deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Disable Or Stop Services
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-15
ATT&CK techniques: T1685, T1489
Log source: linux/process_creation

Description:
Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux systems.
Attackers may stop or disable security tools and services to evade detection, maintain persistence, or disrupt system operations.


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "/service",
      "/systemctl",
      "/chkconfig"
    ],
    "CommandLine|contains": [
      " stop ",
      " disable "
    ]
  },
  "filter_main_legit_snapd": {
    "Image|endswith": "/systemctl",
    "CommandLine|contains": [
      "--no-reload disable snap-snapd-",
      " stop snap-snapd-"
    ]
  },
  "filter_main_ssh_preinstall": {
    "Image|endswith": "/systemctl",
    "ParentCommandLine|contains": "tmp.ci/preinst upgrade",
    "CommandLine|contains|all": [
      " stop ",
      "ssh."
    ]
  },
  "filter_main_ubuntu_upgrade": {
    "ParentCommandLine|contains": "/dpkg/info/ubuntu-pro-client.prerm upgrade",
    "Image|endswith": "/systemctl"
  },
  "filter_optional_aws_agent": {
    "Image|endswith": "/systemctl",
    "CommandLine|endswith": "snap.amazon-ssm-agent.amazon-ssm-agent.service"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html
Sigma Detection Rule: Potential Linux Amazon SSM Agent Hijacking
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Muhammad Faisal
Date: 2023-08-03
ATT&CK techniques: T1219.002
Log source: linux/process_creation

Description:
Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

Detection logic:
{
  "selection": {
    "Image|endswith": "/amazon-ssm-agent",
    "CommandLine|contains|all": [
      "-register ",
      "-code ",
      "-id ",
      "-region "
    ]
  },
  "condition": "selection"
}

References:
  - https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan
  - https://www.bleepingcomputer.com/news/security/amazons-aws-ssm-agent-can-be-used-as-post-exploitation-rat-malware/
  - https://www.helpnetsecurity.com/2023/08/02/aws-instances-attackers-access/
Sigma Detection Rule: Container Residence Discovery Via Proc Virtual FS
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Seth Hanford
Date: 2023-08-23
ATT&CK techniques: T1082
Log source: linux/process_creation

Description:
Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem

Detection logic:
{
  "selection_tools": {
    "Image|endswith": [
      "awk",
      "/cat",
      "grep",
      "/head",
      "/less",
      "/more",
      "/nl",
      "/tail"
    ]
  },
  "selection_procfs_kthreadd": {
    "CommandLine|contains": "/proc/2/"
  },
  "selection_procfs_target": {
    "CommandLine|contains": "/proc/",
    "CommandLine|endswith": [
      "/cgroup",
      "/sched"
    ]
  },
  "condition": "selection_tools and 1 of selection_procfs_*"
}

References:
  - https://blog.skyplabs.net/posts/container-detection/
  - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker
Sigma Detection Rule: Curl Usage on Linux
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-15
ATT&CK techniques: T1105
Log source: linux/process_creation

Description:
Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to a remote server

Detection logic:
{
  "selection": {
    "Image|endswith": "/curl"
  },
  "condition": "selection"
}

References:
  - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html
Sigma Detection Rule: Kaspersky Endpoint Security Stopped Via CommandLine - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Milad Cheraghi
Date: 2025-10-18
ATT&CK techniques: T1685
Log source: linux/process_creation

Description:
Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl.
This activity may indicate a manual interruption of the antivirus service by an administrator, or it could be a sign of potential tampering or evasion attempts by malicious actors.


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "/systemctl",
      "/bash",
      "/sh"
    ],
    "CommandLine|contains|all": [
      "stop",
      "kesl"
    ]
  },
  "condition": "selection"
}

References:
  - https://support.kaspersky.com/KES4Linux/12.0.0/en-US/197929.htm
Sigma Detection Rule: Mask System Power Settings Via Systemctl
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Milad Cheraghi, Nasreddine Bencherchali
Date: 2025-10-17
ATT&CK techniques: T1653
Log source: linux/process_creation

Description:
Detects the use of systemctl mask to disable system power management targets such as suspend, hibernate, or hybrid sleep.
Adversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their malicious processes remain active and uninterrupted.
This behavior can be associated with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of malicious activity.


