Sigma detection rules, expert-reviewed

Malicious Container Runtime Tampering via chmod on runc (via process_creation)

This rule detects removal of the execute permission from the runc container runtime binary using chmod, an action the reemerged TeamTNT campaign performed to lock other actors out of a compromised Docker host after gaining control. Disabling the container runtime this way is not a legitimate administrative action.

Malicious Koske Userland Rootkit Installation via ld.so.preload (via file_event)

This rule detects installation of the Koske userland rootkit that hooks readdir through LD_PRELOAD to hide files and processes. It fires when the hideproc.so shared object is written to disk or when /etc/ld.so.preload is modified to load it globally. Modification of ld.so.preload is uncommon on most systems and is a strong rootkit indicator.

Suspicious Sobolan Staging Directory Creation in var tmp (via file_event)

This rule detects the Sobolan malware extracting its payloads into hidden staging directories under /var/tmp such as .lol11 and .loll1 that mimic the legitimate ICE temp folders. These dot prefixed paths are unique to the Sobolan cryptomining campaign against exposed JupyterLab servers.

Malicious TeamTNT prochider Rootkit Deployment as Shared Object (via file_event)

This rule detects the TeamTNT prochider rootkit being written to disk under the deceptive shared object names xmrig.so and systemd.so which are then loaded through the dynamic linker to hide the cryptominer process. These filenames are specific to the campaign tooling.

Malicious perfctl Rootkit Library Drop via ld.so.preload (via file_event)

This rule detects the perfctl malware dropping its LD_PRELOAD rootkit and fake system libraries that hook pam_authenticate and pcap_loop to hide activity and steal credentials. It fires when the libgcwrap.so rootkit or the decoy libpprocps.so and libfsnkdev.so libraries are written to disk. These filenames are specific to the perfctl campaign.

Suspicious Tomcat Campaign Command and Control Domain Resolution (via dns_query)

This rule detects resolution of the dbliker.top domain that the 2025 Apache Tomcat cryptomining campaign uses to host and deliver its multi stage payloads. This domain was registered shortly before the campaign and any resolution from a workload indicates compromise.

Suspicious TeamTNT Command and Control Domain Resolution (via dns_query)

This rule detects resolution of command and control and download domains tied to the TeamTNT Docker Gatling Gun campaign including the resurrected teamtnt.red domain and the solscan themed lookalike domains. Any workload resolving these domains should be treated as compromised.

Suspicious Proxyjacking Service Resolution Observed in perfctl Campaign (via dns_query)

This rule detects Linux hosts resolving bandwidth sharing and proxyjacking service domains that the perfctl malware abuses to monetize victim network connections alongside cryptomining. Resolution of these services from a server workload is unusual and warrants review.

Suspicious Lucifer Botnet Mining Pool Domain Resolution (via dns_query)

This rule detects Linux hosts resolving the dedicated mining pool domains used by the Lucifer DDoS and cryptomining botnet that targets exposed Apache Hadoop YARN and Druid services. These domains are attacker controlled and their resolution from a server indicates cryptojacking.

Malicious Gh0stBins RAT Registry Marker HHClient

This rule detects creation of the HKCU SOFTWARE HHClient registry key, a host-based marker written by the Gh0stBins Chinese RAT to record its infection date. This key is not associated with any legitimate software.

Malicious CastleLoader C2 Communication via Hardcoded User-Agent

This rule detects outbound HTTP requests using the hardcoded non-standard User-Agent token associated with CastleLoader C2 check-ins. The loader beacons to its server with this fixed string before receiving tasks.

Suspicious PowerShell Spawned by VBScript for RMM Delivery

This rule detects wscript.exe spawning a PowerShell process that skips the user profile, the delivery chain of the 46-country RMM phishing campaign that fetches and installs remote-access tools. A script-host parent driving profile-skipping PowerShell is characteristic of malicious RMM deployment.

Suspicious Banana RAT UAC Skip Environment Variable in PowerShell

This rule detects the MSEDGE_SKIP_UAC environment variable being set within a PowerShell command line, a marker used by Banana RAT during staging to bypass user prompts. This variable is not used by legitimate Microsoft Edge update processes.

Suspicious PowerShell Loading Fake Edge Update Script

This rule detects a PowerShell process that reads and invokes a msedgeupdate.txt payload, the staging technique used by Banana RAT to masquerade as a Microsoft Edge updater. Loading a text file from disk through PowerShell is a strong loader indicator when tied to this filename.

Suspicious JScript.NET Compiler Spawned by AutoIt for Process Hollowing

This rule detects jsc.exe being launched by AutoIt3.exe, a chain used by CastleLoader to create a suspended JScript.NET compiler process that is later hollowed with an injected PE. A jsc.exe process spawned from AutoIt3 is highly unusual in benign environments.