Sigma detection rules, expert-reviewed

Malicious BRICKSTORM Backdoor Execution via Masqueraded Binary Path

This rule detects execution of the BRICKSTORM backdoor from masqueraded system paths used by the VerdantBamboo intrusion set. The malware was deployed as /usr/sbin/luserput and as a blacklist binary under the IPSec libexec directory on pfSense firewalls to blend with legitimate appliance components. Detecting these hardcoded drop locations exposes an active foothold on network edge devices used for long-term espionage.

Malicious Reverse Shell Spawned by Web Server User (via process_creation)

This rule detects the web server account www-data launching an interactive reverse shell, as seen in the compromised-container forensics case following web application exploitation. A shell with a network redirect running as the web user indicates active remote control. This behavior is rarely legitimate for a service account.

Suspicious DERO Cryptojacking Dropper Script Execution

This rule detects execution of the ddns.sh dropper script associated with the DERO cryptojacking campaign. Wiz Research observed this script deployed through malicious Kubernetes deployments to fetch and launch the miner, so references to it indicate an ingress tool transfer and staging on a compromised node.

Suspicious Payload Execution From systemd-private Temporary Directory on Linux

This rule detects a process executing from the per-service private temporary path /tmp/systemd-private- which Wiz observed attackers abusing to hide XMRig Sliver and Mirai payloads after exploiting the Aviatrix Controller RCE CVE-2024-50603. This is important because binaries running out of a systemd private tmp namespace are almost always malware staged to evade detection so execution from this location signals post-exploitation deployment of miners and implants.

Malicious Userland Rootkit Persistence via ld.so.preload on Linux

This rule detects writing to /etc/ld.so.preload to load a malicious shared object which the TeamTNT Doppelganger campaign uses to deploy the libprocesshider rootkit that hooks readdir to hide attacker mining and backdoor processes from process listings.

Suspicious MeshCentral Remote Command Execution via meshctrl (via process_creation)

This rule detects the MeshCentral meshctrl controller invoking RunCommand, the mechanism ShinyHunters used to push a fanout shell script to compromised PeopleSoft hosts in the education sector campaign. Adversaries abuse remote management platforms like MeshCentral to execute commands at scale across an estate, so controller-driven command execution should be validated against authorized administration.

Malicious C2 Download Embedding Host Reconnaissance in URL

This rule detects wget or curl fetching a URL that embeds command substitution such as the current username, a beaconing pattern where the backdoor reports host context to its C2 while retrieving the next stage. Encoding whoami output into the request lets the operator track and profile infected hosts.

Malicious Backdoored liblzma XZ Utils Library File via file_event

This rule detects the creation of the backdoored liblzma shared object versions 5.6.0 and 5.6.1 associated with the XZ Utils supply chain compromise (CVE-2024-3094). The implanted library hooks the OpenSSH authentication routine to allow remote unauthenticated access. Presence of these specific library versions on a host indicates a compromised software supply chain requiring immediate remediation.

Malicious WordPress Webshell session-manager PHP in mu-plugins

This rule detects creation of a session-manager.php file inside the WordPress must use plugins directory. ErrTraffic deploys this file as a persistent server side backdoor on compromised WordPress installations. A PHP file named session-manager.php dropped into mu-plugins is characteristic of this web shell and rarely legitimate.

Suspicious Shai-Hulud Worm Stager Execution from Temp (via process_creation)

This rule detects execution of the processor.sh or migrate-repos.sh shell scripts from the tmp directory used by the Shai-Hulud npm supply-chain worm. These stagers harvest cloud and repository credentials then drive self-propagation by republishing infected packages. Running these named scripts out of tmp is a direct indicator of the worm on a developer or build host.

Suspicious Deletion of System Logs Under var log on Linux Appliance

This rule detects shell commands that remove or truncate files under the /var/log directory, the anti-forensic behavior seen after Cisco SD-WAN exploitation to erase authentication and system logs. Clearing /var/log destroys evidence of intrusion and hides the addition of rogue peers or SSH keys. Deleting log files on an appliance is not part of normal operation.

Suspicious prt-scan Campaign Credential Harvesting via proc environ Scan (via process_creation)

This rule detects processes reading other processes environment blocks through /proc/*/environ which the prt-scan background daemon uses to sweep memory for AWS Cloudflare Netlify and NPM tokens on CI runners. Broad scanning of /proc environ files is uncommon in normal build activity and suggests credential harvesting.

Malicious kagent RAT Delivery via HuggingFace Space Download (via process_creation)

This rule detects a shell downloading and executing an installer script hosted on a HuggingFace Space on Linux hosts. The marimo blockchain botnet campaign delivered the kagent NKN based remote access trojan through an install-linux.sh script pulled from a HuggingFace Space domain. Piping a remote Space installer into a shell indicates malware delivery.

Malicious TCP Session Hijacking via rshijack

This rule detects execution of the rshijack tool used to inject data into established TCP sessions. Wiz Research observed rshijack abused inside a shared Replicate environment to hijack traffic to a central Redis instance, so its use strongly indicates adversary in the middle or lateral movement activity.

Malicious Koske DNS Configuration Locking via chattr (via process_creation)

This rule detects the Koske malware hardening its hijacked DNS configuration by overwriting /etc/resolv.conf with attacker chosen resolvers and then setting the immutable attribute with chattr. Locking resolv.conf prevents defenders and legitimate services from restoring name resolution. This behavior is rare on production Linux hosts.