Sigma detection rules, expert-reviewed

Possible GTFOBins Shell Breakout via Unix Utilities

This rule detects common Unix utilities such as env, awk, busybox, and mysql spawning an interactive shell, a GTFOBins pattern used to break out of restricted environments or abuse sudo privileges. These utilities spawning /bin/sh or /bin/bash is atypical and indicates a shell-evasion attempt by an insider or intruder.

Suspicious runas NETONLY for Access Token Manipulation

This rule detects use of runas with the netonly flag, an access token manipulation technique detailed by Elastic where new network credentials are applied without validating them locally. Attackers use this to run tools under alternate credentials for lateral movement while the local session identity is unchanged. Interactive netonly logons outside of administrative jump host workflows can indicate credential abuse.

Suspicious GRUB Bootloader Script Modification for Bootkit Persistence

This rule detects shell modification of GRUB bootloader scripts under /etc/grub.d, a pre-OS persistence technique from the Elastic Linux persistence grand finale. Injecting commands into GRUB configuration lets an attacker gain execution before the operating system loads for stealthy and resilient persistence. Direct edits to these scripts outside of kernel or bootloader updates should be examined.

Suspicious D-Bus System Service Persistence File Creation

This rule detects writing of a D-Bus system service definition under the dbus-1 system-services directory, a persistence technique from the Elastic Linux persistence grand finale. A malicious service file causes D-Bus to launch attacker code on demand with elevated privileges. New service definitions created through shell tooling rather than package managers warrant review.

Suspicious NetworkManager Dispatcher Script Persistence

This rule detects creation of a script under the NetworkManager dispatcher directory, a persistence technique covered in the Elastic Linux persistence grand finale. Scripts placed in dispatcher.d run automatically on network state changes giving an attacker recurring code execution as root. Writes to this directory outside of package installation are worth investigating.

Suspicious Credential Dump via Registry Hive Save

This rule detects use of reg.exe to save the SAM SECURITY or SYSTEM registry hives to disk, an OS credential dumping technique used in the REF7707 campaign to harvest secrets alongside ntds.dit theft. Exporting these hives lets an attacker extract local account hashes and boot keys offline. Saving protected hives is rarely part of normal administration and indicates credential access.

Suspicious Renamed Windows Debugger CDB Execution

This rule detects execution of the Microsoft console debugger CDB under a renamed file name, a defense evasion technique seen in the REF7707 campaign. CDB is a signed LOLBin that can launch arbitrary commands and shellcode so attackers rename it to evade name based detection. A mismatch between the original file name CDB.exe and the on-disk image name surfaces this abuse.

Malicious Container Escape via Privileged Docker Host PID Namespace

This rule detects a Docker container launched with both privileged mode and the host PID namespace, a container escape primitive documented in Elastic Linux persistence research. Combining these flags lets an attacker use nsenter to break out into the host namespaces and gain full node control. Legitimate workloads rarely require both flags together making this a strong escape indicator.

Suspicious SSH authorized_keys Modification for Persistence

This rule detects append or redirect operations against an SSH authorized_keys file, an account persistence technique highlighted in Elastic Linux persistence research where an attacker adds their own key to a system user home directory. Planting a controlled public key grants durable password-less remote access that survives credential changes. Writes to authorized_keys through shell redirection outside provisioning workflows should be reviewed.

Suspicious Dynamic Linker Hijacking via ld.so.preload Modification

This rule detects command line activity that writes to the /etc/ld.so.preload file, a dynamic linker hijacking mechanism detailed in Elastic Linux persistence research. By adding a malicious shared object to ld.so.preload the attacker forces it to load into every dynamically linked process for stealthy persistence and privilege abuse. Modifications to this global preload file are rarely legitimate and warrant investigation.

Suspicious Web Shell Spawned via Python or PHP Built-in Server

This rule detects launch of a lightweight web server through the Python http.server CGI mode or the PHP built-in development server, a persistence and remote-access technique covered in Elastic Linux persistence research. Attackers stand up these one-line servers to expose a web shell for command execution and file transfer on a compromised host. Such servers spawned outside a development context deserve scrutiny.

Suspicious Kernel Module Load Or Unload For Rootkit Deployment via PUMAKIT

This rule detects invocation of module management utilities that insert or remove Linux kernel modules which the PUMAKIT rootkit relies on to load its kernel component and manipulate the running kernel. Adversaries load a malicious LKM to gain kernel level control and conceal processes files and network activity.

Suspicious Fileless Execution From Memory File Descriptor via PUMAKIT

This rule detects a process executing from an in-memory file descriptor path such as memfd or dev fd which is the fileless execution technique used by the PUMAKIT rootkit loader to run payloads without touching disk. Adversaries use memfd_create and execveat to evade file based detection and forensic recovery on Linux hosts.

Suspicious Access To Chrome Elevation Service COM Object via Katz Stealer

This rule detects a handle to the Chrome elevation service object being obtained by an unexpected process which infostealers abuse to decrypt application-bound encrypted cookies through the elevated COM service. Adversaries invoke the GoogleChromeElevationService to recover the master key protecting stored credentials and session cookies.

Suspicious Chrome Launched With Remote Debugging Port For Cookie Theft

This rule detects chrome.exe started with a remote debugging port argument which MaaS infostealers use to attach over the DevTools protocol and read decrypted cookies and session tokens after Chrome application-bound encryption defenses. Adversaries drive a debug-enabled browser instance to harvest authenticated session material without triggering the standard credential prompts.