Sigma detection rules, expert-reviewed

Suspicious Double Base64 Decoded Payload Piped to Shell in CI (reviewdog Supply Chain)

This rule detects a base64 decoded payload being piped directly into a shell, the execution pattern of the injected reviewdog/action-setup install.sh that dumped CI runner memory. It matters because decode into shell in a build step is a common way supply chain payloads execute credential theft code without touching disk.

Malicious PyPI Package Installation from Gleaming Pisces Supply Chain (via process_creation)

This rule detects installation of the malicious PyPI packages real-ids, coloredtxt, beautifultext, or minisound published by Gleaming Pisces to deliver the PondRAT backdoor. Installing these poisoned packages compromises developer and build systems through the software supply chain.

Suspicious Child Process Spawned by 3CXDesktopApp via Supply Chain Compromise

This rule detects the 3CXDesktopApp.exe process spawning a command interpreter such as cmd.exe or powershell.exe. During the 3CX supply chain compromise the trojanized client executed follow-on commands to profile the host and retrieve second-stage payloads after sideloading a malicious ffmpeg.dll. The VoIP client has no legitimate reason to launch shells.

Malicious Bun Runtime Payload Dropped by Shai Hulud npm Supply Chain Attack

This rule detects creation of the setup_bun.js or bun_environment.js files associated with the Shai Hulud 2.0 npm supply-chain worm. A malicious preinstall script drops setup_bun.js which installs the Bun runtime and stages the large bun_environment.js payload for credential theft and self-propagation. These distinctive filenames written during package installation indicate the worm establishing execution.

Possible CI Runner Memory Scraping via Python Process Memory Read (tj-actions Supply Chain)

This rule detects a Python interpreter reading another process memory through /proc maps and mem, the technique the compromised tj-actions/changed-files GitHub Action used to dump CI runner memory. It is important because this behavior harvests secrets and tokens from the runner and leaks them into build logs.