Sigma detection rules, expert-reviewed

Linux PAM TTY Audit Enabling via /etc/pam.d Modification

Alerts on auditd-observed edits to PAM system-auth/password-auth tied to TTY input auditing.

Linux Code Injection via ld.so Preload File (/etc/ld.so.preload)

Alerts on references to /etc/ld.so.preload, indicating possible dynamic-library injection persistence on Linux.

Linux Remote System Discovery via arp and ping Process Execution

Flags Linux arp or ping commands with LAN/loopback/link-local IP range arguments consistent with remote host discovery.

Linux: Process Execution of Network Scanning and Recon Tools

Flags Linux process executions of common network scanning/recon utilities based on executable name (and netcat listen flag filtering).

Linux auditd: Network service enumeration via telnet, nmap, or netcat

Alerts when telnet/nmap/netcat-style binaries are executed on Linux via auditd, consistent with service discovery scanning.

Linux System Network Connections Discovery via who, w, last, lsof, or netstat

Identifies Linux discovery activity using who/w/last/lsof/netstat for enumerating network connections and system state.

Linux process discovery via grep/egrep searching for security software strings

Alerts when grep/egrep on Linux searches command lines for indicators of security/monitoring tools.

Linux Process Discovery: find, ls -R, tree, findmnt, and locate executed

Alerts on Linux execution of file/directory discovery utilities like find, tree, findmnt, recursive ls, and mlocate.

Linux Base64 Utility Decoding with -d/--decode in Process Creation

Identifies Linux base64 decoding activity using base64 with the -d/--decode flag.

Linux: Command-Line Access to Shell History Files via execve

Alerts when executed commands reference common Linux shell history files.

Linux split Command Used to Divide Files for Possible Exfiltration

Identifies use of the Linux split command to break files into parts, potentially for staging or exfiltration.

Linux auditd: Shutdown, reboot, halt, poweroff or init-triggered system reboot

Identifies Linux shutdown/reboot command execution patterns using auditd execve telemetry.

Linux: Grep used to search for passwords in files (auditd EXECVE)

Flags Linux process executions running grep with “password” in the command line.

Linux: Detect touch commands used to alter file timestamps with -t/-a/-c/-m/-r flags

Alerts on touch executions with timestamp options that alter file access and modification times on Linux.

Linux: Detect dd and truncate used to pad binaries and alter file contents

Flags Linux process executions of dd and truncate consistent with padding binaries to alter on-disk representation.