Sigma detection rules, expert-reviewed

Malicious Foomatic-Rip Filter Spawning Shell via CUPS Exploitation

This rule detects the foomatic-rip print filter spawning a command shell such as bash sh or dash which is the exploitation primitive in the CUPS printing system vulnerability chain. Adversaries abuse a crafted printer PPD FoomaticRIPCommandLine to achieve remote command execution on the print host.

Suspicious Downloaded Shell Stager Made Executable Via Chmod 777

This rule detects a shell retrieving a remote script with wget and immediately granting it world writable and executable permissions using chmod 777 which is the KAIJI stager delivery pattern in the Betting on Bots campaign. Adversaries download and mark payloads executable in one step to bootstrap further malware on the compromised Linux host.

Malicious XMRig Cryptominer Connecting To C3Pool Stratum Pool

This rule detects a process connecting to the c3pool mining pool over the stratum protocol which is the resource hijacking behavior of the XMRIG miner deployed in the Betting on Bots Linux intrusions. Adversaries run XMRIG against public pools to monetize compromised hosts through unauthorized cryptocurrency mining.

Suspicious Python Executing Staged Script From Temp Directory via DPRK Pyperclip Loader

This rule detects a Python interpreter spawning a child process from a file written into the system temporary directory which mirrors the DPRK malicious Pyperclip module that decodes a base64 blob to a temp script and executes it via subprocess. Adversaries stage and run obfuscated Python payloads from temp to retrieve and execute second stage command and control code.

Suspicious Udev Rule Reload After Rules Directory Modification

This rule detects udevadm being invoked to reload or trigger device manager rules which follows an attacker writing a malicious rule into the udev rules directory to gain event driven persistence. Adversaries register a udev rule that runs a payload when a device event fires giving them privileged execution outside standard autostart locations.

Suspicious SUID Binary Discovery via Find Perm 4000

This rule detects the find command searching the filesystem for setuid binaries using the perm 4000 predicate which is a common privilege escalation discovery step on Linux hosts. Adversaries enumerate SUID executables to locate misconfigured binaries that can be abused to elevate to root.

Suspicious Dscl Authonly Password Validation via BANSHEE Credential Phishing

This rule detects the dscl directory service utility invoked against the local node with the authonly option which BANSHEE uses to validate a password harvested through an AppleScript phishing dialog. Adversaries confirm stolen macOS account credentials before using them for further access and keychain theft.

Suspicious System Profiler Hardware Reconnaissance via BANSHEE

This rule detects the system_profiler utility being run against hardware and software data types which the BANSHEE macOS infostealer uses to fingerprint the victim host model and environment. Adversaries collect this system information to profile targets and support later data exfiltration decisions.

Suspicious Scripting Interpreter Execution From Downloads Or Temp via Reputation Hijacking

This rule detects trusted scripting and automation interpreters such as AutoHotkey JamPlus Lua or Node.js executing from user download or temporary directories which is the reputation hijacking technique used to bypass Smart App Control. Adversaries plant a malicious script alongside a reputable interpreter binary so the resulting execution inherits the interpreter good reputation to evade defenses.

Suspicious Explorer Executing Path With Trailing Dot via LNK Stomping

This rule detects process execution where the parent explorer.exe launches a target whose command line contains a malformed path element such as a trailing dot or a leading dot-slash which is characteristic of LNK stomping used to strip the Mark-of-the-Web and bypass Smart App Control. Adversaries craft non-standard shortcut targets so explorer canonicalizes and overwrites them removing MotW reputation checks before execution.

Suspicious DllHost Spawned By MMC Without Arguments via PASTALOADER

This rule detects dllhost.exe launched by mmc.exe with an empty or missing command line which is characteristic of the PASTALOADER stage of GrimResource where shellcode is injected into a freshly spawned dllhost.exe process. Adversaries use this sacrificial COM surrogate combined with DirtyCLR unhooking and indirect syscalls to stealthily load Cobalt Strike.

Suspicious MMC Console Loading MSC File From User Writable Path

This rule detects mmc.exe opening a Microsoft Management Console snap-in file from a user writable directory such as Downloads or Temp which is characteristic of GrimResource where a malicious MSC like sccm-updater.msc is delivered for initial access. Attackers abuse the trusted MMC binary to evade defenses and gain code execution outside the standard administrative snap-in locations.

Suspicious MMC Console Spawning Script Interpreter via GrimResource

This rule detects mmc.exe spawning a script interpreter or scripting host child process which occurs when a crafted MSC file abuses the apds.dll cross-site scripting flaw to execute JavaScript inside mmc.exe as used in the GrimResource technique. Adversaries leverage this MMC initial access and evasion chain to run DotNetToJScript and side-load the PASTALOADER shellcode loader delivering Cobalt Strike.

Malicious WARMCOOKIE Loader Execution via rundll32 RtlUpd via process_creation

This rule detects rundll32.exe executing the WARMCOOKIE backdoor DLL RtlUpd.dll with its Start export. The backdoor is dropped to the ProgramData RtlUpd directory and invoked through rundll32 for execution and persistence. This specific module and export combination is a high-confidence WARMCOOKIE indicator.

Suspicious PowerShell BITS Transfer of DLL Payload via process_creation

This rule detects PowerShell using the BITS transfer cmdlet to download a DLL payload, matching the WARMCOOKIE backdoor delivery chain initiated from a malicious JavaScript file. The technique leverages the background intelligent transfer service to retrieve the loader while evading some download monitoring. A DLL fetched by Start-BitsTransfer through PowerShell is highly suspicious.