Sigma detection rules, expert-reviewed

Suspicious SD-WAN Compromise Reverse Tunnel via gsocket

This rule detects execution of the gsocket or gs-netcat tunneling utilities, matching the Cisco Catalyst SD-WAN exploitation where operators deploy gsocket to establish an outbound relay through firewalls. The Global Socket toolkit provides resilient encrypted access that bypasses inbound restrictions on compromised network devices. Presence of these tools on an appliance indicates covert remote access.

Malicious PAM Configuration Tampering for Passwordless su via pam_rootok (via process_creation)

This rule detects modification of a PAM configuration file to insert the pam_rootok module, granting passwordless su to root. This technique was reported in the Group-IB XMRig covert Linux PAM abuse campaign as a stealthy privilege and persistence mechanism. Abusing pam_rootok lets an attacker escalate to root without credentials while evading authentication logging, making it a high fidelity indicator of compromise.

Malicious Backdoored liblzma Loaded by sshd (CVE-2024-3094)

This rule detects the sshd process loading the backdoored liblzma shared object versions 5.6.0 or 5.6.1 associated with the XZ Utils supply chain compromise. Wiz Research described how this library hooks RSA_public_decrypt to grant remote code execution, so loading these specific versions indicates a compromised host.

Malicious Remote Payload Piped to Shell via Curl or Wget

This rule detects download utilities piping fetched content directly into a shell interpreter, the loader pattern the agentic container-escape actor used to stage its second-stage payload from an attacker server. Piping remote content into sh or bash executes untrusted code without touching disk. This is a common ingress tool transfer and execution technique.

Suspicious Access to Kubernetes Service Account Token via Curl or Wget (via process_creation)

This rule detects curl or wget accessing the mounted Kubernetes service account token path, a credential theft technique observed in current threats to Kubernetes environments. The service account token grants API access with the pod's privileges, so reading it with a download tool indicates an attacker harvesting cluster credentials from a compromised container.

Malicious Immutable Flag on SSH authorized_keys via chattr

This rule detects use of chattr to set or clear the immutable attribute on an SSH authorized_keys file. Linux intrusion actors inject a backdoor key and then mark authorized_keys immutable so defenders and competing actors cannot remove their persistent access.

Suspicious Cron Job Persistence Creation on Linux (via process_creation)

This rule detects editing of a user crontab or writing into system cron directories, the scheduled-execution mechanism adversaries abuse on Linux to persist and re-run payloads on a timer. Cron-based persistence is a durable technique across the Linux threats summarized in the Red Canary Threat Detection Report. Detecting crontab edits and cron-directory writes surfaces persistence as it is established.

Suspicious Outlaw Payload Download via wget dota Archive

This rule detects wget or curl retrieving the Outlaw botnet staging script or the dota.tar.gz archive that unpacks the miner and SSH brute-force components. This download step bootstraps the full infection after initial access on a Linux host. The specific script and archive names are consistent Outlaw distribution artifacts.

Malicious Linux XorDDoS gcc.pid Device Marker File via file_event

This rule detects creation of the /var/run/gcc.pid device-identifier file that the Linux XorDDoS trojan reads and writes to track infected hosts. This hardcoded artifact path is a distinctive marker of the XorDDoS campaign delivering DDoS malware, so its appearance indicates an active infection.

Suspicious XDG Autostart Desktop Entry Persistence via DISGOMOJI

This rule detects creation of a .desktop autostart entry under the user config autostart directory as used by DISGOMOJI malware for Linux persistence. The malware placed a desktop entry to relaunch itself at login. Autostart entries are a common Linux user-level persistence mechanism.

Malicious Perl Reverse Shell Execution on Linux

This rule detects a perl one liner that opens a network socket and connects back to a remote host and hands it to a shell which the opportunistic Log4j campaign uses to spawn an interactive reverse shell after exploiting a vulnerable server.

Suspicious ESXi Virtual Machine Enumeration via esxcli Process List

This rule detects esxcli enumerating running virtual machine processes on an ESXi host. RTM Locker collects the output of esxcli vm process list into a temporary file to build a target list before force-killing and encrypting the VMs. VM process enumeration through esxcli immediately preceding termination is an early ransomware staging behavior.

Suspicious PAM Backdoor via pam_exec Configuration Change

This rule detects modification of a PAM configuration file to load pam_exec.so, a pluggable authentication module backdoor described in Elastic Linux persistence research. By adding a pam_exec directive to an sshd PAM stack the attacker runs an arbitrary script on each authentication for persistence and credential capture. Edits to files under /etc/pam.d that introduce pam_exec are highly suspicious.

Suspicious Hidden Directory configrc for Bandwidth SDK Abuse

This rule detects references to the hidden .configrc directory used to stage tooling. In the campaign monetizing victim bandwidth via proxyware SDKs the attackers hide stager scripts z593 z401 and z402 inside a .configrc directory. Use of this hidden directory helps conceal the proxyware installation footprint.

Malicious ESXi Snapshot Removal Loop Inhibiting Recovery (via process_creation)

This rule detects vim-cmd removing all snapshots across virtual machines, the recovery-inhibition step used by Cicada3301 ransomware on ESXi hosts prior to encryption. Adversaries delete snapshots so encrypted guests cannot be rolled back, making a snapshot removeall operation a strong pre-encryption recovery-tampering signal.