Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
450 rules
Linux process execution of execve_hijack via sudo
Alerts when /sudo spawns a process whose command line includes execve_hijack.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh91Free2022-07-05Linux eBPF Backdoor File Persistence via cron.d and sudoers.d (ebpfbackdoor)
Detects Linux creation of "ebpfbackdoor" files in cron.d/sudoers.d, indicating likely persistence via an eBPF backdoor.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxfile_eventHigh103Free2022-07-05Linux eBPF Rootkit Activity: File Creation of /tmp/rootlog
Detects creation of /tmp/rootlog on Linux, a marker used by the TripleCross rootkit to track backdoor state.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxfile_eventHigh71Free2022-07-05Linux Persistence via /etc/sudoers.d File Creation or Modification
Alerts on file changes in /etc/sudoers.d/ that may indicate persistence via sudo privilege policy.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxfile_eventMedium436Free2022-07-05Linux Process Recon: Find SUID/htpasswd Files via Command-Line Patterns
Flags Linux command-line reconnaissance patterns for .htpasswd discovery and setuid (-perm -4000) file enumeration.
Florian Roth (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh348Free2022-06-20Linux sudoers file access via text-based utilities (cat/grep/head/etc.)
Alerts on Linux process executions that use common text tools to access /etc/sudoers content.
Florian Roth (Nextron Systems), Huntrule TeamLinuxprocess_creationMedium224Free2022-06-20Linux Process Command-Line Printing of Shell History Files
Alerts when Linux commands print or page shell history files via the command line for recon.
Florian Roth (Nextron Systems), Huntrule TeamLinuxprocess_creationMedium163Free2022-06-20Linux Shell History File Deletion via rm/unlink/shred
Alert on Linux command-line history file deletions using rm/unlink/shred targeting bash/zsh history files.
Florian Roth (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh151Free2022-06-20Linux nohup Process Execution (Process Creation)
Flags Linux process launches where the image path ends with '/nohup', indicating nohup was invoked for backgrounding or persistence.
Christopher Peacock @SecurePeacock, SCYTHE @scythe_io, Huntrule TeamLinuxprocess_creationMedium80Free2022-06-06Linux Java Process Launching Suspicious Shell and Scripting Children
Alerts when a Java parent process launches shell or downloader/scripting tools on Linux.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamLinuxprocess_creationHigh90Free2022-06-03Linux Python Spawning Pseudo-Terminal via pty Module
Flags Linux executions where Python imports the pty module and calls spawn to create a pseudo-TTY session.
Nextron Systems, Huntrule TeamLinuxprocess_creationMedium121Free2022-06-03Linux chmod Process Commandlines Targeting Sensitive Directory Paths
Flags Linux chmod commands that modify permissions for paths under /tmp/, /.Library/, /etc/, or /opt/, excluding several known benign package-maintenance patterns.
Christopher Peacock @SecurePeacock, SCYTHE @scythe_io, Huntrule TeamLinuxprocess_creationMedium183Free2022-06-03Linux cron: Suspicious crontab modification with REPLACE
Alerts on Linux cron activity indicating crontab changes containing the keyword "REPLACE".
Pawel Mazur, Huntrule TeamLinuxcronMedium131Free2022-04-16Linux Process Creation: Shell Command Piped Into Another Shell
Flags Linux processes that start with sh/bash -c and pipe execution into a subsequent shell.
Florian Roth (Nextron Systems), Huntrule TeamLinuxprocess_creationMedium395Free2022-03-14Linux Process Creation: Interactive Bash With Suspicious Command-Line and Child Image
Flags interactive bash (bash -i) spawning likely malicious children with encoded execution or recon/utility tool invocations.
Florian Roth (Nextron Systems), Huntrule TeamLinuxprocess_creationMedium132Free2022-03-14