deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: ESXi VM List Discovery Via ESXCLI
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Cedric Maurugeon
Date: 2023-09-04
ATT&CK techniques: T1033, T1007, T1059.012
Log source: linux/process_creation

Description:
Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.

Detection logic:
{
  "selection": {
    "Image|endswith": "/esxcli",
    "CommandLine|contains": "vm process",
    "CommandLine|endswith": " list"
  },
  "condition": "selection"
}

References:
  - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/
  - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html
  - https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/
  - https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html
Sigma Detection Rule: Named Pipe Created Via Mkfifo
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-16
Log source: linux/process_creation

Description:
Detects the creation of a new named pipe using the "mkfifo" utility

Detection logic:
{
  "selection": {
    "Image|endswith": "/mkfifo"
  },
  "condition": "selection"
}

References:
  - https://dev.to/0xbf/use-mkfifo-to-create-named-pipe-linux-tips-5bbk
  - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
Sigma Detection Rule: Potential Container Discovery Via Inodes Listing
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Seth Hanford
Date: 2023-08-23
ATT&CK techniques: T1082
Log source: linux/process_creation

Description:
Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.

Detection logic:
{
  "selection_ls_img": {
    "Image|endswith": "/ls"
  },
  "selection_ls_cli": [
    {
      "CommandLine|endswith": " /"
    },
    {
      "CommandLine|contains": " / "
    }
  ],
  "selection_regex_inode": {
    "CommandLine|re": "(?:\\s-[^-\\s]{0,20}i|\\s--inode\\s)"
  },
  "selection_regex_dir": {
    "CommandLine|re": "(?:\\s-[^-\\s]{0,20}d|\\s--directory\\s)"
  },
  "condition": "all of selection_*"
}

References:
  - https://blog.skyplabs.net/posts/container-detection/
  - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker
Sigma Detection Rule: ESXi VSAN Information Discovery Via ESXCLI
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon
Date: 2023-09-04
ATT&CK techniques: T1033, T1007, T1059.012
Log source: linux/process_creation

Description:
Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.

Detection logic:
{
  "selection_img": {
    "Image|endswith": "/esxcli",
    "CommandLine|contains": "vsan"
  },
  "selection_cli": {
    "CommandLine|contains": [
      " get",
      " list"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html
  - https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html
  - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vsan.html
Sigma Detection Rule: Linux Package Uninstall
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Tuan Le (NCSGroup), Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-09
ATT&CK techniques: T1070
Log source: linux/process_creation

Description:
Detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg".

Detection logic:
{
  "selection_yum": {
    "Image|endswith": "/yum",
    "CommandLine|contains": [
      "erase",
      "remove"
    ]
  },
  "selection_apt": {
    "Image|endswith": [
      "/apt",
      "/apt-get"
    ],
    "CommandLine|contains": [
      "remove",
      "purge"
    ]
  },
  "selection_dpkg": {
    "Image|endswith": "/dpkg",
    "CommandLine|contains": [
      "--remove ",
      " -r "
    ]
  },
  "selection_rpm": {
    "Image|endswith": "/rpm",
    "CommandLine|contains": " -e "
  },
  "condition": "1 of selection_*"
}

References:
  - https://sysdig.com/blog/mitre-defense-evasion-falco
  - https://www.tutorialspoint.com/how-to-install-a-software-on-linux-using-yum-command
  - https://linuxhint.com/uninstall_yum_package/
  - https://linuxhint.com/uninstall-debian-packages/
Sigma Detection Rule: ESXi System Information Discovery Via ESXCLI
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Cedric Maurugeon
Date: 2023-09-04
ATT&CK techniques: T1033, T1007, T1059.012
Log source: linux/process_creation

Description:
Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.

Detection logic:
{
  "selection_img": {
    "Image|endswith": "/esxcli",
    "CommandLine|contains": "system"
  },
  "selection_cli": {
    "CommandLine|contains": [
      " get",
      " list"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/
  - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html
Sigma Detection Rule: Clipboard Collection with Xclip Tool
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Pawel Mazur, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
Date: 2021-10-15
ATT&CK techniques: T1115
Log source: linux/process_creation

Description:
Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed.
Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.


