Sigma detection rules, expert-reviewed

Suspicious SSH Daemon Configuration Change Enabling Root Login

This rule detects command line modification of the SSH daemon configuration to enable root login which DripDropper performs to strengthen its foothold on compromised cloud Linux hosts. Allowing direct root SSH access gives adversaries durable privileged remote access. Detecting edits that set PermitRootLogin surfaces account manipulation used for persistence.

Suspicious Executable Download to Temp Directory via curl on Linux

This rule detects curl invoked to write a downloaded file into the /tmp directory which was used in SAP NetWeaver post exploitation to stage second stage executables and a cryptominer. Writing remote payloads to world writable temp locations is a common ingress and staging technique on Linux. Detecting it surfaces tool transfer that often precedes malware execution.

Suspicious Base64 Decoded Payload Piped to Shell on Linux

This rule detects a base64 decode operation piped directly into a shell interpreter which was used after SAP NetWeaver exploitation to deobfuscate and run attacker payloads. Chaining base64 decoding into sh or bash lets adversaries hide command content from simple monitoring. Detecting this pattern surfaces obfuscated command execution on compromised Linux hosts.

Suspicious sqlite3 Access to gcloud Cached Access Token Database (via process_creation)

This rule detects sqlite3 querying the gcloud access_tokens.db credential store under the user gcloud config directory, the local token-theft behavior Red Canary documented for harvesting GCP access tokens. These cached tokens are stored in plaintext and remain valid after key deletion, so direct database access outside the gcloud tool indicates credential theft.

Suspicious SSH Authorized Keys Modification via Scripting Interpreter on Linux via Process Creation (via process_creation)

This rule detects a scripting interpreter or shell writing to an SSH authorized_keys file, the account-manipulation persistence technique Red Canary demonstrates using perl in its Linux detection guide. Injecting an attacker-controlled public key grants passwordless SSH access that survives reboots, so unexpected modification of authorized_keys is a strong persistence signal.

Suspicious Shadow File Exfiltration Over Dev TCP on Linux via Process Creation (via process_creation)

This rule detects the contents of /etc/shadow being read and piped to a bash /dev/tcp network socket, the password-hash exfiltration example from Red Canary's Linux detection guide. Combining access to the credential store with a raw network channel is an unambiguous attempt to steal hashes for offline cracking.

Suspicious Netcat Reverse Shell via Named Pipe on Linux via Process Creation (via process_creation)

This rule detects the classic Linux netcat reverse shell built on a FIFO created with mknod, the interactive shell technique Red Canary covers in its detection engineer guide to Linux. Chaining a named pipe with netcat backconnects a shell to an attacker while avoiding the need for a netcat build that supports the exec flag.

Suspicious Shell Profile Persistence Injection with Downloader

This rule detects a command that appends content to a user shell profile such as bashrc profile or zshrc while also invoking a downloader like curl or wget. TuxBot v3 injects its loader into these startup files so the bot re-launches on every interactive login. Detecting the profile append with a fetch command reveals shell initialization persistence used by the botnet.

Suspicious Execution of PAN-OS Captive Portal Implant Binaries (via process_creation)

This rule detects execution of implant binaries dropped during exploitation of the PAN-OS Captive Portal zero-day, staged under /var/tmp as linuxap, linuxda, or linuxupdate. These files provide attacker foothold and follow-on tooling on the compromised firewall.

Malicious Payload Download From copy.fail Exploit Host on Linux (via process_creation)

This rule detects curl or wget retrieving content from the copy.fail exploit host used in CVE-2026-31431 Copy Fail attacks. The downloaded exploit is followed by su-based privilege escalation to root on the compromised Linux system.

Suspicious su Execution From Uncommon Parent Process on Linux (via process_creation)

This rule detects the su binary being launched by a parent process that is not a common interactive shell or sudo, a privilege-escalation pattern tied to CVE-2026-31431 Copy Fail exploitation. Attackers invoke su from non-shell contexts to elevate to root after gaining initial code execution.

Possible Mirai IoT Payload Staging via chmod on Linux (via process_creation)

This rule detects chmod granting full 777 permissions to downloaded payloads in world-writable directories or files named after CPU architectures, a staging step used after exploiting CVE-2023-33538. This behavior precedes execution of Condi or Mirai IoT bot binaries dropped via wget on compromised routers.

Suspicious Python Base64 Encoded Command Execution (via process_creation)

This rule detects Python decoding and executing a base64-encoded payload inline, an execution technique used in the TeamPCP multi-stage supply chain attack on security infrastructure. Combining base64 decoding with dynamic exec obscures the executed code and is characteristic of staged malicious payloads rather than normal application behavior.

Suspicious ESXi Management Agent Stop via vpxa init Script (via process_creation)

This rule detects stopping the ESXi vpxa management agent through its init.d script, an evasion step in the RansomHouse MrAgent playbook that severs vCenter oversight before ransomware runs. Disabling vpxa blinds central management while the host is encrypted.

Malicious ESXi Firewall Disable via esxcli (via process_creation)

This rule detects the esxcli command that disables the ESXi host firewall, a defense-evasion action performed by the RansomHouse MrAgent tool before mass VM encryption. Turning off the hypervisor firewall opens management and lateral-movement paths ahead of the Mario ransomware deployment.