Sigma detection rules, expert-reviewed

Linux wget downloads to /tmp using explicit output options

Alerts on wget commands writing output to /tmp using -O or --output-document.

Linux Script Execution from /tmp via Shell -c

Alerts when a Linux shell runs a command with -c that references a script under /tmp/.

Linux: Shell Execution from /tmp by Parent Process

Alert when a /tmp parent process spawns a shell (bash/sh/zsh/etc.), indicating likely staging and command execution.

Suspicious Linux Process Execution From /tmp Directory

Flags execution of binaries located under /tmp on Linux, excluding a known Nextcloud path.

Linux nohup Execution from /tmp

Flags Linux process executions using nohup with command lines referencing /tmp.

Linux grep file discovery targeting GobRAT-specific filenames

Alerts on grep executions on Linux whose arguments contain specific malware-related file names for discovery.

Linux OS Architecture Discovery Using grep

Flags grep executions on Linux whose command line ends with known CPU/architecture identifiers.

Linux Process Creation: crontab -l Enumeration

Flags Linux executions of /crontab with the -l option to list a user’s scheduled cron tasks.

Linux Wget Writing Files Under /tmp or /var/tmp

Alerts when wget creates files under /tmp or /var/tmp on Linux.

Linux Shell Script Creation in /etc/profile.d/ for Persistence

Alerts on creation of .sh/.csh scripts in /etc/profile.d, a common place for persistence via shell startup.

Windows DLL Sideloading via SmadHook32c.dll and SmadHook64c.dll Loads

Alerts on non-standard loads of SmadHook32c.dll/SmadHook64c.dll on Windows, consistent with potential DLL sideloading.

Windows: PowerShell Core DLL Loaded by Office Application

Flags Office apps that load System.Management.Automation DLLs associated with PowerShell Core.

Windows: Detect Loading amsi.dll by LOLBIN Processes

Alert on amsi.dll DLL loads initiated by ExtExport.exe, Odbcconf.exe, or Rundll32.exe on Windows.

Windows File Events: PSScriptPolicyTest Script Creation by Uncommon Process

Alert on __PSScriptPolicyTest_ PowerShell script file creation when the writing process is not an expected PowerShell component.

Proxy Traffic to Operation Triangulation Domains Indicative of C2 Beaconing

Alerts on proxy requests to specific suspect C2-related domains by host substring match.