Sigma detection rules, expert-reviewed

Malicious VoidLink Rootkit Dropper Artifacts via Filesystem (via file_event)

This rule detects the creation of VoidLink dropper artifacts prefixed with vl in temporary and shared memory directories on Linux hosts. The VoidLink rootkit stages its components as hidden vl_ files under /tmp and /dev/shm before loading its kernel module. Files matching this naming pattern indicate rootkit staging activity.

Suspicious Archive Staged in Web Accessible Directory via tar

This rule detects tar creating a compressed archive whose output path lands in the Ivanti EPMM web accessible directory as described by WithSecure where system files were archived to a public web path for retrieval. Staging collected data inside a web served directory is a hallmark of exfiltration over the same web channel used for initial access.

Suspicious Cron Job Downloading and Executing Payload via GlobalProtect Exploitation

This rule detects a malicious cron entry that uses wget piped to bash observed during exploitation of the GlobalProtect CVE-2024-3400 vulnerability. Attackers established persistence and staged tooling through /etc/cron.d/update. Download-and-execute cron jobs provide resilient footholds on compromised appliances.

Malicious Cloud Instance Metadata Credential Access via Command Line Tool on Linux

This rule detects curl or wget requesting the AWS instance metadata IAM security credentials endpoint which the TeamTNT Doppelganger credential stealer uses to harvest cloud role credentials from the IMDS for lateral movement into the victim AWS account.

Suspicious Linux PAM Module pam_unix Modification via file_event

This rule detects creation or modification of the pam_unix.so authentication module that malware replaces to log SSH passwords or accept a universal backdoor password. Unit 42 documented Linux malware tampering with pam_unix.so and related PAM shared objects to subvert authentication, so unexpected writes to this module warrant investigation.

Malicious Reverse Shell via socat

This rule detects socat spawning a shell over a TCP connection, a reverse-shell pattern used by the Outlaw Linux malware for remote access. socat invoked with both an EXEC or SYSTEM shell handler and a TCP endpoint is characteristic of interactive command-and-control rather than benign relaying.

Malicious PostgreSQL COPY FROM PROGRAM Command Execution via Managed Cloud Database (via process_creation)

This rule detects the PostgreSQL server process spawning a shell or command utility, the primitive Wiz Research abused through COPY FROM PROGRAM in GCP Cloud SQL and Azure Database for PostgreSQL to run operating-system commands and open reverse shells. Since the database engine should not launch interpreters, such child processes indicate exploitation of database privileges for code execution and container escape.

Suspicious Remote Script Download Piped to Shell via 8220 Gang Hadooken

This rule detects a curl or wget download whose output is piped directly into a shell interpreter, the download and execute pattern the 8220 gang schedules through cron every few minutes in the Hadooken campaign to pull and run its loader. Piping remote content into a shell removes any on disk staging and is a common Linux malware behavior. It is rarely required by legitimate automation.

Possible GTFOBins Shell Breakout via apt Command

This rule detects the apt or apt-get package manager spawning an interactive shell, a GTFOBins technique used to escape restricted shells or escalate privileges when apt runs under sudo. Package managers do not normally launch shells, so this parent-child relationship indicates a shell breakout attempt.

Suspicious XZ Utils Backdoor Kill-Switch Environment String via process_creation

This rule detects the hardcoded kill-switch string used by the XZ Utils liblzma backdoor (CVE-2024-3094) appearing in process command lines or environment variables. The backdoor checks for this specific token to disable itself, and its presence in telemetry indicates interaction with the implanted malicious code. Investigating hosts exhibiting this string helps identify systems affected by the supply chain attack.

Suspicious Kubernetes API Exposure via kubectl proxy

This rule detects kubectl proxy being launched with a listening port which exposes the Kubernetes API server through an unauthenticated local proxy. Wiz identifies this as a control plane initial access vector because the proxy forwards requests using the operator credentials without further authentication. This is important because binding the proxy to a reachable interface can hand full authenticated API access to anyone who can connect to that port.

Malicious Remote Script Execution via curl Piped to Shell

This rule detects curl downloading a remote script with insecure TLS and piping it directly into a shell, observed in a Huntress Linux intrusion where the actor fetched a worker script from an attacker host before deploying a cryptominer. The -k flag ignores certificate validation while the pipe executes the payload in memory without touching disk for review. Fetch-and-execute one-liners are a common initial staging technique for Linux malware.

Suspicious Systemd Service Masquerading as Sysmon (via file_event)

This rule detects creation of a systemd unit named sysmon.service, a masquerade used in the TeamPCP supply chain attack to disguise a persistence service as a monitoring agent. A systemd service impersonating Sysmon establishes boot persistence while blending in with expected security tooling.

Suspicious Renaming of System wget and curl Binaries (via process_creation)

This rule detects the system wget and curl binaries being renamed to wget_w and curl_c on QNAP and embedded devices. The PolarEdge QNAP backdoor relocates these download utilities to evade detection rules that watch the standard tool names while retaining download capability. Renaming trusted system binaries to these suffixed names is a defense evasion tactic specific to the implant.

Malicious Azure WireServer Access Impersonating WALinuxAgent (via process_creation)

This rule detects a process contacting the Azure WireServer host address while presenting the WALinuxAgent identity, a technique used in the ChaosDB walkthrough to steal certificates and goal-state data. A non-agent process impersonating the Linux guest agent to reach WireServer is a strong sign of credential theft. Legitimate agent traffic originates from the agent binary itself, not ad-hoc curl commands.