Sigma detection rules, expert-reviewed

Suspicious FortiManager Config Archive Written to /tmp/.tm During CVE-2024-47575 Exploitation (via file_event)

This rule detects creation of the hidden staging archive /tmp/.tm on FortiManager, where the CVE-2024-47575 exploitation flow collected managed device configuration data before exfiltration. A hidden archive in /tmp on an appliance indicates collection activity following exploitation.

Suspicious Python Execution of Fake Sysmon Script From Config Directory

This rule detects a Python interpreter executing a sysmon.py script from a hidden .config/sysmon directory on Linux. The LiteLLM AI gateway supply-chain implant masqueraded as a sysmon service under ~/.config/sysmon and installed systemd persistence as reported by Kaspersky. Reusing the Windows Sysmon name for a Linux Python script in a user config path is a masquerading indicator of the backdoor.

Suspicious Reconnaissance and Payload Download by Node Web Process

This rule detects a Node.js process spawning reconnaissance or download utilities such as whoami, wget and curl. Kaspersky observed CVE-2025-55182 exploitation using a deserialization gadget that reaches child_process execSync to run these commands from the web application context. This process ancestry indicates remote code execution and payload staging following successful exploitation.

Suspicious Execution From Hidden fonts-unix Directory in tmp on Linux

This rule detects process execution from the hidden /tmp/.fonts-unix directory on Linux. The AdaptixC2 agent delivered through a malicious npm supply-chain package staged its Linux payload in this location to blend in with legitimate font-socket directories. Executing a binary from a world-writable hidden temp path is a strong indicator of malware staging and persistence on Unix hosts.

Suspicious tmp Download and Execute Chain on Embedded Linux

This rule detects a shell chain that changes into the tmp directory fetches a payload with wget grants it full permissions with chmod and executes it which is the classic Mirai infection sequence on DVR and IoT devices. This variant uses it to deploy an ARM Mirai bot after exploiting CVE-2024-3721. The download and chmod and execute pattern in tmp is a strong IoT botnet indicator.

Suspicious masscan Scanning Docker API Port 2375

This rule detects masscan being launched with port 2375 as a target which the Dero miner worm uses to discover exposed unauthenticated Docker Engine APIs for propagation. Finding open 2375 endpoints is the first step in the container cryptojacking spread. A masscan invocation aimed at the Docker daemon port on an infected host indicates active worming.

Suspicious kswapd0 Masquerading Miner Process

This rule detects a process named kswapd0 executing from a user-writable path rather than existing only as a kernel thread which the Outlaw botnet uses to disguise its UPX-packed XMRig miner. Naming the miner after a legitimate kernel worker hides it from casual process inspection. Any on-disk kswapd0 binary in a home or tmp directory is anomalous.

Malicious SSH authorized_keys Overwrite With Outlaw Marker

This rule detects shell activity that writes the attacker marker mdrfckr into an SSH authorized_keys file which the Outlaw botnet uses to plant its own key and lock out other access. This grants durable remote access to the compromised Linux host for the mining operation. The hardcoded comment string alongside authorized_keys manipulation is a strong Outlaw indicator.

Suspicious Linux Boot Persistence via rc.local or init.d Modification (via file_event)

This rule detects modification of /etc/rc.d/rc.local or files under /etc/init.d which the DinodasRAT Linux implant abuses to survive reboots by registering itself as a boot-time service which is a common Linux persistence technique warranting review.

Malicious DinodasRAT Hidden Config File Creation on Linux (via file_event)

This rule detects creation of the hidden configuration file /etc/.netc.conf which is dropped by the DinodasRAT Linux implant to store its C2 settings enabling persistent espionage and its presence indicates an active backdoor on the host.

Suspicious NKAbuse Implant Staging under StoreService Config Directory (via file_event)

This rule detects creation of a file whose name begins with app_linux_ inside a .config/StoreService directory on Linux. After exploiting a public-facing service the NKAbuse setup script drops its architecture-specific binary app_linux_{ARCH} into /root/.config/StoreService/, so this path and name pattern indicates the multiplatform implant being installed.

Malicious DNS Query To fdmpkg C2 Domain via DNS Query

This rule detects DNS resolution of subdomains under the fdmpkg C2 domain used by the backdoored Free Download Manager Linux package. The malware encodes a 20-byte hex value as a subdomain of u.fdmpkg[.]org for DNS-based command-and-control, so any query matching this structure indicates an infected host.

Suspicious Cryptomining Shell Script Execution sex.sh or miner.sh on Linux (via process_creation)

This rule detects execution of the sex.sh or miner.sh scripts dropped by threat actors after exploiting React2Shell on Linux to deploy a cryptominer. Running these named installer scripts indicates resource-hijacking activity for financial gain on the compromised host.

Malicious Global Socket gs-netcat Reverse Shell over DNS Port (via process_creation)

This rule detects execution using the Global Socket relay with GS_PORT set to 53 and interactive listener arguments loading npm-cli.dat, the covert channel established by actors exploiting React2Shell on Linux. Tunneling a reverse shell over the DNS port through the Global Socket relay is used to bypass egress filtering and hide C2 traffic.

Malicious Cron Execution of Binary from tmp Directory on Linux (via process_creation)

This rule detects cron launching an executable located under /tmp such as /tmp/kernal, the minute-interval persistence used by threat actors exploiting React2Shell (CVE-2025-55182) on Linux hosts. Scheduling a world-writable /tmp binary via cron provides resilient re-execution of dropped backdoors after post-exploitation.