Sigma detection rules, expert-reviewed

Linux Process Execution of esxcli Network Commands for ESXi Network Discovery

Alerts when an ESXi esxcli command queries or lists network configuration via the "network" flag.

Linux Process Discovery of Container Environment via ls -i on / Directory

Detects Linux commands that list inode information for '/' to probe whether execution is occurring inside a container.

Linux Docker Container Discovery via .dockerenv File Listing or Reads

Detects Linux process executions using common utilities to read or list .dockerenv, indicating potential container environment discovery.

Linux Container Discovery via /proc Virtual Filesystem Probing with CLI Text Tools

Flags Linux process executions using standard text tools to enumerate /proc for container-related discovery signals.

Linux Process Creation: ESXi User Account Added via esxcli system account add

Alerts when esxcli is used to run an ESXi system account add command, indicating user account creation.

Linux Amazon SSM Agent Hijack Indicators via Suspicious Agent Registration Arguments

Alerts when the Linux amazon-ssm-agent is run with full SSM registration flags (-register, -code, -id, -region).

Linux Named Pipe Creation via mkfifo in /tmp

Flags mkfifo executions that create named pipes in /tmp, a commonly abused location.

Linux Named Pipe Creation via mkfifo Process Execution

Flags Linux process executions of /mkfifo that create named pipes.

Linux wget downloads to /tmp using explicit output options

Alerts on wget commands writing output to /tmp using -O or --output-document.

Linux Script Execution from /tmp via Shell -c

Alerts when a Linux shell runs a command with -c that references a script under /tmp/.

Linux: Shell Execution from /tmp by Parent Process

Alert when a /tmp parent process spawns a shell (bash/sh/zsh/etc.), indicating likely staging and command execution.

Suspicious Linux Process Execution From /tmp Directory

Flags execution of binaries located under /tmp on Linux, excluding a known Nextcloud path.

Linux nohup Execution from /tmp

Flags Linux process executions using nohup with command lines referencing /tmp.

Linux grep file discovery targeting GobRAT-specific filenames

Alerts on grep executions on Linux whose arguments contain specific malware-related file names for discovery.

Linux OS Architecture Discovery Using grep

Flags grep executions on Linux whose command line ends with known CPU/architecture identifiers.