Sigma detection rules, expert-reviewed

Malicious JSP Webshell Deployment in Ivanti EPMM Tomcat (via file_event)

This rule detects creation of JSP files under the Ivanti EPMM Tomcat mifs webapps directory, where exploitation of CVE-2026-1281 and CVE-2026-1340 plants webshells such as 401.jsp and 403.jsp. A webshell in this application path gives attackers persistent authenticated command execution on the appliance.

Malicious EtherRAT SSH authorized_keys Backdoor Injection via Shell (via process_creation)

This rule detects the injection of an SSH public key carrying the root@vps identifier into an authorized_keys file on Linux hosts. This activity is performed by the EtherRAT React2Shell implant to establish persistent root access over SSH. Writing an attacker controlled key into authorized_keys grants durable remote access and should be treated as a compromise.

Malicious TeamPCP systemd User Unit Dropper via sysmon.py Persistence (via file_event)

This rule detects creation of a Python dropper named sysmon.py inside the per-user systemd unit directory which the TeamPCP compromise of Trivy writes on developer machines to gain persistent execution. The dropper polls an attacker C2 and downloads a follow-on payload so its presence indicates an active supply-chain implant that harvests cloud and SSH credentials.

Malicious TeamPCP durabletask Payload python3 managed.pyz from tmp (via process_creation)

This rule detects execution of python3 against /tmp/managed.pyz which is the primary payload dropped by the trojanized durabletask PyPI releases from the TeamPCP campaign. Running a zipapp from /tmp under python3 in this exact form indicates the supply-chain implant is active and harvesting cloud and Kubernetes credentials.

Suspicious Access to Cloud and Database Credential Files via Process

This rule detects command lines reading AWS credential and PostgreSQL password files that an LLM-driven attacker harvested after gaining marimo RCE to pivot toward an internal database. Reading these unattended credential stores is a common post-exploitation credential-access step. Access outside of expected tooling indicates credential theft in progress.

Suspicious Kubernetes Service Account Token Generation via kubectl

This rule detects the use of kubectl create token to mint a service account token which attackers abuse after compromising an Amazon EKS node to impersonate service accounts and pivot from the Kubernetes cluster into the connected cloud account.

Suspicious Python Startup .pth File Creation for Interpreter Persistence

This rule detects creation of the litellm_init.pth Python path-configuration file. The LiteLLM supply-chain attack abused a .pth file that Python auto-executes at interpreter startup to run attacker code whenever the environment is used as documented by Kaspersky. A malicious .pth dropped into a site-packages directory grants stealthy persistence tied to every Python invocation.

Suspicious Remote Script Execution via Wget or Curl Piped to Shell (via process_creation)

This rule detects downloading a remote script and piping it directly into a shell, an execution technique observed in attacks against Kubernetes environments to run attacker tooling on compromised nodes. Fetching and executing code in a single command leaves no script on disk and is a common initial execution pattern following container compromise.

Suspicious Crontab Removal via Command Line (via process_creation)

This rule detects use of crontab with the remove flag to wipe scheduled jobs, a cleanup action performed by the Tox based coinminer to erase competing tasks and its own traces. Clearing the crontab helps the miner evade cleanup and hide indicators of prior activity.

Malicious DeadBolt Ransomware Note and Encrypted File Artifacts

This rule detects the creation of the DeadBolt ransom note or files bearing the .deadbolt extension which mark encrypted data on compromised QNAP network attached storage devices. The note and extension appear as the ransomware finishes encrypting shares. It is important because their presence confirms an active DeadBolt impact event requiring immediate response.

Possible Cryptomining Beacon to c3pool Mining Domain

This rule detects DNS lookups for the c3pool mining pool domain used by the cryptominer dropped after SSTI exploitation in this research. Enterprise systems have no reason to resolve public mining pool infrastructure. Detecting the query surfaces resource hijacking following the web compromise.

Malicious Bash Dev-TCP Reverse Shell via Shell (via process_creation)

This rule detects an interactive bash shell redirecting input and output through a /dev/tcp network socket on Linux hosts. This reverse shell technique was used by the marimo blockchain botnet campaign to obtain interactive access after exploitation. Bash reverse shells over /dev/tcp are almost never legitimate and indicate hands on access.

Obfuscated Base64-Decoded Payload Piped to a Shell (via process_creation)

This rule detects a base64 decode operation piped directly into bash, sh or eval, a one-liner adversaries use to reconstruct and immediately run an obfuscated payload on Linux. Base64 deobfuscation into a shell is a defense-evasion and execution technique in the Red Canary Threat Detection Report. Detecting the decode-and-execute chain surfaces hidden command execution as it runs.

FireWood Backdoor Persistence Files in Hidden kde-root Directory (via file_event)

This rule detects creation of the FireWood backdoor working files inside a hidden .kde-root directory, where the Linux implant stores its loader and PID artifacts under either a system library path or a user home directory. The masquerade as KDE runtime files combined with the hidden directory reflects the backdoor establishing itself on the host.

Suspicious File Immutability Manipulation via chattr

This rule detects use of chattr to set or clear the immutable attribute on files, an anti-removal technique used by Kinsing and similar Log4Shell payloads to protect malicious binaries and persistence entries from deletion. Setting the immutable bit prevents defenders and cleanup tooling from removing the implanted files.