Sigma detection rules, expert-reviewed

Malicious Disabling of Huntress Updater via systemctl Stop

This rule detects systemctl being used to stop the huntress-updater service, an anti-forensic and defense-evasion action observed in a Huntress Linux intrusion where the actor disabled the security agent before continuing cryptomining. Stopping the endpoint agent blinds detection and prevents updates. Targeted termination of a named security service by an attacker is high-confidence malicious activity.

Suspicious Local Account Creation on Linux (via process_creation)

This rule detects useradd or adduser execution or a direct append to /etc/passwd, an account-creation technique attackers use to plant a durable local login on a compromised Linux host. Creating a rogue local account is a persistence technique tracked in the Red Canary Threat Detection Report. Detecting it surfaces a new attacker-controlled account.

Suspicious Exposed Ollama API Service Connection

This rule detects network connections to the default Ollama LLM service port, exposure that attackers abuse to hijack local AI inference in the evolved LLMjacking campaign. An internet-reachable Ollama endpoint allows unauthenticated model access and resource theft. Connections from untrusted sources to this port warrant review of the exposed service.

Possible CopyFail Root Exploitation via Python Spawning SUID Shell (via process_creation)

This rule detects a Python interpreter spawning a shell that invokes SUID privileged binaries, a behavior consistent with exploitation of the CopyFail vulnerability to gain root on modern Linux distributions. The child shell abuses setuid utilities to elevate an unprivileged process. Detecting this chain surfaces local privilege escalation attempts.

Suspicious Bootkitty Rootkit Component Drop under opt via File System

This rule detects creation of the Bootkitty user-space and kernel components /opt/injector.so, /opt/observer, and /opt/rootkit_loader.ko. These fixed paths are dropped by the first known UEFI bootkit for Linux to load a kernel module and inject a shared object through the boot process. Their presence indicates a UEFI bootkit compromise.

Malicious Panamorfi DDoS JAR Execution via Java (via process_creation)

This rule detects the Panamorfi campaign running its Java payloads conn.jar and mineping.jar after compromising an exposed Jupyter notebook. conn.jar connects to a Discord channel for command and control while mineping.jar launches TCP flood denial of service attacks. These jar names are unique to the campaign.

Masquerading Systemd Service Masquerade via Systemctl Reenable of rsyslogd (via process_creation)

This rule detects systemctl reenabling a service named rsyslogd, the persistence behavior of the Kimsuky Gomir variant that installs a malicious rsyslogd service to impersonate the legitimate rsyslog logging daemon. Adversaries leverage the trailing d suffix to blend with real system services while ensuring the implant restarts, making early detection critical for surfacing masqueraded persistence before further intrusion activity.

Suspicious Kubernetes Secret Enumeration via kubectl

This rule detects kubectl commands that list or read Kubernetes secrets. Wiz Research observed attackers who gained code execution in a pod running kubectl get secrets to harvest cluster credentials, so secret enumeration from unexpected contexts can signal credential access and lateral movement preparation.

Suspicious Double Base64 Decoded Payload Piped to Shell in CI (reviewdog Supply Chain)

This rule detects a base64 decoded payload being piped directly into a shell, the execution pattern of the injected reviewdog/action-setup install.sh that dumped CI runner memory. It matters because decode into shell in a build step is a common way supply chain payloads execute credential theft code without touching disk.

Suspicious SSH Daemon Spawning Shell via xz Backdoor (via process_creation)

This rule detects the SSH daemon spawning an interactive shell without an intervening login shell, a behavior associated with the xz-utils supply chain backdoor CVE-2024-3094. Observed in Elastic Security Labs live malware lab telemetry where sshd directly launching sh or bash signals unauthenticated command execution enabling remote access.

Malicious Mini Shai-Hulud gh-token-monitor Persistence Service (via file_event)

This rule detects creation of the gh-token-monitor LaunchAgent plist or systemd user service dropped by the Mini Shai-Hulud TanStack npm compromise to poll for GitHub tokens every 60 seconds. This fixed persistence artifact indicates the trojanized package has installed its credential-monitoring daemon.

Malicious TeamTNT Silentbob Cryptominer Setup Script Execution (via process_creation)

This rule detects execution of the setup_c3pool_miner.sh script that the TeamTNT Silentbob campaign drops inside compromised containers to install a Monero cryptominer after discovering misconfigured Docker APIs and JupyterLab instances. Deployment of this miner setup script on a server workload indicates cryptojacking.

Suspicious perfctl Hidden IPC Directory Creation in tmp (via file_event)

This rule detects the perfctl malware creating its hidden inter process communication directory /tmp/.xdiag which holds a Unix socket and state files such as the victim IP, event log and TOR data. The hidden dot prefixed directory under tmp is used to coordinate the cryptominer and rootkit and is unique to this threat.

Malicious UNC4841 SSH Backdoor Persistence via Non-Standard Port and AllowUsers Restriction (via process_creation)

This rule detects an sshd process being launched on a high non-standard port while restricting logins to a hardcoded attacker account through the -oAllowUsers option. UNC4841 used this technique to maintain covert SSH access to compromised Barracuda ESG appliances following CVE-2023-2868 exploitation. Establishing a dedicated backdoor listener scoped to a single attacker user provides resilient remote access that blends with legitimate SSH traffic.

Suspicious Kernel Module Load via insmod on Linux (via process_creation)

This rule detects insmod being used to load a kernel object module on Linux, a technique attackers use to install rootkits at the kernel level. Loadable kernel module rootkits hide processes, files, and network activity from userland tooling. Detecting insmod of a .ko module surfaces potential kernel-mode persistence and evasion.