Linux hosts resolving the dedicated mining pool domains used by the Lucifer DDoS and cryptomining botnet that targets exposed Apache Hadoop YARN and Druid services. These domains are attacker controlled and their resolution from a server indicates cryptojacking.

Suspicious Linux CoinMiner Watchdog Staging in Shared Memory (via process_creation)

This rule detects a watchdog command that downloads the miner into a hidden .Sys_cache_backup file under dev shm using curl with a wget fallback as observed in the Linux SSH CoinMiner campaign. Fetching an executable into shared memory to survive removal is a hallmark of this miner.

Suspicious Linux Payload Download From Xrpl City Miner Host (via process_creation)

This rule detects wget or curl retrieving payloads from the download.xrpl.city host used to distribute the Linux SSH CoinMiner and its propagation modules. This host serves disguised archive and binary files during the infection chain.

Suspicious Making a File Executable in a Temp Directory (via process_creation)

This rule detects chmod granting execute permission to a file staged in /tmp, /dev/shm or /var/tmp, a common step between dropping a payload and running it on Linux. Setting execute bits on temp-directory files is a defense-evasion and execution-preparation technique tracked in the Red Canary Threat Detection Report. Detecting it surfaces a payload being armed for execution.

Suspicious systemd Service Persistence Creation (via process_creation)

This rule detects creation or enabling of a systemd unit under the system service directories, a persistence technique that runs an attacker binary at boot with elevated privileges on Linux. Systemd service persistence is tracked in the Red Canary Threat Detection Report. Detecting the unit write and enable surfaces a boot-persistent foothold.