Sigma detection rules, expert-reviewed

Malicious GPO Logon Script Planted in SYSVOL Group Policy Path

This rule detects creation of a batch or script file inside the Group Policy user logon scripts path which the IcedID to Dagon Locker actor used to abuse a domain GPO for organization wide code execution at logon and this matters because writing a logon script into the Group Policy scripts folder can execute across every affected user and is a powerful domain wide deployment mechanism.

Malicious Langflow Build Public Temp RCE Access via Webserver

This rule detects POST requests to the Langflow build_public_tmp flow endpoint exploited by CVE-2026-55255 to achieve unauthenticated remote code execution. Attackers chain an IDOR on the responses endpoint with this build path to run arbitrary flows. Requests to this endpoint from untrusted sources indicate active exploitation of the exposed Langflow instance.

Malicious LiteLLM Authentication SQL Injection via Web Request (via webserver)

This rule detects web requests containing a UNION based SQL injection payload targeting the LiteLLM verification token table. This matches exploitation of the LiteLLM authentication SQL injection vulnerability where a crafted bearer token smuggles SQL into the auth path. Requests carrying a UNION SELECT against the litellm verification token table indicate active exploitation.

Possible Marimo Unauthenticated Terminal WebSocket Access via Web Request (via webserver)

This rule detects web requests to the Marimo terminal WebSocket endpoint on Linux hosts. Unauthenticated access to this endpoint corresponds to the Marimo remote code execution vulnerability that grants an interactive shell to anonymous users. Requests to the terminal WebSocket path from untrusted sources indicate exploitation attempts.

Malicious VoidLink Kernel Rootkit C2 Endpoints via HTTP (via proxy)

This rule detects HTTP requests to the handshake and compile endpoints of the VoidLink command and control server. VoidLink contacts these endpoints to register infected hosts and to request on demand compilation of kernel rootkit modules matched to the victim host. Traffic to these endpoints indicates active rootkit command and control.

Malicious EtherRAT C2 Exfiltration Endpoints via HTTP (via proxy)

This rule detects HTTP requests to the reobfuscation and crypto key endpoints used by the EtherRAT command and control infrastructure. These paths are used by the React2Shell implant to fetch payloads and exfiltrate harvested wallet and credential material. Traffic to these specific endpoints indicates active command and control communication.

Malicious JADEPUFFER Lockd Encryptor Execution

This rule detects execution of the lockd encryptor with its lock argument, the encryption stage of the evolved JADEPUFFER ransomware that targets AI model files. The binary encrypts data and appends a locked extension across the host. Its invocation is a high-confidence sign of in-progress ransomware impact.

Malicious JADEPUFFER Lockd Ransomware Payload Download

This rule detects download of the lockd ransomware binary into a hidden temp directory, the staging step of the evolved JADEPUFFER campaign built to destroy AI models. The actor writes the encryptor to a concealed path before execution. This named artifact in a hidden directory is a strong ransomware deployment indicator.

Malicious JADEPUFFER Ransom Database Table Manipulation

This rule detects command lines that disable foreign key checks and create a ransom README table, the destructive database steps JADEPUFFER agentic ransomware performs to extort victims. The actor drops configuration tables and writes a ransom-note table in their place. These SQL fragments in process telemetry indicate active data destruction and extortion.

Malicious JADEPUFFER Python Beacon via Cron

This rule detects inline Python one-liners using urllib to contact a beacon endpoint, the scheduled command-and-control mechanism of the JADEPUFFER agentic ransomware for automated database extortion. The actor installs a cron entry that periodically calls back to its beacon path. This pattern indicates scheduled ransomware C2 activity.

Malicious Second-Stage Loader Fetch of SLT Payload via Curl or Wget

This rule detects download utilities retrieving the slt loader payload used after Langflow CVE-2026-55255 exploitation to stage further tooling. The actor fetches this named endpoint over HTTP and pipes it to a shell for execution. The specific loader path combined with a download utility is a strong ingress tool transfer indicator.

Malicious Container Escape via Nsenter Host Namespace Entry

This rule detects nsenter used to enter the host init process namespaces, the breakout step an agentic threat actor performed after gaining a privileged container. Entering PID 1 mount and other namespaces grants full host command execution from inside a container. This pattern reliably indicates a container escape attempt.

Malicious Keyhunter Worker Persistence via Systemd Service

This rule detects command lines referencing the keyhunter-worker component used by the NATS-as-C2 campaign to harvest cloud credentials and AI API keys. The actor installs a systemd unit under a keyhunter-worker path that beacons to a NATS broker for tasking. This named artifact indicates deployment of the credential-harvesting worker for persistence.

Malicious Marimo Notebook Credential File Access via Shell (via process_creation)

This rule detects a Marimo notebook process spawning a shell that reads environment and deployment credential files on Linux hosts. Attackers exploiting the Marimo terminal remote code execution vulnerability harvested env docker-compose and celerybeat schedule files to steal secrets. A notebook engine reading these credential bearing files indicates post exploitation credential theft.

Suspicious Self-Hosted GitHub Actions Runner Started As Root via Shell (via process_creation)

This rule detects a self-hosted GitHub Actions runner being started with the runner allow run as root flag on Linux hosts. Threat actors register self-hosted runners and force them to run as root to obtain a persistent backdoor with full privileges on the host. A runner explicitly permitted to run as root is highly unusual and warrants review.