Sigma detection rules, expert-reviewed

Suspicious Shell History Anti-Forensics via HISTFILE Manipulation

This rule detects commands that unset or redirect the shell history file to prevent command logging which the freenode Linux backdoor operators use to hide activity. Observed in NCC Group research analyzing the Linux backdoor from the freenode IRC network compromise. Disabling shell history is an anti-forensic behavior commonly seen in hands-on-keyboard intrusions.

Malicious Kubernetes Node Escape via chroot to Node kubectl Path

This rule detects a chroot into the node-local kubectl directory used on managed Kubernetes nodes, a container-to-node escape technique observed in real-world cluster attacks after landing in a privileged pod. Breaking out to the node host filesystem gives the attacker control over the worker node and any credentials stored on it.

Possible Kubernetes Service Account Token Theft from Pod Secrets Path

This rule detects a process referencing the in-pod service-account secrets directory where Kubernetes mounts the projected token, ca certificate and namespace, a credential-access step observed in real-world cluster attacks. Reading this token lets an attacker authenticate to the Kubernetes API as the pod identity and expand access across the cluster.

Suspicious Kubernetes Pod Deployment with Privileged or Host Namespace Flags

This rule detects on-the-fly creation of Kubernetes pods running tooling such as busybox or socat with privileged, host-PID or host-path options, a container-escape and pivot technique seen in real-world cluster attacks. Launching a privileged pod that mounts the node filesystem lets an attacker break out of the container onto the underlying host.

Suspicious Kubernetes Permission Enumeration via kubectl auth can-i

This rule detects use of kubectl to enumerate the caller permissions in a cluster by listing all allowed actions, a post-compromise reconnaissance step observed in real-world Kubernetes intrusions after remote code execution in a pod. Attackers use this to map the reach of a stolen service-account token before attempting privilege escalation or lateral movement.

Possible Shellshock Bash Function Definition Injection via Process Creation

This rule detects the Shellshock (CVE-2014-6271) exploitation pattern where an attacker injects a Bash environment-variable function definition prefix into a command line. Captured in NCC Group research on the Shellshock Bash vulnerability targeting CGI endpoints. Exploiting this flaw yields unauthenticated remote code execution which makes early detection of the injection prefix important.

Malicious React Server Component RCE via Node Web Process Spawning Shell (via process_creation)

This rule detects a Node.js or Next.js server process spawning a shell that runs reconnaissance or download commands such as whoami, curl, or wget, the exploitation pattern for the CVE-2025-55182 React2Shell flaw in React Server Components. Adversaries trigger this to gain remote code execution on internet-facing servers before dropping miners and RATs, making the web-process-to-shell chain an early signal of active exploitation.

Suspicious Remote Payload Download Piped to Shell on Linux (via process_creation)

This rule detects curl or wget downloads piped directly into a shell interpreter. Attackers exploiting OpenMetadata used this pattern to retrieve and execute a cryptominer without writing an intermediate file.

Malicious Reverse Shell via Netcat or Shell Redirection on Linux (via process_creation)

This rule detects Netcat invoked with a command execution flag or a bash dev tcp redirection used to establish an interactive reverse shell. Attackers exploiting OpenMetadata used these techniques for hands-on access to compromised Kubernetes workloads.

Suspicious OpenMetadata Exploit Interactsh OAST Callback (via process_creation)

This rule detects processes invoking Interactsh out-of-band domains such as oast.me and oast.pro. Attackers exploiting critical OpenMetadata vulnerabilities on Kubernetes used these callbacks to confirm remote code execution before deploying a cryptominer.

Malicious Linux systemd Persistence nvmconf.service

This rule detects creation of a systemd unit named nvmconf.service, the Linux persistence installed by the Mastra npm supply chain compromise. The service masquerades as Node version manager configuration to relaunch the malicious payload across reboots.

Suspicious GCP Metadata Service Token Access via Command Line (via process_creation)

This rule detects a command line that queries the GCP metadata service compute endpoint for a service account access token, the action used to steal cloud credentials after achieving code execution in an exposed Cloud Function. Adversaries harvest the default service account token to pivot into the wider cloud project, so metadata token retrieval from a runtime process is a high-value credential access indicator.

Malicious Switch User to Rogue Root-Equivalent Account troot (via process_creation)

This rule detects a switch-user operation targeting the troot account, the uid 0 backdoor account injected into /etc/passwd and /etc/shadow during exploitation of Cisco Catalyst SD-WAN Manager. Adversaries create and then assume this masqueraded root-equivalent account to maintain privileged access, so an su to troot is a strong sign of post-exploitation activity.

Malicious Cisco SD-WAN Tenant List Upload Script Execution (via process_creation)

This rule detects execution of the vconfd_script_upload_tenant_list.sh helper script recorded during exploitation of Cisco Catalyst SD-WAN Manager (CVE-2026-20245), where the crafted tenant CSV was processed to append a rogue root account to system files. Adversaries trigger this internal script as part of the privilege escalation chain, so its appearance in logs indicates the vulnerability was exercised.

Possible Cisco Catalyst SD-WAN Manager Tenant Upload Exploitation CVE-2026-20245 (via process_creation)

This rule detects the tenant-upload tenant-list request pattern used to exploit CVE-2026-20245 in Cisco Catalyst SD-WAN Manager, where a crafted tenant CSV was uploaded to inject a privileged account into the appliance. Adversaries leverage this zero-day to gain root-level control of the management plane, so this request signature is a high-value indicator of active exploitation.