Detection logic:
{
  "selection": {
    "Image|contains": "xclip",
    "CommandLine|contains|all": [
      "-sel",
      "clip",
      "-o"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.packetlabs.net/posts/clipboard-data-security/
Sigma Detection Rule: Connection Proxy
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Ömer Günal
Date: 2020-06-17
ATT&CK techniques: T1090
Log source: linux/process_creation

Description:
Detects setting proxy configuration

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "http_proxy=",
      "https_proxy="
    ]
  },
  "condition": "selection"
}
Sigma Detection Rule: Flush Iptables Ufw Chain
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-01-18
ATT&CK techniques: T1686
Log source: linux/process_creation

Description:
Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic

Detection logic:
{
  "selection_img": {
    "Image|endswith": [
      "/iptables",
      "/xtables-legacy-multi",
      "/iptables-legacy-multi",
      "/ip6tables",
      "/ip6tables-legacy-multi"
    ]
  },
  "selection_params": {
    "CommandLine|contains": [
      "-F",
      "-Z",
      "-X"
    ]
  },
  "selection_ufw": {
    "CommandLine|contains": [
      "ufw-logging-deny",
      "ufw-logging-allow",
      "ufw6-logging-deny",
      "ufw6-logging-allow"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://blogs.blackberry.com/
  - https://www.cyberciti.biz/tips/linux-iptables-how-to-flush-all-rules.html
  - https://twitter.com/Joseliyo_Jstnk/status/[PII_REDACTED]74822144
Sigma Detection Rule: Linux HackTool Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])
Date: 2023-01-03
ATT&CK techniques: T1587
Log source: linux/process_creation

Description:
Detects known hacktool execution based on image name.

Detection logic:
{
  "selection_c2_frameworks": {
    "Image|endswith": [
      "/crackmapexec",
      "/havoc",
      "/merlin-agent",
      "/merlinServer-Linux-x64",
      "/msfconsole",
      "/msfvenom",
      "/ps-empire server",
      "/ps-empire",
      "/sliver-client",
      "/sliver-server",
      "/Villain.py"
    ]
  },
  "selection_c2_framework_cobaltstrike": {
    "Image|contains": [
      "/cobaltstrike",
      "/teamserver"
    ]
  },
  "selection_scanners": {
    "Image|endswith": [
      "/autorecon",
      "/httpx",
      "/legion",
      "/naabu",
      "/netdiscover",
      "/nuclei",
      "/recon-ng"
    ]
  },
  "selection_scanners_sniper": {
    "Image|contains": "/sniper"
  },
  "selection_web_enum": {
    "Image|endswith": [
      "/dirb",
      "/dirbuster",
      "/eyewitness",
      "/feroxbuster",
      "/ffuf",
      "/gobuster",
      "/wfuzz",
      "/whatweb"
    ]
  },
  "selection_web_vuln": {
    "Image|endswith": [
      "/joomscan",
      "/nikto",
      "/wpscan"
    ]
  },
  "selection_exploit_tools": {
    "Image|endswith": [
      "/aircrack-ng",
      "/bloodhound-python",
      "/bpfdos",
      "/ebpfki",
      "/evil-winrm",
      "/hashcat",
      "/hoaxshell.py",
      "/hydra",
      "/john",
      "/ncrack",
      "/nxc-ubuntu-latest",
      "/pidhide",
      "/pspy32",
      "/pspy32s",
      "/pspy64",
      "/pspy64s",
      "/setoolkit",
      "/sqlmap",
      "/writeblocker"
    ]
  },
  "selection_linpeas": {
    "Image|contains": "/li

References:
  - https://github.com/Gui774ume/ebpfkit
  - https://github.com/pathtofile/bad-bpf
  - https://github.com/carlospolop/PEASS-ng
  - https://github.com/t3l3machus/hoaxshell
  - https://github.com/t3l3machus/Villain
Sigma Detection Rule: System Network Connections Discovery - Linux
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Daniil Yugoslavskiy, oscd.community
Date: 2020-10-19
ATT&CK techniques: T1049
Log source: linux/process_creation

Description:
Detects usage of system utilities to discover system network connections

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "/who",
      "/w",
      "/last",
      "/lsof",
      "/netstat"
    ]
  },
  "filter_landscape_sysinfo": {
    "ParentCommandLine|contains": "/usr/bin/landscape-sysinfo",
    "Image|endswith": "/who"
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md
Sigma Detection Rule: Potential Ruby Reverse Shell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @d4ns4n_
Date: 2023-04-07
Log source: linux/process_creation

Description:
Detects execution of ruby with the "-e" flag and calls to "socket" related functions. This could be an indication of a potential attempt to setup a reverse shell

Detection logic:
{
  "selection": {
    "Image|contains": "ruby",
    "CommandLine|contains|all": [
      " -e",
      "rsocket",
      "TCPSocket"
    ],
    "CommandLine|contains": [
      " ash",
      " bash",
      " bsh",
      " csh",
      " ksh",
      " pdksh",
      " sh",
      " tcsh"
    ]
  },
  "condition": "selection"
}

References:
  - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
  - https://www.revshells.com/
Sigma Detection Rule: ESXi Admin Permission Assigned To Account Via ESXCLI
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-09-04
ATT&CK techniques: T1059.012, T1098
Log source: linux/process_creation

Description:
Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.

