Sigma detection rules, expert-reviewed

Suspicious Linux Crontab Reboot Persistence to Hidden Sys Cache Binary (via process_creation)

This rule detects the installation of a crontab reboot entry pointing to a hidden .Sys_cache binary under var tmp as used by the Linux SSH CoinMiner campaign. Piping a modified crontab that adds a reboot job to a hidden file is a common miner persistence technique.

Malicious Docker Socket Access via Curl Unix Socket

This rule detects curl invocations that talk directly to the Docker daemon Unix socket, the technique an AI agent-driven actor used to create a privileged container and escape onto the host orchestration plane. Direct API calls to the docker.sock allow spawning containers that mount the host filesystem. This behavior is a strong container escape indicator.

Malicious Keyhunter Worker Systemd Unit File Creation

This rule detects creation of the keyhunter-worker systemd unit file dropped by the NATS-as-C2 credential harvesting campaign. The unit establishes persistence for a worker that connects to an attacker NATS broker and exfiltrates cloud and AI API keys. A unit file with this name is a strong indicator of compromise.

Suspicious Archive Staged in Web Root via tar on Ivanti EPMM

This rule detects creation of a compressed tar archive written into the Ivanti EPMM public web directory /var/www/ext/html. It corresponds to collection and staging behaviour where stolen data is archived in a web-accessible path for later download. Detecting it exposes exfiltration staging on the appliance.

Suspicious Obfuscated Shell Execution via sh -c bash Redirection (via process_creation)

This rule detects the sh -c argument-to-bash redirection trick used to obfuscate reconnaissance commands after Ivanti EPMM exploitation. This construct hides the real command from naive process logging by passing it through positional parameters. It is a distinctive obfuscation pattern rarely seen in benign automation.

Malicious Shell Execution via Foomatic-rip Print Filter through CUPS Exploit

This rule detects the foomatic-rip CUPS print filter spawning a shell interpreter such as bash or sh. The CUPS foomatic-rip vulnerability chain lets an attacker-supplied printer inject commands through the FoomaticRIPCommandLine field, yielding a reverse shell and follow-on CoinMiner deployment. Execution of a shell as a child of foomatic-rip indicates remote command injection.

Malicious Mini Shai-Hulud TanStack Destructive rm Killswitch (via process_creation)

This rule detects the destructive rm -rf against the user home directory that the Mini Shai-Hulud TanStack payload invokes as a killswitch on certain regional systems. While recursive home deletion can occur in scripts its use here follows credential theft and signals the payloads self-destruct or sabotage stage.

Malicious OMI Server Spawning Shell as Root via OMIGOD SCX Provider (via process_creation)

This rule detects the OMI server or engine process spawning a shell or command interpreter, which the OMIGOD CVE-2021-38647 and CVE-2021-38648 flaws abuse to execute attacker commands as root through the SCX provider on Azure Linux virtual machines. Such child processes indicate unauthenticated remote code execution or local privilege escalation and should be investigated as an active intrusion.

Suspicious Base64 Decode Piped to Python Interpreter

This rule detects base64 decoding of a staged file piped into a Python interpreter, an obfuscated execution step observed in the AI agent-driven container escape. Encoding payloads and decoding them into an interpreter hides malicious code from simple string inspection. This chain indicates defense-evasion around payload execution.

Malicious TeamPCP durabletask Infection Markers and Rope State (via file_event)

This rule detects the .sys-update-check cache infection markers and the .rope_state SSM instance state file written by the trojanized durabletask PyPI payload to track infection and staged AWS SSM targets. These fixed hidden files indicate the TeamPCP implant is installed and enumerating cloud resources.

Possible ReverseSocks5 Tunneling Tool Execution on Linux (via process_creation)

This rule detects execution of the ReverseSocks5 tunneling utility staged as R5 under /tmp or /var during PAN-OS Captive Portal zero-day exploitation. Attackers use this SOCKS5 tunnel to proxy traffic and maintain covert access into the internal network.

Malicious SSH authorized_keys Modification Following Web Server Compromise (via process_creation)

This rule detects modification of an SSH authorized_keys file through shell commands that append or fetch key material, a persistence technique used after CVE-2025-55182 exploitation to plant attacker SSH keys on compromised servers. Adversaries add their own keys to guarantee durable remote access independent of the web application, so writes to authorized_keys from an exploited host warrant investigation.

Suspicious LD_PRELOAD Library Injection via PUMAKIT Userland Rootkit

This rule detects a process launched with the LD_PRELOAD environment variable pointing at a shared object under a system library path which the PUMAKIT userland rootkit uses to hook standard library calls and hide its presence. Adversaries preload a malicious shared object to intercept functions for stealth and persistence.

Malicious XMRig Cryptominer Connecting to SupportXMR Pool (JINX-0132)

This rule detects a process command line referencing the supportxmr.com mining pool used by the JINX-0132 cryptojacking campaign. It matters because a mining pool address on a server is a direct indicator of resource hijacking following exposed DevOps API exploitation.

In-Memory Reverse Shell and In-Memory Payload Staging During Ivanti CSA Exploitation (via process_creation)

This rule detects reverse shell establishment through netcat with the command-execution flag spawning a shell, or payload staging into the memory-backed /dev/shm directory, both observed during Houken exploitation of Ivanti Cloud Service Appliance devices. Adversaries leverage these techniques to obtain interactive access and stage tooling without touching disk, making early detection critical for catching hands-on-keyboard activity on the appliance.