Sigma detection rules, expert-reviewed

Malicious HTTP User Agent zzhbot From Docker API Compromise

This rule detects outbound HTTP requests using the User-Agent string zzhbot which the vurl reverse connection tool sets when beaconing to its command and control infrastructure in the campaign targeting exposed Docker APIs.

Possible AF_ALG Privilege Escalation via algif_aead Module Load

This rule detects loading of the algif_aead kernel crypto module through modprobe or insmod, an autoload step abused by the CVE-2026-31431 Copy Fail local privilege escalation. The exploit drives an AF_ALG splice chain that requires the algif_aead module to reach the vulnerable kernel path. On hosts that do not use userspace crypto the on-demand load of this module is a suspicious precursor to privilege escalation.

Malicious Destructive Recursive Delete of Home Directory

This rule detects a recursive forced deletion targeting the user home directory, the destructive payload triggered by the Shai-Hulud gh-token-monitor daemon. After exfiltrating credentials the framework wipes the developer home directory to destroy evidence and disrupt the victim. A rm -rf against the home path is almost never intentional interactive behavior and signals a wiper action.

Suspicious Process Memory Secret Dump via proc mem

This rule detects a process reading another process address space through the proc mem interface, the credential harvesting technique used by the Shai-Hulud framework to scrape secrets from memory. The malware walks proc pid mem to lift tokens and keys that never touch disk. Direct reads of proc mem outside of debuggers are rare and indicate in-memory secret theft.

Malicious Node.js Execution of Hidden .claude Setup Script

This rule detects Node.js executing a setup script from a hidden .claude directory, the auto-run payload delivered by the open source Shai-Hulud framework. A workspace tasks.json configured to run on folder open silently launches this script when a developer opens the repository. Node running a hidden .claude setup module is not part of normal project execution and marks the initial foothold.

Suspicious Node.js Spawning Script Interpreter for Dropped Payload

This rule detects a Node.js process launching the Windows script host or a Python interpreter against a payload staged in the temp directory, the dropper chain of the compromised axios package RAT. The malicious postinstall script writes a VBS or Python loader to a temp location and executes it to establish the cross-platform RAT. Node spawning wscript or python on a temp script is anomalous for normal package installs.

Suspicious Data Exfiltration via curl Multipart Upload to Gate Endpoint

This rule detects curl uploading a local archive as a multipart form file to a remote gate endpoint, the exfiltration step of the macOS infostealer. After collecting browser and keychain material into a zip the stealer posts it to attacker infrastructure. A curl multipart file upload of a compressed archive to a generic gate path reflects staged data theft rather than normal application traffic.

Suspicious Exfiltration of Environment File via wget POST

This rule detects reading a dotenv secrets file and posting its contents to a remote host using wget post-data, an exfiltration pattern observed after React2Shell RCE. Attackers grab application secrets from the .env file to pivot into connected cloud and database services. The combination of the .env path and an outbound HTTP post argument reflects deliberate credential theft rather than routine tooling.

Malicious Node.js Process Spawning Unix Shell or Network Client

This rule detects a Node.js server process spawning a Unix shell, curl, or wget, a strong indicator of remote code execution against a web application. This behavior was central to CVE-2025-55182 React2Shell exploitation of React Server Components where the crafted Next-Action request drove child_process execution. Web application runtimes should not normally launch interactive shells or downloaders, so this lineage signals hands-on-keyboard post-exploitation.

Suspicious PowerShell Remote Download and Execution via Invoke-WebRequest

This rule detects a PowerShell command that downloads a file with Invoke-WebRequest and then runs it with Start-Process which the MUT-8694 campaign chains inside malicious npm and PyPI packages to fetch and launch a second stage on Windows hosts.

Malicious Microsoft Defender Tampering via PowerShell Preference Cmdlets

This rule detects the use of Add-MpPreference or Set-MpPreference to add scan exclusions or disable real time protection which the MUT-8694 npm and PyPI campaign runs to blind Microsoft Defender before deploying its payloads on Windows developer systems.

Malicious Immutable Attribute Set on SSH Authorized Keys via chattr on Linux

This rule detects the chattr command applying the append only or immutable attribute to an SSH authorized_keys file which cryptomining actors abusing container APIs use to lock in their backdoor SSH key and prevent defenders or competing miners from removing it.

Suspicious Internet Scanning for Docker and Kubelet Ports via masscan

This rule detects the masscan tool being run against the Docker API and kubelet ports which threat actors use to discover exposed container orchestration services across the internet before deploying cryptomining payloads.

Suspicious Cron Reboot Persistence Pointing to Hidden User Directory on Linux

This rule detects a crontab entry using the reboot schedule to launch a binary from a hidden path under a user local bin directory which the opportunistic Log4j campaign uses to persist its componist implant across system restarts.

Malicious Encrypted Reverse Shell via Netcat and GPG on Linux

This rule detects a command pipeline that reads from a netcat listener decrypts the traffic with gpg and pipes it into a shell which the opportunistic Log4j campaign uses to run an encrypted reverse shell that evades network content inspection.