Sigma detection rules, expert-reviewed

Possible CI Runner Memory Scraping via Python Process Memory Read (tj-actions Supply Chain)

This rule detects a Python interpreter reading another process memory through /proc maps and mem, the technique the compromised tj-actions/changed-files GitHub Action used to dump CI runner memory. It is important because this behavior harvests secrets and tokens from the runner and leaks them into build logs.

Suspicious utmpdump Usage for wtmp Log Manipulation

This rule detects the utmpdump utility referencing the wtmp utmp or btmp accounting files. Operators infiltrating global telecom networks use utmpdump to dump edit and reload login records to erase evidence of their sessions. Interactive use of utmpdump against these files is a strong anti-forensics signal.

Suspicious Clearing of hosts.deny Access Restrictions on Linux

This rule detects shell activity that clears or overwrites the etc hosts.deny file. Automated SSH intrusion actors wipe host based access controls immediately after login to guarantee continued reachability before injecting their own authorized keys.

Malicious Container Escape via core_pattern Hijack (via process_creation)

This rule detects a process writing to the kernel core_pattern handler under proc sys kernel, a technique used in the BrokenSesame research to break out of a container by having a crash trigger execution on the host. Attackers set core_pattern to a pipe handler and then force a segfault to run code with host privileges. Modification of this kernel path from a workload is a strong escape signal.

Malicious PHP Webshell Dropped in PAN-OS Unauthenticated Web Root

This rule detects a PHP file being written under the PAN-OS management web root path /var/appweb/htdocs/unauth/ which Wiz observed attackers using to drop webshells while exploiting CVE-2024-0012 and CVE-2024-9474 in the wild. This is important because the unauth directory should never contain attacker PHP scripts so a new PHP file there is a high confidence indicator of authentication bypass followed by webshell installation on the firewall.

Malicious Privileged Container Launch With Host Root Mount via Docker

This rule detects a docker run command that starts a privileged container while bind mounting the host root filesystem which threat actors abusing exposed Docker and Kubernetes APIs use to escape the container and gain full control of the underlying node for cryptomining.

Malicious TeamPCP Trivy C2 Beacon to ICP Canister and Cloudflare Tunnel (via dns_query)

This rule detects DNS resolution of the Internet Computer canister fallback host the Cloudflare tunnel and the aquasecurtiy typosquat domain used as command-and-control by the TeamPCP implant embedded in the compromised Trivy v0.69.4 release. These hosts serve payloads and receive exfiltrated credentials so a lookup indicates an infected build or developer host beaconing out.

Suspicious Execution of freenode Linux Backdoor Helper Binary

This rule detects execution of the helper binary used by the Linux backdoor from the freenode IRC network compromise. Observed in NCC Group research analyzing that Linux backdoor which deploys a helper at /bin/dh. Detecting this uncommon helper path helps surface rootkit-supported backdoor activity on Linux hosts.

Suspicious Dero Miner Binaries nginx and cloud Execution

This rule detects execution of the Dero campaign binaries planted as usr bin nginx for propagation and usr bin cloud as the Dero miner. Naming the miner and worm after benign system tools hides them from operators reviewing running processes inside containers. The specific paths combined with these names are strong campaign indicators.

Suspicious chmod 777 on Dropped Payload in Temp Directory

This rule detects a process granting world-writable and executable permissions to a file staged under /tmp, a step used to make a downloaded exploit payload runnable. During React2Shell exploitation the actor dropped an architecture-specific binary into /tmp and made it executable before running it. Broad chmod 777 on temp payloads is a common post-compromise action that precedes execution of second-stage tooling.

Suspicious MOTD Or Git Hook Script Creation For Linux Persistence

This rule detects creation of executable scripts in the dynamic message-of-the-day directory or a git hooks directory which are persistence locations abused to run attacker code on login or developer workflow events. Adversaries drop scripts into update-motd.d or git hooks so their payload executes automatically with the privileges of the triggering process.

Suspicious Node Payload Drop in Local Share Directory (via file_event)

This rule detects creation of a sync.js payload under a hidden NodeJS local-share directory. The M-Red-Team AsyncAPI supply-chain compromise dropped this file after a GitHub Actions pwn-request to stage its second stage. A JavaScript payload written to this unusual location is a strong indicator of implant staging.

Suspicious awk Character Generation Piped to Shell on VMware ESXi (via process_creation)

This rule detects awk being used to assemble command strings from numeric character codes on VMware ESXi. Actors abuse awk BEGIN blocks with printf and percent-c formatting to build obfuscated commands that are then piped into a shell. This construct rarely appears in legitimate ESXi administration.

Malicious Cryptominer Payload Retrieval into Temporary Directory

This rule detects a shell changing into a writable temporary directory before downloading a secondary payload, a staging pattern used by the Log4j XMRig campaign to fetch shell droppers such as 8UsA.sh. This behavior stages miner components in non-persistent locations to evade inspection and hijack compute resources.

Suspicious Shell Spawned by Gogs Git Server on Linux

This rule detects the Gogs Git service process spawning a command shell which indicates exploitation of the CVE-2025-8110 remote code execution used in the wild to deploy Supershell reverse-SSH C2 payloads. A Git hosting service launching an interactive shell is not expected behavior and signals active post-exploitation.