Sigma detection rules, expert-reviewed

Suspicious Container Image Export via ctr in Cloud Model Exfiltration

This rule detects use of the containerd ctr client to export a container image to a local tar archive on a Kubernetes node. This behavior matches the ModeLeak attack against Vertex AI where an attacker abused a compromised service agent to pull and export proprietary LLM model images. Exporting images to disk is a precursor to staging and exfiltrating sensitive model or workload data from cloud tenants.

Suspicious Curl Download and Chmod Execute Chain on Linux (via process_creation)

This rule detects a shell command line that downloads a payload with curl and immediately makes it executable with chmod, the download-and-run staging chain Gleaming Pisces used to install PondRAT on Linux and macOS. Fetching and executing a remote binary in a single command is a common malware bootstrap and warrants review on servers.

Malicious Linux Payload Download and Execution Chain via Wget and Chmod (via process_creation)

This rule detects a shell command chain that fetches a binary with wget into tmp, grants it full execute permissions with chmod 777, and prepares it to run, the classic exploitation payload staging seen in the botnet scanning campaigns abusing Zyxel and Ivanti flaws. This download and execute sequence over a single command line reflects automated post exploitation rather than legitimate package management.

Malicious BlackCat Munchkin Controller Execution via process_creation

This rule detects the BlackCat Munchkin utility boot sequence that runs the /app/controller binary and then powers off the disposable Linux virtual machine. Munchkin executes its ransomware controller from this hardcoded path inside a throwaway VM to evade host defenses, so this command shape is a high-confidence indicator of Munchkin execution.

Malicious Systemd Service Masquerading as Sd-Pam Helper

This rule detects creation of a systemd unit file named sd-pam.service, a name TuxBot v3 borrows from the legitimate PAM session helper which is a binary and never ships as a service. The botnet installs this always-restart unit for resilient persistence on Linux and IoT hosts. Detecting the bogus service file exposes systemd persistence hiding behind a trusted system name.

Suspicious Python Path Configuration Hook Persistence (via file_event)

This rule detects creation of the litellm_init.pth Python path configuration file used in the TeamPCP supply chain attack to run code automatically when the interpreter starts. A .pth file with an import hook executes attacker code on every Python invocation, providing stealthy persistence within the software environment.

Suspicious Modification of PAM Authentication Module

This rule detects writes to the pam_unix.so authentication module under the security library directory. Telecom-focused intruders replace pam_unix.so with a backdoored version to harvest credentials and enable covert authentication. Modification of this PAM module outside package updates signals an authentication backdoor.

Malicious POOLRAT Backdoor Log File Creation (via file_event)

This rule detects creation of the file /tmp/xweb_log.md, the hardcoded error-log artifact written by the POOLRAT Linux backdoor deployed by Gleaming Pisces. This fixed path is unique to the implant and indicates the backdoor is running on the host.

Suspicious Cloudflare Quick Tunnel Used for Covert Access (via dns_query)

This rule detects DNS resolution of trycloudflare.com quick tunnel subdomains used in the TeamPCP supply chain attack to expose internal services and route command and control through Cloudflare infrastructure. Ephemeral tunnel domains provide attacker-controlled ingress that bypasses perimeter controls, so such lookups from servers warrant investigation.

Suspicious External Address Reconnaissance via curl to ifconfig me via process_creation

This rule detects external address reconnaissance from the compromised host where an operator curls ifconfig.me to learn the victim public IP after landing on the box. This egress check confirms outbound reachability and identity before establishing the reverse tunnel and file based C2. Automated querying of external IP echo services on a server is a common early intrusion discovery step.

Suspicious Reverse SSH Tunnel Exposing Local SSH via process_creation

This rule detects the reverse SSH tunnel used in the AI assisted intrusions where ssh -R forwards a remote listener back to the local SSH service to keep persistent inbound access through an attacker relay. Protocol tunneling over SSH lets operators bypass inbound firewall controls. Legitimate administrative reverse tunnels exist, so review the destination and account context when this fires.

Linux: System Shell Spawned by Celery Worker Python Process

Flags Linux instances where a Celery worker’s Python process spawns a system shell interpreter.

Suspicious F5 Appliance Reconnaissance Commands

This rule detects post exploitation reconnaissance commands run on an F5 appliance such as enumerating configuration files and locating the VERSION file as described in NCC Group RIFT F5 TMUI intelligence. Adversaries execute these commands after TMUI exploitation to fingerprint the device and its configuration before deploying webshells so these sequences on an appliance are suspicious.

Suspicious Access To Kubernetes Service Account Token File

This rule detects command line access to the mounted Kubernetes service account token path under var run secrets kubernetes io as described in NCC Group Kubernetes detection engineering research. Adversaries read this bearer token to impersonate the pod service account and authenticate to the API server for lateral movement and privilege escalation.

Suspicious Loading of Malicious Netfilter Kernel Module for Traffic Signaling

This rule detects loading of a rogue netfilter kernel module used by the freenode Linux backdoor to implement magic-packet traffic signaling. Observed in NCC Group research analyzing the Linux backdoor from the freenode IRC network compromise which installs an ipt_ip_udp module hooking PREROUTING. Rogue kernel modules that enable covert wake-on-packet backdoors are a strong indicator of rootkit activity.