Sigma detection rules, expert-reviewed

Malicious Remote MSI Execution with Image Extension via msiexec (via process_creation)

This rule detects msiexec silently installing an MSI package fetched from a remote HTTP URL where the payload uses an image file extension. Operators exploiting CVE-2023-46604 delivered ransomware as MSI files named with a .png extension via msiexec quiet install.

Malicious ActiveMQ Exploitation Java Spawning PowerShell Downloader (via process_creation)

This rule detects an ActiveMQ Java process spawning PowerShell that downloads a remote payload. Exploitation of CVE-2023-46604 caused the ActiveMQ java process to launch PowerShell IEX and DownloadFile commands to stage ransomware.

Suspicious BoryptGrab Infostealer Staging Directory (via file_event)

This rule detects creation of files within the Filegraber or decrypt_browser staging directories. The BoryptGrab-lineage infostealer wrote harvested browser data and logs to these folders, retaining the misspelled Filegraber directory name.

Malicious NTDS Database Staging to Audit Directory (via file_event)

This rule detects creation of an ntds.dit Active Directory database copy under a C drive audit Active Directory path. During the Anubis ransomware intrusion the operators exfiltrated domain credentials by copying the NTDS database into an audit directory and archiving it, an activity that does not occur during normal operations.

Suspicious Cleo Autorun Health Check File Drop (via file_event)

This rule detects creation of healthcheck.txt or healthchecktemplate.txt files inside a Cleo autorun directory. Operators exploited the Cleo autorun feature by writing these files to trigger execution of an embedded PowerShell stager.

Malicious Koske Persistence via Systemd Service and Shell Profile Hijack (via process_creation)

This rule detects Koske establishing persistence by registering the shellkoske systemd service and by deploying a hijacked shell profile named .bashrc.koske that beacons to command and control. These named artifacts are unique to the Koske campaign and do not appear in legitimate software.

Suspicious Automated SSH Lateral Movement with Batch Mode (via process_creation)

This rule detects non interactive SSH connection attempts that disable host key checking and use batch mode with a short connect timeout, the pattern the Tomcat campaign uses to spread across hosts with harvested keys. Configuration management tooling can produce similar commands so validate the source process.

Malicious Multi Layer Base64 Decoded Payload Execution via Bash (via process_creation)

This rule detects the Apache Tomcat cryptomining campaign fetching a payload and piping it through several chained base64 decode passes before executing it with bash. Repeated base64 decode stages in a single command line indicate deliberate obfuscation and are not typical of legitimate administration.

Malicious Sobolan Payload Download from Jupyter Compromise (via process_creation)

This rule detects retrieval of the Sobolan archive from the hidden .sobo path on the attacker download server using wget or curl after an unauthenticated JupyterLab instance is compromised. The .sobo/temp.tar path is specific to this campaign.

Malicious TeamTNT Docker Gatling Gun Initialization Script (via process_creation)

This rule detects execution of the TeamTNT Docker Gatling Gun initialization scripts TDGGinit.sh and TDGG.sh that are deployed inside compromised containers to harvest cloud credentials, add hosts to an attacker Docker Swarm and deploy cryptominers. These script names are specific to the campaign.

Malicious Hadooken Cryptominer Execution via Masqueraded Binaries (via process_creation)

This rule detects execution of the Hadooken cryptominer components crondr and bprofr that are dropped into system binary paths and later renamed to blend in with legitimate processes on compromised Weblogic servers. These binary names are unique to the Hadooken campaign.

Suspicious Shell Spawned by PostgreSQL Server Process (via process_creation)

This rule detects a shell interpreter spawned as a child of the postgres server process, the behavior used by the PG_MEM malware to run operating system commands through the COPY FROM PROGRAM SQL feature after brute forcing database credentials. Legitimate archive commands and extensions can also spawn shells so context is required.

Suspicious Payload Download from Filebin via wget (via process_creation)

This rule detects use of wget or curl to fetch an archive from the filebin.net file sharing service, the delivery method used by the Panamorfi campaign to stage its DDoS toolkit onto compromised Jupyter servers. Filebin has legitimate uses so review the fetched content and host role.

Suspicious Cloud Instance Metadata Access from Command Line (via process_creation)

This rule detects command line access to the cloud instance metadata service at 169.254.169.254 targeting the instance identity and IAM credential endpoints, the method the Kinsing actor used to steal temporary cloud credentials. Some SDKs and agents query metadata legitimately so filter known tooling.

Malicious Looney Tunables Privilege Escalation Exploit by Kinsing (via process_creation)

This rule detects the Kinsing actor running the gnu-acme.py exploit for CVE-2023-4911 Looney Tunables to escalate privileges through the glibc dynamic loader after gaining a foothold via PHPUnit. The gnu-acme.py filename is specific to this observed intrusion.