Sigma detection rules, expert-reviewed

Malicious Hadooken Cryptominer Execution via Masqueraded Binaries (via process_creation)

This rule detects execution of the Hadooken cryptominer components crondr and bprofr that are dropped into system binary paths and later renamed to blend in with legitimate processes on compromised Weblogic servers. These binary names are unique to the Hadooken campaign.

Malicious Looney Tunables Privilege Escalation Exploit by Kinsing (via process_creation)

This rule detects the Kinsing actor running the gnu-acme.py exploit for CVE-2023-4911 Looney Tunables to escalate privileges through the glibc dynamic loader after gaining a foothold via PHPUnit. The gnu-acme.py filename is specific to this observed intrusion.

Malicious Container Runtime Tampering via chmod on runc (via process_creation)

This rule detects removal of the execute permission from the runc container runtime binary using chmod, an action the reemerged TeamTNT campaign performed to lock other actors out of a compromised Docker host after gaining control. Disabling the container runtime this way is not a legitimate administrative action.

Malicious Koske Userland Rootkit Installation via ld.so.preload (via file_event)

This rule detects installation of the Koske userland rootkit that hooks readdir through LD_PRELOAD to hide files and processes. It fires when the hideproc.so shared object is written to disk or when /etc/ld.so.preload is modified to load it globally. Modification of ld.so.preload is uncommon on most systems and is a strong rootkit indicator.

Suspicious Sobolan Staging Directory Creation in var tmp (via file_event)

This rule detects the Sobolan malware extracting its payloads into hidden staging directories under /var/tmp such as .lol11 and .loll1 that mimic the legitimate ICE temp folders. These dot prefixed paths are unique to the Sobolan cryptomining campaign against exposed JupyterLab servers.

Malicious perfctl Rootkit Library Drop via ld.so.preload (via file_event)

This rule detects the perfctl malware dropping its LD_PRELOAD rootkit and fake system libraries that hook pam_authenticate and pcap_loop to hide activity and steal credentials. It fires when the libgcwrap.so rootkit or the decoy libpprocps.so and libfsnkdev.so libraries are written to disk. These filenames are specific to the perfctl campaign.

Suspicious Tomcat Campaign Command and Control Domain Resolution (via dns_query)

This rule detects resolution of the dbliker.top domain that the 2025 Apache Tomcat cryptomining campaign uses to host and deliver its multi stage payloads. This domain was registered shortly before the campaign and any resolution from a workload indicates compromise.

Suspicious TeamTNT Command and Control Domain Resolution (via dns_query)

This rule detects resolution of command and control and download domains tied to the TeamTNT Docker Gatling Gun campaign including the resurrected teamtnt.red domain and the solscan themed lookalike domains. Any workload resolving these domains should be treated as compromised.

Suspicious Lucifer Botnet Mining Pool Domain Resolution (via dns_query)

This rule detects Linux hosts resolving the dedicated mining pool domains used by the Lucifer DDoS and cryptomining botnet that targets exposed Apache Hadoop YARN and Druid services. These domains are attacker controlled and their resolution from a server indicates cryptojacking.

Malicious Gh0stBins RAT Registry Marker HHClient

This rule detects creation of the HKCU SOFTWARE HHClient registry key, a host-based marker written by the Gh0stBins Chinese RAT to record its infection date. This key is not associated with any legitimate software.

Malicious CastleLoader C2 Communication via Hardcoded User-Agent

This rule detects outbound HTTP requests using the hardcoded non-standard User-Agent token associated with CastleLoader C2 check-ins. The loader beacons to its server with this fixed string before receiving tasks.

Suspicious Banana RAT UAC Skip Environment Variable in PowerShell

This rule detects the MSEDGE_SKIP_UAC environment variable being set within a PowerShell command line, a marker used by Banana RAT during staging to bypass user prompts. This variable is not used by legitimate Microsoft Edge update processes.

Suspicious PowerShell Loading Fake Edge Update Script

This rule detects a PowerShell process that reads and invokes a msedgeupdate.txt payload, the staging technique used by Banana RAT to masquerade as a Microsoft Edge updater. Loading a text file from disk through PowerShell is a strong loader indicator when tied to this filename.

Suspicious JScript.NET Compiler Spawned by AutoIt for Process Hollowing

This rule detects jsc.exe being launched by AutoIt3.exe, a chain used by CastleLoader to create a suspended JScript.NET compiler process that is later hollowed with an injected PE. A jsc.exe process spawned from AutoIt3 is highly unusual in benign environments.

Suspicious Masquerading Python Interpreter csshost Executing Script

This rule detects a renamed Python interpreter named csshost.exe executing a Python script, a masquerading technique used by PyLangGhost RAT to hide its stealer logic behind a system-looking process name. The legitimate Python binary is copied and renamed to blend in.