Sigma detection rules, expert-reviewed

Malicious wp2shell WordPress Web Shell via PHP Drop to Plugin Directory

This rule detects a PHP file written into a wp2shell plugin directory which is the web shell installed by the pre-auth WordPress RCE before command execution. Attackers drop the malicious plugin to gain a persistent server-side foothold. A PHP file appearing under this specific plugin path is a high-confidence web shell indicator.

Suspicious PG_MEM Payload Drop in PostgreSQL Data Directory (via file_event)

This rule detects the PG_MEM malware writing its pg_core loader and pg_mem payload into the PostgreSQL data directory after gaining code execution through the database. Executables written under the postgres data directory are highly abnormal and indicate compromise.

Malicious Sed Tampering of Juniper Syslog Configuration by UNC3886 (via process_creation)

This rule detects sed modifying the Junos syslog configuration file at /mfs/var/etc/syslog.conf, the logging suppression technique UNC3886 used to disable syslog before operating on compromised routers. Editing the appliance syslog configuration indicates deliberate impairment of defenses.

Suspicious Credential File Discovery via Find on Linux

This rule detects use of the find utility to recursively search common home and system directories for environment key and credential files which React2Shell CVE-2025-55182 post-exploitation scripts use to locate AWS SSH and application secrets for theft. Broad filesystem searches targeting env and key extensions indicate automated credential discovery on a compromised host.

Suspicious Download to tmp Followed by chmod Execution on Linux

This rule detects a single command line that downloads a file into a temporary directory and makes it executable. SSH compromise scripts fetch architecture specific botnet binaries into tmp with wget or curl and immediately grant execute permissions before launching them.

Malicious Modification of Ivanti web Binary by TRAILBLAZE Injection (via file_event)

This rule detects writes to the Ivanti Connect Secure /home/bin/web process binary, the target of the in-memory TRAILBLAZE and BRUSHFIRE injection chain during CVE-2025-22457 exploitation. Modification of this core appliance binary indicates implant injection and compromise.

Suspicious Clearing of Linux Authentication and History Logs

This rule detects removal or truncation of Linux authentication and shell history artifacts such as auth.log wtmp btmp and bash_history which the Salt Typhoon intrusions performed to erase evidence of access on compromised network devices and hosts. Deleting or emptying these files is a strong indicator of anti forensic activity following unauthorized access.

Malicious ESXi Virtual Machine Termination via esxcli (via process_creation)

This rule detects enumeration and forced termination of running virtual machines through esxcli vm process list and esxcli vm process kill commands. The Linux variant of Helldown ransomware uses this technique to stop VMs before encrypting their datastore files on ESXi hosts. Killing virtual machine worlds ensures files are unlocked so the ransomware can encrypt them and disrupt the entire virtualized environment.

Suspicious Persistence via Shell Script Dropped in profile.d Directory (via file_event)

This rule detects creation of a shell script under /etc/profile.d/ that executes for every interactive login shell. During Ivanti post-exploitation lateral movement the actor planted a cron.sh style script in profile.d to re-establish access on login. New executable scripts in profile.d are a well-known Linux persistence mechanism warranting review.

Malicious Rogue Root User Creation via Useradd UID Zero

This rule detects useradd invoked with the non-unique flag and a UID of 0 which creates a hidden secondary root-equivalent account for persistence and privilege escalation on Linux. Adversaries add a UID 0 account to retain full administrative control while blending in as an ordinary user.

Malicious TeamPCP LiteLLM Credential Exfiltration C2 Lookup (via dns_query)

This rule detects DNS lookups for the checkmarx.zone and models.litellm.cloud command-and-control hosts used by the trojanized LiteLLM PyPI packages to exfiltrate harvested environment variables and cloud credentials. A resolution of either host on a build or developer machine indicates the malicious LiteLLM payload has executed and is calling home.

Malicious EC2 Instance Metadata Credential Theft via curl (via process_creation)

This rule detects a command line that curls the EC2 Instance Metadata Service security-credentials path at 169.254.169.254 to steal the temporary IAM role credentials of a compromised instance. Attackers harvest these credentials for reconnaissance, lateral movement, and privilege escalation in the cloud account. Detecting IMDS credential retrieval on a host flags active cloud credential access.

Malicious EKS Pod Identity Credential Theft via Link-Local Endpoint

This rule detects command line access to the EKS Pod Identity credential endpoint at 169.254.170.23/v1/credentials. Wiz Research demonstrated that a compromised pod can request this URL with a stolen authorization token to retrieve IAM credentials, so direct interaction with this endpoint outside the SDK indicates credential theft.

In-Memory VShell Downloader Piping curl and wget Fallback Into Shell (via process_creation)

This rule detects a single command line that combines curl and a wget fallback and pipes the retrieved payload directly into a shell, the download-and-execute pattern used by VShell to fetch its second stage from the C2 server. Adversaries leverage the dual-tool fallback to survive missing utilities and run code without touching disk, making detection of this construct useful for catching in-memory staging on Linux.

Malicious Named Pipe Netcat Reverse Shell via Shell (via process_creation)

This rule detects a reverse shell built from a named pipe relayed through netcat on Linux hosts. The marimo blockchain botnet campaign used mkfifo and nc to relay an interactive shell back to attacker infrastructure. This combination of a fifo and netcat is a well known reverse shell construct that warrants immediate investigation.