Sigma detection rules, expert-reviewed

Suspicious ESXi execInstalledOnly Disabled via esxcli During Ransomware

This rule detects esxcli disabling the execInstalledOnly enforcement setting on an ESXi host which ransomware crews do to allow unsigned binaries to run before encrypting virtual machines. Attackers weaken hypervisor integrity controls to deploy their locker at scale.

Suspicious iptables Port Redirect Rule via GRIMBOLT

This rule detects iptables creating a REDIRECT rule sending traffic from 443 to 10443 as used by UNC6201 GRIMBOLT for single packet authorization gated command and control. Attackers use this redirect to hide a backdoor listener behind a normally trusted port.

Malicious Reverse Shell Spawned from Oracle EBS Java Process

This rule detects an interactive bash reverse shell to /dev/tcp launched by a Java process running as the applmgr account, matching post-exploitation of the Oracle E-Business Suite zero-day. This gives the extortion actor command execution on the application server to stage the GOLDVEIN.JAVA C2 and exfiltrate data.

Suspicious Linux Persistence via sed Edit of Boot and Init Files

This rule detects sed performing an in-place edit of Linux boot and service files such as rc.local, init.d scripts and systemd units, matching BRICKSTORM persistence that injects the Go backdoor into system startup. Modifying these startup mechanisms ensures the espionage implant relaunches after reboot.

Malicious Bash Reverse Shell via /dev/tcp

This rule detects an interactive bash session redirecting its input and output to a /dev/tcp socket, matching the OVERSTEP dobackshell command that opens a reverse shell from a compromised SonicWall SMA appliance. This gives the operator hands-on-keyboard control to stage data theft and additional persistence.

Malicious Sed Tampering of Ivanti Debug and Audit Logs (via process_creation)

This rule detects sed being used to edit the Ivanti Connect Secure debuglog and audit.log files in place, the selective log tampering technique used during zero-day exploitation to remove evidence of PHASEJAM web shell activity. In-place editing of appliance logs indicates indicator removal by an intruder.

Malicious Rogue F5 BIG-IP Administrator Account Creation via tmsh (via process_creation)

This rule detects the F5 tmsh utility creating an authentication user with an administrator role. Initial access brokers exploiting F5 BIG-IP CVE-2023-46747 provisioned a rogue admin account to lock in privileged appliance control. Creation of a new admin-role user on a network appliance is a strong persistence and account-manipulation indicator.

Malicious Python Reverse Shell One-Liner Execution (via process_creation)

This rule detects Python invoked with an inline -c one-liner that opens a socket and duplicates its file descriptors onto a shell, the hallmark of a reverse shell. Actors targeting Ivanti Connect Secure used Python reverse shells for interactive access after exploitation. Inline socket-to-shell Python is a high-confidence remote-access indicator.

Malicious Ivanti Log Clearing via logClear Perl Script (via process_creation)

This rule detects execution of a logClear Perl utility used to selectively remove appliance log entries on compromised Ivanti Connect Secure devices. The actor ran this tooling to delete Integrity Checker and system events tied to their intrusion, frustrating forensic review. Purpose-built log-clearing tooling on an appliance is a clear indicator-removal action.

Suspicious Fake GIF Magic Header Written to Disguise Payload File (via process_creation)

This rule detects printf being used to write a GIF magic-byte header into a .gif file as a masquerading step. During Ivanti post-exploitation the actor prepended fake GIF headers so malicious content would pass as harmless image files. Manufacturing image magic bytes over shell is a deliberate file-type masquerading and obfuscation behavior.

Suspicious Base64 Decode Piped to Python Interpreter for In-Memory Execution (via process_creation)

This rule detects a shell command that decodes Base64 content and pipes it directly into a Python interpreter, often alongside an LD_LIBRARY_PATH override. During Ivanti Connect Secure exploitation the actor executed obfuscated Python payloads this way to run tooling without touching disk. Chaining base64 decoding into python is a common obfuscated in-memory execution pattern on Linux appliances.

Malicious UNC4841 Dropper Deployment to Boot Partition via mknod (via process_creation)

This rule detects the mknod utility being used to create files within the /boot/os_tools/ directory on Linux-based appliances. UNC4841 staged dropper components in this boot-partition path to survive appliance updates and reboots on compromised Barracuda ESG devices. Writing executable content into the boot partition is highly abnormal and indicates deliberate low-level persistence.

Suspicious systemd Service Persistence via GRIDTIDE xapt

This rule detects creation of a systemd unit file named xapt.service under etc systemd system as used by GRIDTIDE to persist its C backdoor. Attackers install this service so the xapt payload in usr sbin restarts automatically across reboots.

Malicious ld.so.preload Persistence Modification on Ivanti Connect Secure (via file_event)

This rule detects modification of /etc/ld.so.preload, the dynamic linker preload persistence mechanism abused during CVE-2025-22457 exploitation to auto-load the SPAWN family of implants into every process. Changes to ld.so.preload on an appliance grant stealthy systemwide code execution.

Malicious PHASEJAM Web Shell Written Into Ivanti CGI Endpoints (via file_event)

This rule detects modification of the Ivanti Connect Secure getComponent.cgi or restAuth.cgi files, into which the PHASEJAM web shell was injected during zero-day exploitation. Writes to these trusted CGI endpoints grant persistent remote command execution on the appliance.