Sigma detection rules, expert-reviewed

Possible Mirai IoT Payload Staging via chmod on Linux (via process_creation)

This rule detects chmod granting full 777 permissions to downloaded payloads in world-writable directories or files named after CPU architectures, a staging step used after exploiting CVE-2023-33538. This behavior precedes execution of Condi or Mirai IoT bot binaries dropped via wget on compromised routers.

Suspicious Python Base64 Encoded Command Execution (via process_creation)

This rule detects Python decoding and executing a base64-encoded payload inline, an execution technique used in the TeamPCP multi-stage supply chain attack on security infrastructure. Combining base64 decoding with dynamic exec obscures the executed code and is characteristic of staged malicious payloads rather than normal application behavior.

Suspicious ESXi Management Agent Stop via vpxa init Script (via process_creation)

This rule detects stopping the ESXi vpxa management agent through its init.d script, an evasion step in the RansomHouse MrAgent playbook that severs vCenter oversight before ransomware runs. Disabling vpxa blinds central management while the host is encrypted.

Malicious ESXi Firewall Disable via esxcli (via process_creation)

This rule detects the esxcli command that disables the ESXi host firewall, a defense-evasion action performed by the RansomHouse MrAgent tool before mass VM encryption. Turning off the hypervisor firewall opens management and lateral-movement paths ahead of the Mario ransomware deployment.

Malicious Reverse Shell via bash dev tcp Redirection (via process_creation)

This rule detects an interactive bash reverse shell that redirects a session over the /dev/tcp pseudo-device, delivered after exploitation of the React Server Components vulnerabilities. The one-liner opens a network socket back to the attacker for hands-on-keyboard control of the compromised server.

Malicious Command Injection Probe via node Spawning Shell Arithmetic Echo (via process_creation)

This rule detects a node process spawning /bin/sh to echo an arithmetic expression, the validation probe used when exploiting the React Server Components vulnerabilities CVE-2025-55182 and CVE-2025-66478. Attackers confirm remote command execution by evaluating a math expression through the injected shell before delivering payloads.

Suspicious GeoServer Java Process Spawning Download Utility

This rule detects a Java or shell process spawning wget or curl to fetch a payload from a port 8080 host. Attackers exploiting the GeoServer JXPath remote code execution flaw use Runtime.exec to pull stager scripts over HTTP. A web application process downloading from an atypical port indicates exploitation and payload retrieval.

Suspicious SSH Reverse Tunnel Over DNS Port

This rule detects the ssh client establishing a reverse tunnel bound to port 53. Actors compromising telecom providers route SSH reverse tunnels over the DNS port to evade egress filtering. A remote-forward SSH session using port 53 is highly abnormal and indicates covert tunneling.

Suspicious Timestomp via touch Reference Copy

This rule detects the touch command using the -r switch to copy timestamps from a reference file onto another file. Telecom network intruders timestomp their implants with touch -r so dropped files blend with legitimate system files. This behavior obscures the true creation time of attacker artifacts.

Malicious ld.so.preload Hijack Loading libcext by Auto-Color (via process_creation)

This rule detects modification of /etc/ld.so.preload to load libcext.so.2, the shared object used by the Auto-Color backdoor to hook libc functions and hide its network connections. This dynamic linker hijack provides rootkit-like concealment and persistence across all dynamically linked processes.

Malicious Container Escape via chroot to Host Mount

This rule detects a process invoking chroot into a mounted host filesystem path from within a privileged container. This behavior matches Dirty DAG where an attacker ran a privileged pod that mounted and chrooted into the underlying node to escape the container. Chrooting into a host mount is a definitive container escape technique granting node-level control.

Suspicious Azure WireServer Access via curl from Container

This rule detects command-line HTTP requests to the Azure host WireServer at 168.63.129.16 from a container or node. This behavior matches Dirty DAG where an attacker queried the Azure fabric and instance metadata to steal managed identity tokens. Direct curl or wget access to the WireServer address from workloads is anomalous and indicates cloud credential harvesting.

Suspicious Kubernetes Permission Enumeration via kubectl auth can-i

This rule detects enumeration of granted Kubernetes permissions via kubectl auth can-i --list. This behavior matches the Dirty DAG exploitation of Azure Data Factory Airflow where an attacker inside a compromised pod mapped its privileges before escalating. Permission enumeration from a workload context is an early reconnaissance step toward cluster takeover.

Malicious ESXi Syslog Redirection to tmp via esxcli

This rule detects reconfiguration of the ESXi syslog log directory to a volatile tmp location via esxcli. This behavior matches Akira ransomware operators targeting VMware ESXi who redirect logs to erase forensic evidence before encrypting virtual machines. Pointing syslog at tmp destroys audit trails and is a defense evasion step tied to hypervisor-level ransomware attacks.

Suspicious Kubernetes Enumeration via kubectl in Cloud Compromise

This rule detects cluster-wide pod enumeration via kubectl across all namespaces from a node or workload context. This behavior matches the ModeLeak reconnaissance phase where a compromised Vertex AI custom job used service agent credentials to map cluster resources. Broad cross-namespace enumeration from non-administrative contexts often precedes privilege escalation and lateral access to model artifacts.