Sigma detection rules, expert-reviewed

Suspicious Reverse Shell via socat EXEC Redirection

This rule detects socat invoked with an EXEC or SYSTEM redirection to a shell, a reverse shell pattern shown in Elastic Linux persistence research. Attackers pair a socat TCP endpoint with EXEC to pipe an interactive shell back to a listener for command and control. Socat spawning a shell process is uncommon in normal administration and points to remote-access tooling.

Malicious Process Memory Injection via dd Write to /proc/pid/mem by UNC3886 (via process_creation)

This rule detects the dd utility writing to a process memory file under /proc, the injection primitive UNC3886 used to load TINYSHELL backdoors into legitimate processes on Junos OS routers. Direct writes to another process memory are a strong indicator of code injection and defense evasion.

Malicious Interactive Reverse Shell on Linux (via process_creation)

This rule detects Linux command lines that establish an interactive reverse shell, including bash redirection to /dev/tcp, netcat with command execution, or a named-pipe backpipe. Reverse shells are a common execution and command-and-control behavior across the Linux intrusions summarized in the Red Canary Threat Detection Report. Detecting these constructs surfaces hands-on-keyboard access to the host.

Suspicious Cron Persistence File Created in System Cron Directories

This rule detects creation of a file named 0anacron inside the system cron directories which the DripDropper Linux malware uses to masquerade as a trusted periodic job and establish scheduled task persistence. Placing a script among legitimate cron jobs lets the malware re execute and survive reboots. Detecting this file write surfaces persistence establishment on compromised Linux hosts.

Linux Process Execution of Python Base64 Decode One-Liners

Alerts on Linux process creations running Python -c one-liners that import base64 and invoke decoding functions.

Linux setcap sets cap_setuid on a binary via setcap utility

Alerts on Linux executions of setcap configuring cap_setuid on a binary, indicating potential identity-manipulation and persistence risk.

Linux setcap sets cap_setgid on binaries (Setgid capability assignment)

Flags Linux setcap commands that set cap_setgid on binaries via process creation logs.

Linux Script Interpreters Spawning Credential Scanners (trufflehog, gitleaks)

Flags Linux cases where node or bun processes launch trufflehog or gitleaks to search for secrets.

Linux File Creation: Filename Contains Embedded Base64 Bash Fragments

Alerts on Linux file events for filenames that appear to embed Base64-decoding bash command patterns.

Kaspersky Endpoint Security Service Stopped via Command Line on Linux

Flags Linux commands using systemctl/bash/sh to stop Kaspersky (kesl) services, suggesting defense impairment or manual service shutdown.

Linux systemctl Mask Power Targets to Disable Suspend, Hibernate, Hybrid Sleep

Flags systemctl mask commands targeting suspend/hibernate/hybrid-sleep power management targets.

Linux Python CLI Web Server Execution via http.server or SimpleHTTPServer

Flags Linux processes running Python’s built-in HTTP server modules via command line.

Linux auditctl -D used to delete all audit rules

Flags auditctl -D executions that delete all audit rules and watchers on Linux.

Linux sudo --chroot Command Execution

Identifies Linux executions of sudo with chroot-related options ("--chroot" or "-R") via process creation command-line telemetry.

Linux Process Execution of TruffleHog with Secret-Scanning Platforms

Flags Linux execution of TruffleHog when command lines reference common source platforms and cloud targets.