Sigma detection rules, expert-reviewed

Suspicious Making a File Executable in a Temp Directory (via process_creation)

This rule detects chmod granting execute permission to a file staged in /tmp, /dev/shm or /var/tmp, a common step between dropping a payload and running it on Linux. Setting execute bits on temp-directory files is a defense-evasion and execution-preparation technique tracked in the Red Canary Threat Detection Report. Detecting it surfaces a payload being armed for execution.

Suspicious systemd Service Persistence Creation (via process_creation)

This rule detects creation or enabling of a systemd unit under the system service directories, a persistence technique that runs an attacker binary at boot with elevated privileges on Linux. Systemd service persistence is tracked in the Red Canary Threat Detection Report. Detecting the unit write and enable surfaces a boot-persistent foothold.

Possible Network Service Scanning via Nmap or Masscan (via process_creation)

This rule detects execution of network scanners such as nmap, masscan or zmap, a network-service-discovery technique attackers run to map reachable hosts and open ports for lateral movement. Internal scanning is tracked in the Red Canary Threat Detection Report. Detecting scanner execution surfaces reconnaissance from a compromised host.

Suspicious Disabling or Flushing of the Linux Host Firewall (via process_creation)

This rule detects commands that flush iptables rules or stop the ufw/firewalld service, a defense-impairment step attackers take to remove filtering that would block command-and-control or lateral movement on a Linux host. Disabling the host firewall is a defense-evasion technique in the Red Canary Threat Detection Report. Detecting these commands surfaces host defenses being lowered.

Malicious Remote Script Piped Directly to a Shell (via process_creation)

This rule detects curl or wget output piped straight into sh or bash on Linux, a one-line download-and-execute pattern used to fetch and immediately run a remote payload. Piping a downloaded script to a shell is an ingress-and-execution technique tracked in the Red Canary Threat Detection Report. Detecting this chain surfaces remote code execution as it happens.

Malicious Cryptocurrency Miner Execution (via process_creation)

This rule detects command lines carrying cryptomining indicators such as stratum pool URLs, --donate-level or known miner names, a resource-hijacking impact technique that runs coin miners on compromised Linux hosts. Cryptomining is tracked in the Red Canary Threat Detection Report. Detecting these arguments surfaces unauthorized use of compute resources.

Malicious Shared Library Preload Persistence via ld.so.preload (via process_creation)

This rule detects modification of /etc/ld.so.preload, which forces a shared library to load into every dynamically linked process, a stealthy persistence and privilege-escalation technique used by Linux rootkits. Ld.so.preload hijacking is tracked in the Red Canary Threat Detection Report. Detecting the change surfaces a system-wide library hijack.

Suspicious Shell Profile Persistence Modification (via process_creation)

This rule detects commands that append to shell startup files such as .bashrc, .bash_profile, .zshrc or /etc/profile.d, which run automatically at each login and are abused for durable execution on Linux. Shell-profile persistence is a technique tracked in the Red Canary Threat Detection Report. Detecting the modification surfaces a login-triggered foothold.

Suspicious Shell History Clearing or Disabling (via process_creation)

This rule detects commands that clear or disable shell history, such as truncating bash_history, unsetting HISTFILE or setting HISTFILESIZE to zero, an anti-forensic step used to hide interactive activity on a Linux host. Shell history tampering is an indicator-removal technique tracked in the Red Canary Threat Detection Report. Detecting it surfaces an operator covering hands-on-keyboard tracks.

Suspicious SSH authorized_keys Persistence Modification (via process_creation)

This rule detects command lines that append to or fetch content into an SSH authorized_keys file, which plants an attacker public key for durable, credential-free remote access to a Linux host. Adding rogue SSH keys is an account-manipulation persistence technique tracked in the Red Canary Threat Detection Report. Detecting the modification surfaces a persistence foothold being established.

Malicious Read Access to the Linux Shadow Password File (via process_creation)

This rule detects a shell or file utility reading /etc/shadow, the file holding Linux password hashes, which adversaries copy to crack credentials offline. OS credential access on Linux hosts supports the lateral movement and escalation documented in the Red Canary Threat Detection Report. Because /etc/shadow is normally accessed only by system authentication components, ad-hoc reads by cat, cp or editors are a strong credential-theft indicator.

Malicious Houken PHP Webshell Written into Ivanti CSA Webroot via Shell Redirection (via process_creation)

This rule detects a shell dropping a PHP webshell into the Ivanti Cloud Service Appliance LANDesk broker webroot by echoing PHP code that invokes system() or eval() on request parameters, the initial-access behavior used by the Houken intrusion set after exploiting Ivanti CSA zero-days. Adversaries leverage this to obtain a persistent command channel on the appliance, making early detection critical for catching perimeter compromise before rootkit deployment and lateral movement.

Malicious Houken sysinitd Rootkit Kernel Module Load via insmod (via process_creation)

This rule detects loading of the Houken sysinitd rootkit kernel module via insmod, the persistence and defense-evasion behavior deployed on compromised Ivanti Cloud Service Appliance devices to hook the kernel and hide the intrusion. Adversaries leverage a loadable kernel module to survive reboots and conceal processes and network activity, making detection critical because the rootkit blinds most higher-level telemetry once loaded.

HamsaUpdate Linux Payload Download via Wget Piped to Bash (via process_creation)

This rule detects the Operation HamsaUpdate Linux stage retrieving update.sh with wget and piping it directly into bash for immediate execution. Downloading a remote script and executing it inline without touching disk is the delivery behavior used to run the multi-layer wiper loader on Linux hosts.

Suspicious Timestomping of PHP Webshell in Ivanti CSA Webroot via touch (via process_creation)

This rule detects use of touch with an explicit date argument to backdate a PHP file inside the Ivanti Cloud Service Appliance LANDesk broker webroot, the timestomping behavior used by the Houken intrusion set to blend planted webshells with legitimate appliance files. Adversaries leverage timestamp manipulation to frustrate forensic triage, making this a strong signal of an attacker actively concealing webshell drops on the appliance.