Detection logic:
{
  "selection_systemctl": {
    "Image|endswith": "/systemctl",
    "CommandLine|contains": " mask"
  },
  "selection_power_options": {
    "CommandLine|contains": [
      "suspend.target",
      "hibernate.target",
      "hybrid-sleep.target"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.man7.org/linux/man-pages/man1/systemctl.1.html
  - https://linux-audit.com/systemd/faq/what-is-the-difference-between-systemctl-disable-and-systemctl-mask/
Sigma Detection Rule: Triple Cross eBPF Rootkit Execve Hijack
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-05
Log source: linux/process_creation

Description:
Detects execution of a the file "execve_hijack" which is used by the Triple Cross rootkit as a way to elevate privileges

Detection logic:
{
  "selection": {
    "Image|endswith": "/sudo",
    "CommandLine|contains": "execve_hijack"
  },
  "condition": "selection"
}

References:
  - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/src/helpers/execve_hijack.c#L275
Sigma Detection Rule: Shell Invocation Via Ssh - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
Date: 2024-08-29
ATT&CK techniques: T1059
Log source: linux/process_creation

Description:
Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.


Detection logic:
{
  "selection_img": {
    "Image|endswith": "/ssh",
    "CommandLine|contains": [
      "ProxyCommand=;",
      "permitlocalcommand=yes",
      "localhost"
    ]
  },
  "selection_cli": {
    "CommandLine|contains": [
      "/bin/bash",
      "/bin/dash",
      "/bin/fish",
      "/bin/sh",
      "/bin/zsh",
      "sh 0<&2 1>&2",
      "sh 1>&2 0<&2"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://gtfobins.github.io/gtfobins/ssh/
  - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
Sigma Detection Rule: User Has Been Deleted Via Userdel
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tuan Le (NCSGroup)
Date: 2022-12-26
ATT&CK techniques: T1531
Log source: linux/process_creation

Description:
Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks

Detection logic:
{
  "selection": {
    "Image|endswith": "/userdel"
  },
  "condition": "selection"
}

References:
  - https://linuxize.com/post/how-to-delete-group-in-linux/
  - https://www.cyberciti.biz/faq/linux-remove-user-command/
  - https://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/
  - https://linux.die.net/man/8/userdel
Sigma Detection Rule: Enable BPF Kprobes Tracing
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-25
Log source: linux/process_creation

Description:
Detects common command used to enable bpf kprobes tracing

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "echo 1 >",
      "/sys/kernel/debug/tracing/events/kprobes/"
    ],
    "CommandLine|contains": [
      "/myprobe/enable",
      "/myretprobe/enable"
    ]
  },
  "condition": "selection"
}

References:
  - https://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace/
  - https://bpftrace.org/
  - https://www.kernel.org/doc/html/v5.0/trace/kprobetrace.html
Sigma Detection Rule: Execution Of Script Located In Potentially Suspicious Directory
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-06-02
Log source: linux/process_creation

Description:
Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh", etc.

Detection logic:
{
  "selection_img": {
    "Image|endswith": [
      "/bash",
      "/csh",
      "/dash",
      "/fish",
      "/ksh",
      "/sh",
      "/zsh"
    ]
  },
  "selection_flag": {
    "CommandLine|contains": " -c "
  },
  "selection_paths": {
    "CommandLine|contains": "/tmp/"
  },
  "condition": "all of selection_*"
}

References:
  - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
  - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/
  - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
  - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
Sigma Detection Rule: Potential PHP Reverse Shell
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @d4ns4n_
Date: 2023-04-07
Log source: linux/process_creation

Description:
Detects usage of the PHP CLI with the "-r" flag which allows it to run inline PHP code. The rule looks for calls to the "fsockopen" function which allows the creation of sockets.
Attackers often leverage this in combination with functions such as "exec" or "fopen" to initiate a reverse shell connection.


Detection logic:
{
  "selection": {
    "Image|contains": "/php",
    "CommandLine|contains|all": [
      " -r ",
      "fsockopen"
    ],
    "CommandLine|contains": [
      "ash",
      "bash",
      "bsh",
      "csh",
      "ksh",
      "pdksh",
      "sh",
      "tcsh",
      "zsh"
    ]
  },
  "condition": "selection"
}

References:
  - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
  - https://www.revshells.com/
Sigma Detection Rule: ESXi Syslog Configuration Change Via ESXCLI
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Cedric Maurugeon
Date: 2023-09-04
ATT&CK techniques: T1685, T1690, T1059.012
Log source: linux/process_creation

Description:
Detects changes to the ESXi syslog configuration via "esxcli"

Detection logic:
{
  "selection": {
    "Image|endswith": "/esxcli",
    "CommandLine|contains|all": [
      "system",
      "syslog",
      "config"
    ],
    "CommandLine|contains": " set"
  },
  "condition": "selection"
}

References:
  - https://support.solarwinds.com/SuccessCenter/s/article/Configure-ESXi-Syslog-to-LEM?language=en_US
  - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html
Sigma Detection Rule: Group Has Been Deleted Via Groupdel
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tuan Le (NCSGroup)
Date: 2022-12-26
ATT&CK techniques: T1531
Log source: linux/process_creation

Description:
Detects execution of the "groupdel" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks

Detection logic:
{
  "selection": {
    "Image|endswith": "/groupdel"
  },
  "condition": "selection"
}

