Sigma detection rules, expert-reviewed

Suspicious Execution From var tmp Masquerading as apt via GRIDTIDE

This rule detects a binary named xapt executing from the var tmp directory as used by the GRIDTIDE espionage campaign to masquerade as the legitimate apt package manager. Attackers run this payload with root privileges to spawn shells and establish backdoor access.

Possible SSTI Remote Command Execution from Web Application Process

This rule detects a web application runtime spawning reconnaissance or download shell commands, the hallmark of server side template injection reaching remote code execution. Template engines such as Jinja2 or FreeMarker are abused to run os.popen against system utilities. Detecting the abnormal child process exposes exploitation of the exposed web application.

Suspicious Botnet Payload Drop to Hidden Xdiag Temp Path

This rule detects references to the hidden staging directory /tmp/.xdiag and the /tmp/httpd artifact used to drop React2Shell follow-on payloads. Attackers stage Mirai and Gafgyt mipsel botnet binaries in these locations after exploiting affected hosts for command-and-control enrollment.

Suspicious Process Argv0 Masquerade As Kernel Worker via GSOCKET

This rule detects a process launched with an argv0 spoofed to resemble a kernel worker thread such as a bracketed raid5wq name which the GSOCKET tooling uses to hide its reverse connectivity on Linux hosts. Adversaries masquerade as kernel threads to blend into process listings and evade casual inspection.

APT28 httd Implant Persistence via systemd linux.service from Boot Directory (via process_creation)

This rule detects systemctl enabling a service named linux.service, the systemd persistence behavior used by the APT28 httd Linux implant staged from the boot directory in Operation Roundish. Adversaries leverage a generically named systemd unit to survive reboots on compromised mail servers.

Malicious Kernel Module Loaded From a User-Writable Path on Linux (via process_creation)

This rule detects insmod loading a kernel module (.ko) from a temporary or user-writable directory, an indicator of a loadable-kernel-module rootkit being installed rather than a package-managed driver. Kernel module abuse is a stealthy Linux persistence and defense-evasion technique referenced in the Red Canary Threat Detection Report. Because legitimate drivers load from system paths, module loads from user paths are a strong indicator of malicious activity.

Suspicious PAN-OS Shell Execution Setting panusername via Command Injection (via process_creation)

This rule detects command injection on Palo Alto PAN-OS CVE-2024-9474 where the injected user value spawns a shell that exports the panusername and superuser variables and pulls attacker content. The panusername export inside a shell command line is highly abnormal.

Suspicious SELinux Policy Module Loading to Whitelist Linux Implant (via process_creation)

This rule detects use of audit2allow to build a custom SELinux module and semodule to load it, the defense-evasion behavior APT28 used in Operation Roundish to permit its implant under SELinux. Adversaries leverage generated policy modules to silence SELinux denials that would otherwise block malicious activity.

Malicious Webshell Written to Citrix NetScaler VPN Theme Directory (via file_event)

This rule detects the post-exploitation stage of Citrix NetScaler CVE-2026-8452 where a php webshell is dropped into the vpn theme directory after a pre-auth heap overflow. A php file in this template directory indicates appliance compromise.

Malicious Simps Botnet Infection Marker File Creation (via file_event)

This rule detects creation of the keksec.infected.you.log marker file dropped by the Simps botnet to flag a compromised host. The presence of this Keksec group artifact indicates the device has been enrolled into Mirai and Gafgyt based DDoS operations.

Malicious Viper C2 Installation via f8x One-Liner Setup Script (via process_creation)

This rule detects execution of the f8x offensive setup script used by the You Dun group to deploy Viper command-and-control tooling on Linux staging hosts, invoked through bash with flags such as -viper or -all. The f8x helper is an attacker-specific installer for red-team infrastructure, so its execution on a server is a high-confidence indicator of adversary tooling being stood up rather than legitimate administration.

Suspicious Clearing of System Logs on Linux (via process_creation)

This rule detects commands that delete or truncate files under /var/log, an indicator-removal technique used to erase evidence of intrusion on Linux hosts. Clearing system logs is tracked in the Red Canary Threat Detection Report. Detecting this activity surfaces anti-forensic log destruction.

Malicious Linux Cryptominer Masquerading as systemd-logind via var tmp Execution

This rule detects a process executing from /var/tmp/systemd-logind, a Linux cryptominer masquerading as the legitimate systemd-logind daemon which normally runs from /usr/lib/systemd. It was observed in a Huntress-investigated intrusion where a Monero miner beaconed to a mining pool over port 443. Execution of a trusted daemon name from a world-writable temporary directory indicates resource-hijacking malware attempting to evade casual process review.

Suspicious Shell Spawned by PostgreSQL Server via COPY FROM PROGRAM on Linux

This rule detects a PostgreSQL server process spawning a command shell which indicates abuse of the COPY FROM PROGRAM feature for arbitrary command execution as used by the DreamBus botnet after brute-forcing weak database credentials. A database engine launching a shell is not normal behavior and points to post-authentication remote code execution.

Malicious VoidLink Fileless Execution via memfd via Memory (via process_creation)

This rule detects processes executing from an anonymous in-memory file descriptor on Linux hosts. The VoidLink rootkit loader uses memfd_create and execveat to run its payload entirely from memory without touching disk. Execution backed by a memfd path is a strong indicator of fileless malware staging.