Sigma detection rules, expert-reviewed

Malicious ActiveMQ CVE-2023-46604 Payload Download via curl or wget

This rule detects curl or wget fetching the Kinsing exploitation Spring context files poc.xml or linux-poc.xml. During ActiveMQ CVE-2023-46604 exploitation the broker is coerced into loading a remote XML that pulls the next stage, so these filenames in a download command indicate active exploitation.

Suspicious Autostart Desktop Entry Persistence via Linux File Creation

This rule detects creation of a system-backup.desktop autostart entry under the user config autostart directory on Linux. TransparentTribe uses this masqueraded desktop file together with a systemd unit and a per-minute crontab to persist the DeskRAT implant. A backup themed autostart entry is a low effort way to regain execution at every login which is why it warrants review.

Malicious PolarEdge QNAP Backdoor Dropper Script in Temp (via file_event)

This rule detects creation of the hidden dropper script used by the PolarEdge QNAP backdoor in the temp directory. After exploiting CVE-2023-20118 the implant writes a hidden qnax shell script to stage its components. A hidden script with this name in tmp is a specific artifact of the PolarEdge implant.

Suspicious Login Shell Assigned to Service Account games on Linux

This rule detects a command that assigns an interactive login shell to the built in games service account which DripDropper abuses to convert an unused system account into a usable backdoor. Service accounts normally have a nologin shell so granting one a real shell is a strong sign of account manipulation. Detecting this change surfaces persistence via a valid but repurposed account.

Suspicious SSH Daemon Configuration Change Enabling Root Login

This rule detects command line modification of the SSH daemon configuration to enable root login which DripDropper performs to strengthen its foothold on compromised cloud Linux hosts. Allowing direct root SSH access gives adversaries durable privileged remote access. Detecting edits that set PermitRootLogin surfaces account manipulation used for persistence.

Suspicious Executable Download to Temp Directory via curl on Linux

This rule detects curl invoked to write a downloaded file into the /tmp directory which was used in SAP NetWeaver post exploitation to stage second stage executables and a cryptominer. Writing remote payloads to world writable temp locations is a common ingress and staging technique on Linux. Detecting it surfaces tool transfer that often precedes malware execution.

Suspicious Base64 Decoded Payload Piped to Shell on Linux

This rule detects a base64 decode operation piped directly into a shell interpreter which was used after SAP NetWeaver exploitation to deobfuscate and run attacker payloads. Chaining base64 decoding into sh or bash lets adversaries hide command content from simple monitoring. Detecting this pattern surfaces obfuscated command execution on compromised Linux hosts.

Suspicious sqlite3 Access to gcloud Cached Access Token Database (via process_creation)

This rule detects sqlite3 querying the gcloud access_tokens.db credential store under the user gcloud config directory, the local token-theft behavior Red Canary documented for harvesting GCP access tokens. These cached tokens are stored in plaintext and remain valid after key deletion, so direct database access outside the gcloud tool indicates credential theft.

Suspicious SSH Authorized Keys Modification via Scripting Interpreter on Linux via Process Creation (via process_creation)

This rule detects a scripting interpreter or shell writing to an SSH authorized_keys file, the account-manipulation persistence technique Red Canary demonstrates using perl in its Linux detection guide. Injecting an attacker-controlled public key grants passwordless SSH access that survives reboots, so unexpected modification of authorized_keys is a strong persistence signal.

Suspicious Shadow File Exfiltration Over Dev TCP on Linux via Process Creation (via process_creation)

This rule detects the contents of /etc/shadow being read and piped to a bash /dev/tcp network socket, the password-hash exfiltration example from Red Canary's Linux detection guide. Combining access to the credential store with a raw network channel is an unambiguous attempt to steal hashes for offline cracking.

Suspicious Netcat Reverse Shell via Named Pipe on Linux via Process Creation (via process_creation)

This rule detects the classic Linux netcat reverse shell built on a FIFO created with mknod, the interactive shell technique Red Canary covers in its detection engineer guide to Linux. Chaining a named pipe with netcat backconnects a shell to an attacker while avoiding the need for a netcat build that supports the exec flag.

Suspicious Shell Profile Persistence Injection with Downloader

This rule detects a command that appends content to a user shell profile such as bashrc profile or zshrc while also invoking a downloader like curl or wget. TuxBot v3 injects its loader into these startup files so the bot re-launches on every interactive login. Detecting the profile append with a fetch command reveals shell initialization persistence used by the botnet.

Suspicious Execution of PAN-OS Captive Portal Implant Binaries (via process_creation)

This rule detects execution of implant binaries dropped during exploitation of the PAN-OS Captive Portal zero-day, staged under /var/tmp as linuxap, linuxda, or linuxupdate. These files provide attacker foothold and follow-on tooling on the compromised firewall.

Malicious Payload Download From copy.fail Exploit Host on Linux (via process_creation)

This rule detects curl or wget retrieving content from the copy.fail exploit host used in CVE-2026-31431 Copy Fail attacks. The downloaded exploit is followed by su-based privilege escalation to root on the compromised Linux system.

Suspicious su Execution From Uncommon Parent Process on Linux (via process_creation)

This rule detects the su binary being launched by a parent process that is not a common interactive shell or sudo, a privilege-escalation pattern tied to CVE-2026-31431 Copy Fail exploitation. Attackers invoke su from non-shell contexts to elevate to root after gaining initial code execution.