References:
  - https://linuxize.com/post/how-to-delete-group-in-linux/
  - https://www.cyberciti.biz/faq/linux-remove-user-command/
  - https://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/
  - https://linux.die.net/man/8/groupdel
Sigma Detection Rule: Syslog Clearing or Removal Via System Utilities
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Max Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
Date: 2021-10-15
ATT&CK techniques: T1685.006
Log source: linux/process_creation

Description:
Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a method to hide their tracks


Detection logic:
{
  "selection_file": {
    "CommandLine|contains": "/var/log/syslog"
  },
  "selection_command_rm": {
    "Image|endswith": "/rm",
    "CommandLine|contains": [
      " -r ",
      " -f ",
      " -rf ",
      "/var/log/syslog"
    ]
  },
  "selection_command_unlink": {
    "Image|endswith": "/unlink"
  },
  "selection_command_mv": {
    "Image|endswith": "/mv"
  },
  "selection_command_truncate": {
    "Image|endswith": "/truncate",
    "CommandLine|contains|all": [
      "0 ",
      "/var/log/syslog"
    ],
    "CommandLine|contains": [
      "-s ",
      "-c ",
      "--size"
    ]
  },
  "selection_command_ln": {
    "Image|endswith": "/ln",
    "CommandLine|contains|all": [
      "/dev/null ",
      "/var/log/syslog"
    ],
    "CommandLine|contains": [
      "-sf ",
      "-sfn ",
      "-sfT "
    ]
  },
  "selection_command_cp": {
    "Image|endswith": "/cp",
    "CommandLine|contains": "/dev/null"
  },
  "selection_command_shred": {
    "Image|endswith": "/shred",
    "CommandLine|contains": "-u "
  },
  "selection_unique_other": {
    "CommandLine|contains": [
      " > /var/log/syslog",
      " >/var/log/syslog",
      " >| /var/log/syslog",
      ": > /var/log/syslog",
      ":> /var/log/syslog",
      ":>/var/log/syslog",
      ">|/var/log/syslog"
    ]
  },
  "selection_unique_journalctl": {
    "CommandLine|contains": [
      "journalctl --vacuum",
      "journalctl --rotate"
    ]
  },
  "condition": "(selection_file and 1 of selection_command_*) or 1 of sele

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md
  - https://www.virustotal.com/gui/file/54d60fd58d7fa3475fa123985bfc1594df26da25c1f5fbc7dfdba15876dd8ac5/behavior
Sigma Detection Rule: Script Interpreter Spawning Credential Scanner - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-25
ATT&CK techniques: T1552, T1005, T1059.004
Log source: linux/process_creation

Description:
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.


Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": [
      "/node",
      "/bun"
    ]
  },
  "selection_child": [
    {
      "Image|endswith": [
        "/trufflehog",
        "/gitleaks"
      ]
    },
    {
      "CommandLine|contains": [
        "trufflehog",
        "gitleaks"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/bun_environment.js
  - https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised
  - https://www.endorlabs.com/learn/shai-hulud-2-malware-campaign-targets-github-and-cloud-credentials-using-bun-runtime
  - https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/
Sigma Detection Rule: Docker Container Discovery Via Dockerenv Listing
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Seth Hanford
Date: 2023-08-23
ATT&CK techniques: T1082
Log source: linux/process_creation

Description:
Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "/cat",
      "/dir",
      "/find",
      "/ls",
      "/stat",
      "/test",
      "grep"
    ],
    "CommandLine|endswith": ".dockerenv"
  },
  "condition": "selection"
}

References:
  - https://blog.skyplabs.net/posts/container-detection/
  - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker
Sigma Detection Rule: Decode Base64 Encoded Text
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Daniil Yugoslavskiy, oscd.community
Date: 2020-10-19
ATT&CK techniques: T1027
Log source: linux/process_creation

Description:
Detects usage of base64 utility to decode arbitrary base64-encoded text

Detection logic:
{
  "selection": {
    "Image|endswith": "/base64",
    "CommandLine|contains": "-d"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md
Sigma Detection Rule: BPFtrace Unsafe Option Usage
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Andreas Hunkeler (@Karneades)
Date: 2022-02-11
ATT&CK techniques: T1059.004
Log source: linux/process_creation

Description:
Detects the usage of the unsafe bpftrace option

Detection logic:
{
  "selection": {
    "Image|endswith": "bpftrace",
    "CommandLine|contains": "--unsafe"
  },
  "condition": "selection"
}

References:
  - https://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace/
  - https://bpftrace.org/
Sigma Detection Rule: Copy Passwd Or Shadow From TMP Path
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-01-31
ATT&CK techniques: T1552.001
Log source: linux/process_creation