Detection logic:
{
  "selection": {
    "Image|endswith": "/esxcli",
    "CommandLine|contains": "system",
    "CommandLine|contains|all": [
      " permission ",
      " set",
      "Admin"
    ]
  },
  "condition": "selection"
}

References:
  - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html
Sigma Detection Rule: ESXi VM Kill Via ESXCLI
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon
Date: 2023-09-04
ATT&CK techniques: T1059.012, T1529
Log source: linux/process_creation

Description:
Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.

Detection logic:
{
  "selection": {
    "Image|endswith": "/esxcli",
    "CommandLine|contains|all": [
      "vm process",
      "kill"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/
  - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html
  - https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/
  - https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html
Sigma Detection Rule: Shell Execution via Rsync - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth
Date: 2024-09-02
ATT&CK techniques: T1059
Log source: linux/process_creation

Description:
Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.


Detection logic:
{
  "selection_img": {
    "Image|endswith": [
      "/rsync",
      "/rsyncd"
    ],
    "CommandLine|contains": " -e "
  },
  "selection_cli": {
    "CommandLine|contains": [
      "/ash ",
      "/bash ",
      "/dash ",
      "/csh ",
      "/sh ",
      "/zsh ",
      "/tcsh ",
      "/ksh ",
      "'ash ",
      "'bash ",
      "'dash ",
      "'csh ",
      "'sh ",
      "'zsh ",
      "'tcsh ",
      "'ksh "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://gtfobins.github.io/gtfobins/rsync/#shell
Sigma Detection Rule: File Deletion
Repository: SigmaHQ/sigma
Severity: informational
Status: stable
Author: Ömer Günal, oscd.community
Date: 2020-10-07
ATT&CK techniques: T1070.004
Log source: linux/process_creation

Description:
Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "/rm",
      "/shred",
      "/unlink"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md
Sigma Detection Rule: Bash Interactive Shell
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: @d4ns4n_
Date: 2023-04-07
Log source: linux/process_creation

Description:
Detects execution of the bash shell with the interactive flag "-i".

Detection logic:
{
  "selection": {
    "Image|endswith": "/bash",
    "CommandLine|contains": " -i "
  },
  "condition": "selection"
}

References:
  - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
  - https://www.revshells.com/
  - https://linux.die.net/man/1/bash
Sigma Detection Rule: Capsh Shell Invocation - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
Date: 2024-09-02
ATT&CK techniques: T1059
Log source: linux/process_creation

Description:
Detects the use of the "capsh" utility to invoke a shell.


Detection logic:
{
  "selection": {
    "Image|endswith": "/capsh",
    "CommandLine|endswith": " --"
  },
  "condition": "selection"
}

References:
  - https://gtfobins.github.io/gtfobins/capsh/#shell
  - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
Sigma Detection Rule: Linux Recon Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-06-20
ATT&CK techniques: T1592.004, T1552.001
Log source: linux/process_creation

Description:
Detects events with patterns found in commands used for reconnaissance on linux systems

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      " -name .htpasswd",
      " -perm -4000 "
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/sleventyeleven/linuxprivchecker/blob/0d701080bbf92efd464e97d71a70f97c6f2cd658/linuxprivchecker.py
Sigma Detection Rule: Linux Remote System Discovery
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Alejandro Ortuno, oscd.community
Date: 2020-10-22
ATT&CK techniques: T1018
Log source: linux/process_creation

Description:
Detects the enumeration of other remote systems.

Detection logic:
{
  "selection_1": {
    "Image|endswith": "/arp",
    "CommandLine|contains": "-a"
  },
  "selection_2": {
    "Image|endswith": "/ping",
    "CommandLine|contains": [
      " 10.",
      " 192.168.",
      " 172.16.",
      " 172.17.",
      " 172.18.",
      " 172.19.",
      " 172.20.",
      " 172.21.",
      " 172.22.",
      " 172.23.",
      " 172.24.",
      " 172.25.",
      " 172.26.",
      " 172.27.",
      " 172.28.",
      " 172.29.",
      " 172.30.",
      " 172.31.",
      " 127.",
      " 169.254."
    ]
  },
  "condition": "1 of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md
Sigma Detection Rule: Potential Xterm Reverse Shell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @d4ns4n_
Date: 2023-04-24
ATT&CK techniques: T1059
Log source: linux/process_creation

