Sigma detection rules, expert-reviewed

Linux auditd alerts on syslog daemon configuration file changes

Alerts when syslog daemon configuration files are changed on a Linux host via auditd PATH events.

Linux auditd: Monitor changes to /etc/audit, /etc/libaudit.conf, and /etc/audisp files

Flags modifications to Linux auditd configuration files that can weaken host auditing.

Linux: Detect Modification of /etc/ld.so.preload for Shared Object Injection

Flags auditd activity where /etc/ld.so.preload is modified, indicating potential shared object injection.

Linux auditd: dd overwrites a file using /dev/null or /dev/zero

Flags dd command lines that overwrite files by sourcing data from /dev/null or /dev/zero.

Linux System Owner or User Discovery via Common Utility Execution

Flags execution of Linux user/system identification utilities such as whoami and id.

Linux: Detect execution of tcpdump or tshark with interface (-i) capture option

Alerts on tcpdump or tshark executions on Linux where an interface flag is present, consistent with network sniffing.

Linux Masquerading via crond Path Using cp Launching /bin/sh

Alerts on Linux execve where cp runs through /bin/sh and the argument ends with /crond, indicating potential masquerading.

Linux Auditd: Command Execution of zip, gzip -k, or tar -c for Data Compression

Alerts on Linux execve events launching zip, gzip (-k), or tar create commands often used to compress data.

Linux auditd: Webshell Remote Command Execution via execve/execveat (euid=33)

Alerts on execve/execveat executions by the web server user, consistent with potential webshell command execution.

Linux Service Reload/Start via systemctl or service Command Execution

Identifies Linux process executions invoking service control commands with start or reload keywords.

Linux auditd: chmod/chown process execution indicating file or folder permission changes

Flags Linux EXECVE events running chmod or chown, which commonly correspond to file/folder permission changes.

Linux auditd: Detect chattr -i removing immutable file attribute

Flags Linux processes using chattr to remove the immutable (-i) file attribute via auditd execve telemetry.

Linux Command Lines Creating Symlink to /etc/passwd

Alerts on Linux command lines attempting to create symlinks to /etc/passwd via ln -s/ln -f patterns.

Linux Suspicious Reverse Shell Command-Line Execution Patterns

Alerts on Linux command lines containing reverse-shell-style strings such as /dev/tcp redirections, netcat pipes, and socket connect patterns.

Linux syslog: Detect suspicious BIND/named error messages

Alerts on Linux syslog messages with BIND named fatal or denied DNS error strings.