Description:
Detects when the file "passwd" or "shadow" is copied from tmp path

Detection logic:
{
  "selection_img": {
    "Image|endswith": "/cp"
  },
  "selection_path": {
    "CommandLine|contains": "/tmp/"
  },
  "selection_file": {
    "CommandLine|contains": [
      "passwd",
      "shadow"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://blogs.blackberry.com/
  - https://twitter.com/Joseliyo_Jstnk/status/[PII_REDACTED]74822144
Sigma Detection Rule: Audit Rules Deleted Via Auditctl
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Mohamed LAKRI
Date: 2025-10-17
ATT&CK techniques: T1685.004
Log source: linux/process_creation

Description:
Detects the execution of 'auditctl' with the '-D' command line parameter, which deletes all configured audit rules and watches on Linux systems.
This technique is commonly used by attackers to disable audit logging and cover their tracks by removing monitoring capabilities.
Removal of audit rules can significantly impair detection of malicious activities on the affected system.


Detection logic:
{
  "selection": {
    "Image|endswith": "/auditctl",
    "CommandLine|re": "-D"
  },
  "condition": "selection"
}

References:
  - https://www.atomicredteam.io/atomic-red-team/atomics/T1562.012
  - https://linux.die.net/man/8/auditct
Sigma Detection Rule: Mount Execution With Hidepid Parameter
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-01-12
ATT&CK techniques: T1564
Log source: linux/process_creation

Description:
Detects execution of the "mount" command with "hidepid" parameter to make invisible processes to other users from the system

Detection logic:
{
  "selection": {
    "Image|endswith": "/mount",
    "CommandLine|contains|all": [
      "hidepid=2",
      " -o "
    ]
  },
  "condition": "selection"
}

References:
  - https://blogs.blackberry.com/
  - https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/
  - https://twitter.com/Joseliyo_Jstnk/status/[PII_REDACTED]74822144
Sigma Detection Rule: Ufw Force Stop Using Ufw-Init
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-01-18
ATT&CK techniques: T1686
Log source: linux/process_creation

Description:
Detects attempts to force stop the ufw using ufw-init

Detection logic:
{
  "selection_init": {
    "CommandLine|contains|all": [
      "-ufw-init",
      "force-stop"
    ]
  },
  "selection_ufw": {
    "CommandLine|contains|all": [
      "ufw",
      "disable"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://blogs.blackberry.com/
  - https://twitter.com/Joseliyo_Jstnk/status/[PII_REDACTED]74822144
Sigma Detection Rule: Nohup Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
Date: 2022-06-06
ATT&CK techniques: T1059.004
Log source: linux/process_creation

Description:
Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments

Detection logic:
{
  "selection": {
    "Image|endswith": "/nohup"
  },
  "condition": "selection"
}

References:
  - https://gtfobins.github.io/gtfobins/nohup/
  - https://en.wikipedia.org/wiki/Nohup
  - https://www.computerhope.com/unix/unohup.htm
Sigma Detection Rule: Linux Crypto Mining Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-10-26
ATT&CK techniques: T1496
Log source: linux/process_creation

Description:
Detects command line parameters or strings often used by crypto miners

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      " --cpu-priority=",
      "--donate-level=0",
      " -o pool.",
      " --nicehash",
      " --algo=rx/0 ",
      "stratum+tcp://",
      "stratum+udp://",
      "sh -c /sbin/modprobe msr allow_writes=on",
      "LS1kb25hdGUtbGV2ZWw9",
      "0tZG9uYXRlLWxldmVsP",
      "tLWRvbmF0ZS1sZXZlbD",
      "c3RyYXR1bSt0Y3A6Ly",
      "N0cmF0dW0rdGNwOi8v",
      "zdHJhdHVtK3RjcDovL",
      "c3RyYXR1bSt1ZHA6Ly",
      "N0cmF0dW0rdWRwOi8v",
      "zdHJhdHVtK3VkcDovL"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.poolwatch.io/coin/monero
Sigma Detection Rule: Setuid and Setgid
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Ömer Günal
Date: 2020-06-16
ATT&CK techniques: T1548.001
Log source: linux/process_creation

Description:
Detects suspicious change of file privileges with chown and chmod commands

Detection logic:
{
  "selection_root": {
    "CommandLine|contains": "chown root"
  },
  "selection_perm": {
    "CommandLine|contains": [
      " chmod u+s",
      " chmod g+s"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.001/T1548.001.md
Sigma Detection Rule: Scheduled Task/Job At
Repository: SigmaHQ/sigma
Severity: low
Status: stable
Author: Ömer Günal, oscd.community
Date: 2020-10-06
ATT&CK techniques: T1053.002
Log source: linux/process_creation

Description:
Detects the use of at/atd which are utilities that are used to schedule tasks.
They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "/at",
      "/atd"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.002/T1053.002.md