Sigma detection rules, expert-reviewed

Linux Suspicious Reverse Shell Command-Line Execution Patterns

Alerts on Linux command lines containing reverse-shell-style strings such as /dev/tcp redirections, netcat pipes, and socket connect patterns.

Linux syslog: Detect suspicious BIND/named error messages

Alerts on Linux syslog messages with BIND named fatal or denied DNS error strings.

Linux Auditd: Program Executions from Suspicious Web and Data Directories

Alerts on Linux process creation when the executed binary path begins with commonly abused temp/web/data directories.

Linux auditd: Executing suspicious chmod and cp commands

Triggers on auditd EXECVE events for chmod (777/u+s) and cp overwriting /bin/ksh or /bin/sh.

Linux JexBoss Suspicious Bash Command Launch with /dev/tcp

Flags Linux executions containing bash -c /bin/bash paired with /dev/tcp/ indicative of a reverse-shell command sequence.

Linux Suspicious Shell Command Lines for Exploit/Payload Delivery

Detects Linux command-line strings matching wget/piping, payload staging, permission changes, and socat/HTTP server execution patterns.

Linux VSFTPD Logs: Suspicious Error Messages Indicating Possible Exploitation Attempts

Looks for specific vsftpd error strings that may indicate exploitation-triggered faults or abnormal request handling.

Linux SSHD Logs: Suspicious OpenSSH Daemon Error Keywords

Alerts on sshd log entries with specific OpenSSH fatal or cryptographic error messages indicating suspicious access attempts.

Linux Command-Line Indicators of Equation Group Tooling

Flags execution of known suspicious Linux shell command patterns tied to Equation Group-style scripting and tooling.

Linux Log File Alerts for Suspicious Messages

Generates alerts when Linux log text contains suspicious keywords indicating possible network, service, or logging disruption.

Linux Log Shellshock Expression Pattern Matching

Identifies Shellshock-style function-body expressions in Linux log data via keyword string matches.

Linux Syslog Buffer Overflow Exploit Attempt Keywords

Alerts on Linux syslog entries containing known buffer overflow/stack-smashing attempt keyword patterns.

Linux ClamAV alerts for Trojan, Webshell, Rootkit, Htran, VirTool detections

Detects ClamAV log entries with keyword-based indicators for Trojans, webshells, rootkits, and Htran.