Sigma detection rules, expert-reviewed

Linux Process Creation: crontab -l Enumeration

Flags Linux executions of /crontab with the -l option to list a user’s scheduled cron tasks.

Linux Wget Writing Files Under /tmp or /var/tmp

Alerts when wget creates files under /tmp or /var/tmp on Linux.

Linux Shell Script Creation in /etc/profile.d/ for Persistence

Alerts on creation of .sh/.csh scripts in /etc/profile.d, a common place for persistence via shell startup.

Linux process-created writes to sensitive or critical files via shell redirection or editors

Alerts on Linux process command lines that redirect output or run editors while targeting sensitive/critical file paths.

Linux Process Creating xterm Reverse Shell Display Tunneling

Alerts on xterm processes started with -display and display endpoint ":1" consistent with a reverse shell tunnel.

Linux Python Reverse Shell via pty and socket Module Execution

Alerts on Linux executions of Python -c commands that use socket and pty to connect and spawn a potential reverse shell.

Linux Process Creation: Ruby -e Reverse Shell Socket Usage

Detects inline Ruby (-e) using rsocket/TCPSocket and shell keywords, which may indicate reverse-shell style behavior.

Linux Process Creation: PHP CLI Inline Code Using fsockopen with -r

Alerts on Linux executions of php -r inline code that references fsockopen, consistent with outbound reverse-shell style socket creation.

Linux Perl Reverse Shell Execution via Perl -e and Socket/exec Patterns

Detects perl -e one-liners on Linux that include Perl Socket::INET reverse-shell code patterns and exec/connect logic.

Linux netcat/ncat Execution with -e and Shell Invocation

Alerts on Linux executions of nc/ncat using -e that reference common shells, indicating potential reverse-shell setup.

Linux Bash Launched in Interactive Mode (-i)

Alerts when /bash is executed with the interactive flag (-i) on Linux.

Linux Package Removal via yum, apt, dpkg, or rpm Commands

Detects package uninstall activity on Linux via yum, apt/apt-get, dpkg, or rpm based on command-line removal flags.

Linux Auditd: Unix Shell Configuration File Modification

Alerts when shell startup or login configuration files (system or user) are modified on Linux.

Linux firewall rule deletion via iptables, firewall-cmd, ufw, or nft

Flags EXECVE activity that removes Linux firewall rules using iptables, firewall-cmd, ufw, or nft.

Linux process copying passwd or shadow from /tmp

Alerts on Linux cp commands that copy /tmp-based passwd or shadow files.