Sigma detection rules, expert-reviewed

Suspicious Scheduled Task Under NetFramework Path via PHANTOMPULSE

This rule detects creation of scheduled tasks placed in the Microsoft Windows NetFramework folder with implant specific names such as DotNetSvcUpdateTask or CoreTask as used by the PHANTOMPULSE RAT in Elastic research. Registering tasks under this seldom populated system path with update themed names provides masqueraded persistence for the backdoor.

Suspicious GitHub CLI Token Extraction With Secret Scanner in CI Pipeline

This rule detects use of the GitHub CLI to print an authentication token alongside execution of a secret scanning tool inside a runner as described in Elastic CI CD pipeline abuse research. Pairing gh auth token with TruffleHog indicates an actor mining the pipeline for reusable credentials and repository secrets.

Suspicious Remote Script Piped Directly to Interpreter in CI Pipeline

This rule detects curl fetching a remote payload and piping it straight into bash or node as observed in CI CD pipeline abuse research by Elastic. Executing untrusted remote code without staging is a common supply chain and pipeline compromise technique that bypasses review controls.

Suspicious Environment Variable Dump Piped to Base64 for CI Credential Exfil

This rule detects a process reading the full environment and piping it through base64 encoding to stage secrets for exfiltration as seen in CI CD pipeline abuse research by Elastic. Dumping env with null separators and double base64 encoding is a hallmark of automated credential harvesting inside build runners.

Suspicious osascript LaunchAgent Plist Persistence for PhantomPulse on macOS

This rule detects osascript writing a LaunchAgent property list to establish persistence as used by the macOS PhantomPulse RAT variant in Elastic research. Using AppleScript to drop a plist under LaunchAgents lets the implant execute automatically at login while avoiding direct file tooling.

Suspicious Shell History and Log Clearing on Linux

This rule detects commands that clear shell history or truncate and shred system logs as used by Linux rootkit operators to remove traces of activity in Elastic detection research. Clearing history and wiping auth or utmp logs after intrusion is a common anti forensic action indicating hands on keyboard cleanup.

Suspicious Kernel Module Load From World Writable Directory on Linux

This rule detects insmod or modprobe loading a kernel object from tmp or shared memory paths as used to install Linux rootkits described in Elastic rootkit detection engineering research. Loading a ko file from a world writable staging directory rather than the module tree is a strong indicator of kernel level implant deployment.

Malicious Node Runtime Spawning Shell to Download Python Payload via Axios Compromise

This rule detects a Node or Bun runtime spawning a shell that uses curl to fetch a Python loader into tmp and launches it with nohup as observed in the Axios npm supply chain compromise. A JavaScript package executing curl and python3 in sequence indicates malicious postinstall behavior staging a backdoor on the developer host.

Suspicious osascript Spawning Shell Executing Hidden macOS Payload via Axios Compromise

This rule detects osascript dispatching a shell that executes a hidden payload located under Library Caches as observed in the macOS variant of the Axios supply chain RAT. Attackers use AppleScript to launch a persistent implant while evading command line inspection, marking early stage execution on developer endpoints.

Malicious Renamed PowerShell as wt.exe in ProgramData via Axios Compromise

This rule detects a PowerShell binary renamed to wt.exe and executed from the ProgramData directory as seen in the Axios npm supply chain compromise. The RAT masquerades its interpreter to evade process name based detection and blend with Windows Terminal, enabling stealthy execution of downloaded payloads.

Suspicious Sleep and Hibernate Disabled via Powercfg for Mining (via process_creation)

This rule detects powercfg being used to zero standby and hibernate timeouts so the host never sleeps, keeping a cryptominer running continuously. Observed in the Elastic Security Labs fake-installer Monero mining operation where power settings are altered to maximize resource hijacking uptime.

Malicious BRUSHLOGGER Rundll32 Execution from ProgramData (via process_creation)

This rule detects rundll32 loading the BRUSHLOGGER Recorder.dll from the attacker's ProgramData staging directory. Observed in Elastic Security Labs analysis where Recorder.dll under a Photoes Pics path is executed to capture keystrokes from financial services targets.

Suspicious Systemd Service Unit Written to System Directory (via process_creation)

This rule detects writing a systemd service unit into the system service directory from a shell, a Linux persistence technique. Observed in the Elastic Security Labs TeamPCP scenario where a service file is dropped into /etc/systemd/system to survive reboots and relaunch the miner or tunneling tooling.

Malicious Remote Script Piped to Shell via Curl (via process_creation)

This rule detects curl fetching a remote script and piping it directly into a shell interpreter, a common Linux and container compromise technique. Observed in the Elastic Security Labs TeamPCP container attack scenario where curl -fsSL of proxy.sh piped to bash bootstraps the intrusion and downloads further tooling.

Malicious ScreenConnect Client Installation via Msiexec (via process_creation)

This rule detects silent installation of the ScreenConnect client setup MSI, abused in the SILENTCONNECT campaign to deploy remote access tooling. Observed in Elastic Security Labs telemetry where msiexec installs ScreenConnect.ClientSetup.msi to give the adversary persistent hands-on-keyboard control.