Description:
Detects usage of "xterm" as a potential reverse shell tunnel

Detection logic:
{
  "selection": {
    "Image|contains": "xterm",
    "CommandLine|contains": "-display",
    "CommandLine|endswith": ":1"
  },
  "condition": "selection"
}

References:
  - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
  - https://www.revshells.com/
Sigma Detection Rule: Linux Setuid Capability Set on a Binary via Setcap Utility
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: Luc Génaux
Date: 2026-01-24
ATT&CK techniques: T1548, T1554
Log source: linux/process_creation

Description:
Detects the use of the 'setcap' utility to set the 'setuid' capability (cap_setuid) on a binary file.
This capability allows a non privileged process to make arbitrary manipulations of user IDs (UIDs), including setting its current UID to a value that would otherwise be restricted (i.e. UID 0, the root user).
This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.


Detection logic:
{
  "selection": {
    "Image|endswith": "/setcap",
    "CommandLine|contains": "cap_setuid"
  },
  "condition": "selection"
}

References:
  - https://man7.org/linux/man-pages/man8/setcap.8.html
  - https://dfir.ch/posts/linux_capabilities/
  - https://juggernaut-sec.com/capabilities/#cap_setuid
Sigma Detection Rule: Triple Cross eBPF Rootkit Install Commands
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-05
ATT&CK techniques: T1014
Log source: linux/process_creation

Description:
Detects default install commands of the Triple Cross eBPF rootkit based on the "deployer.sh" script

Detection logic:
{
  "selection": {
    "Image|endswith": "/sudo",
    "CommandLine|contains|all": [
      " tc ",
      " enp0s3 "
    ],
    "CommandLine|contains": [
      " qdisc ",
      " filter "
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/apps/deployer.sh
Sigma Detection Rule: Download File To Potentially Suspicious Directory Via Wget
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-06-02
ATT&CK techniques: T1105
Log source: linux/process_creation

Description:
Detects the use of wget to download content to a suspicious directory

Detection logic:
{
  "selection_img": {
    "Image|endswith": "/wget"
  },
  "selection_output": [
    {
      "CommandLine|re": "\\s-O\\s"
    },
    {
      "CommandLine|contains": "--output-document"
    }
  ],
  "selection_path": {
    "CommandLine|contains": "/tmp/"
  },
  "condition": "all of selection_*"
}

References:
  - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
  - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/
  - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
  - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
Sigma Detection Rule: File and Directory Discovery - Linux
Repository: SigmaHQ/sigma
Severity: informational
Status: test
Author: Daniil Yugoslavskiy, oscd.community, CheraghiMilad
Date: 2020-10-19
ATT&CK techniques: T1083
Log source: linux/process_creation

Description:
Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.


Detection logic:
{
  "selection_file_with_asterisk": {
    "Image|endswith": "/file",
    "CommandLine|re": "(.){200,}"
  },
  "selection_recursive_ls": {
    "Image|endswith": "/ls",
    "CommandLine|contains": "-R"
  },
  "selection_find_execution": {
    "Image|endswith": "/find"
  },
  "selection_tree_execution": {
    "Image|endswith": "/tree"
  },
  "selection_findmnt_execution": {
    "Image|endswith": "/findmnt"
  },
  "selection_locate_execution": {
    "Image|endswith": "/mlocate"
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md
Sigma Detection Rule: DD File Overwrite
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
Date: 2021-10-15
ATT&CK techniques: T1485
Log source: linux/process_creation

Description:
Detects potential overwriting and deletion of a file using DD.

Detection logic:
{
  "selection1": {
    "Image": [
      "/bin/dd",
      "/usr/bin/dd"
    ]
  },
  "selection2": {
    "CommandLine|contains": "of="
  },
  "selection3": {
    "CommandLine|contains": [
      "if=/dev/zero",
      "if=/dev/null"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md#atomic-test-2---macoslinux---overwrite-file-with-dd
Sigma Detection Rule: PUA - TruffleHog Execution - Linux
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-09-24
ATT&CK techniques: T1083, T1552.001
Log source: linux/process_creation

Description:
Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously.
While it is a legitimate tool, intended for use in CI pipelines and security assessments,
It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.


Detection logic:
{
  "selection_img": {
    "Image|endswith": "/trufflehog"
  },
  "selection_cli_platform": {
    "CommandLine|contains": [
      " docker --image ",
      " Git ",
      " GitHub ",
      " Jira ",
      " Slack ",
      " Confluence ",
      " SharePoint ",
      " s3 ",
      " gcs "
    ]
  },
  "selection_cli_verified": {
    "CommandLine|contains": " --results=verified"
  },
  "condition": "selection_img or all of selection_cli_*"
}

References:
  - https://github.com/trufflesecurity/trufflehog
  - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack