Sigma detection rules, expert-reviewed

Suspicious Remote Payload Download Piped to Shell on Linux

This rule detects curl or wget output piped directly into a shell, the download-and-execute technique used by the PeerBlight Linux backdoor after exploiting React2Shell CVE-2025-55182. Piping a remote script straight to bash runs attacker code without touching disk for review. This one-line fetch-to-shell pattern is a common Linux initial execution indicator.

Malicious LD_PRELOAD Rootkit Persistence via ld.so.preload

This rule detects a command writing the OVERSTEP shared object into /etc/ld.so.preload to hook every dynamically linked process on a SonicWall SMA appliance. This LD_PRELOAD rootkit hides attacker files and processes while capturing credentials, cementing long-term stealthy access after public-facing exploitation.

Suspicious Cron Job Executing Binary From var tmp via Process Creation

This rule detects a cron daemon spawning a process from the /var/tmp directory. The trojanized Free Download Manager installs an /etc/cron.d/collect job that runs /var/tmp/crond every ten minutes, using cron to persist and periodically launch its reverse-shell payload from a world-writable path.

Suspicious Bash Reverse Shell via /dev/tcp

This rule detects Bash command lines that redirect a shell to a /dev/tcp socket, a fileless reverse-shell technique. This was used against Linux and SAP hosts following CVE-2025-31324 exploitation to obtain interactive remote access. Legitimate administrative use of /dev/tcp is uncommon and warrants investigation.

Malicious Auto-Color Backdoor Self-Copy on Linux (via process_creation)

This rule detects references to the /var/log/cross/auto-color path where the Auto-Color Linux backdoor copies itself for persistence while masquerading inside a log directory. Placing an executable under /var/log is an evasive persistence technique meant to avoid scrutiny of typical binary locations.

Malicious Netcat Reverse Shell with Command Execution Flag (via process_creation)

This rule detects netcat launched with the -e flag to pipe a shell to a remote endpoint. Actors exploiting F5 BIG-IP and ScreenConnect used nc -e /bin/bash to obtain interactive reverse shells on compromised hosts. The -e execution flag combined with a shell path is a well-established reverse-shell indicator.

Suspicious TruffleHog Secret Scanner Spawned by Node Package Manager on Linux

This rule detects the TruffleHog secret scanning tool being launched as a child of a node or npm process which the Shai-Hulud npm worm abuses during package install to locate GitHub npm and cloud credentials on the victim host. Running a credential scanner from within a package install lifecycle is anomalous and indicates automated secret theft rather than a developer audit.

Suspicious Proxyware Download to Hidden Tmp Path on Linux

This rule detects wget fetching a payload into the hidden /tmp/logs/.config/whatchdog location used to stage residential proxyware on compromised Linux hosts. Downloading an executable into a concealed tmp directory is a strong indicator of proxyware staging.

Suspicious Payload Download and Execution via curl chmod 777 (via process_creation)

This rule detects a download-and-run chain that fetches a file with curl or wget and marks it world-executable with chmod 777 before running it, the delivery routine used after exploiting the React Server Components flaws to stage XMRig, Mirai and Cobalt Strike CrossC2. Chaining retrieval, permission change and execution stages a remote binary on the compromised host.

Suspicious Cloudflare Quick Tunnel Establishment via trycloudflare.com (via process_creation)

This rule detects establishment of a Cloudflare quick tunnel referencing trycloudflare.com, an anonymous tunneling channel abused after React2Shell exploitation to reach compromised servers without exposing attacker infrastructure. Adversaries use these ephemeral tunnels to proxy command and control and remote access through trusted Cloudflare domains, so their presence on a server signals covert external connectivity.

Suspicious WordPress Web Shell Drop in Plugins Directory (via file_event)

This rule detects creation of a PHP web shell file whose name contains shell inside the WordPress plugins directory, matching the compromised-container forensics case that recovered a rshell.php web shell. Attackers drop such files to keep code-execution access to a web application. A shell-named PHP file written under wp-content plugins is a strong web shell indicator.

Suspicious User and Network Namespace Creation via unshare on Linux

This rule detects use of unshare to create combined user and network namespaces as leveraged by the Copy Fail and DirtyFrag Linux page cache exploits in Elastic research. Unprivileged user namespace creation is a common precursor to kernel exploitation that grants capabilities inside the new namespace for privilege escalation.

Suspicious sshpass Noninteractive SSH Password Authentication (via process_creation)

This rule detects use of sshpass to supply an SSH password on the command line, the method ShinyHunters used for credential spraying across PeopleSoft nodes listed in /etc/hosts during the education sector campaign. Adversaries rely on sshpass to automate password-based lateral movement, and passing credentials inline is rarely legitimate in enterprise environments, so this behavior deserves scrutiny.

Malicious Akira ESXi Encryptor Execution

This rule detects execution of the Akira ESXi encryptor identified by its distinctive virtual-machine targeting arguments. Akira operators ran the Linux ESXi encryptor with flags such as --stopvm --vmonly and --ep to shut down and encrypt virtual machines. These combined VM-control encryptor arguments indicate active hypervisor-level ransomware deployment against an ESXi host.

Suspicious Linux Log Sanitization via sed In-Place Edit

This rule detects sed being used to edit web and appliance log files in place, matching OVERSTEP anti-forensic behavior that strips attacker artifacts from SonicWall SMA logs. Selective log tampering conceals exploitation and backdoor activity from responders.