deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Steganography Hide Zip Information in Picture File
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Pawel Mazur
Date: 2021-09-09
ATT&CK techniques: T1027.003
Log source: linux/

Description:
Detects appending of zip file to image

Detection logic:
{
  "commands": {
    "type": "EXECVE",
    "a0": "cat"
  },
  "a1": {
    "a1|endswith": [
      ".jpg",
      ".png"
    ]
  },
  "a2": {
    "a2|endswith": ".zip"
  },
  "condition": "commands and a1 and a2"
}

References:
  - https://zerotoroot.me/steganography-hiding-a-zip-in-a-jpeg-file/
Sigma Detection Rule: Hidden Files and Directories
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Pawel Mazur
Date: 2021-09-06
ATT&CK techniques: T1564.001
Log source: linux/

Description:
Detects adversary creating hidden file or directory, by detecting directories or files with . as the first character

Detection logic:
{
  "selection_commands": {
    "type": "EXECVE",
    "a0": [
      "mkdir",
      "nano",
      "touch",
      "vi",
      "vim"
    ]
  },
  "selection_arguments": [
    {
      "a1|re": "(^|\\/)\\.[^.\\/]"
    },
    {
      "a2|re": "(^|\\/)\\.[^.\\/]"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md
Sigma Detection Rule: Data Exfiltration with Wget
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Pawel Mazur
Date: 2021-11-18
ATT&CK techniques: T1048.003
Log source: linux/

Description:
Detects attempts to post the file with the usage of wget utility.
The adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could allow them to read files like /etc/shadow.


Detection logic:
{
  "selection": {
    "type": "EXECVE",
    "a0": "wget",
    "a1|startswith": "--post-file="
  },
  "condition": "selection"
}

References:
  - https://linux.die.net/man/1/wget
  - https://gtfobins.github.io/gtfobins/wget/
Sigma Detection Rule: Overwriting the File with Dev Zero or Null
Repository: SigmaHQ/sigma
Severity: low
Status: stable
Author: Jakob Weinzettl, oscd.community
Date: 2019-10-23
ATT&CK techniques: T1485
Log source: linux/

Description:
Detects overwriting (effectively wiping/deleting) of a file.

Detection logic:
{
  "selection": {
    "type": "EXECVE",
    "a0|contains": "dd",
    "a1|contains": [
      "if=/dev/null",
      "if=/dev/zero"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md
Sigma Detection Rule: Possible Coin Miner CPU Priority Param
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-10-09
ATT&CK techniques: T1068
Log source: linux/

Description:
Detects command line parameter very often used with coin miners

Detection logic:
{
  "cmd1": {
    "a1|startswith": "--cpu-priority"
  },
  "cmd2": {
    "a2|startswith": "--cpu-priority"
  },
  "cmd3": {
    "a3|startswith": "--cpu-priority"
  },
  "cmd4": {
    "a4|startswith": "--cpu-priority"
  },
  "cmd5": {
    "a5|startswith": "--cpu-priority"
  },
  "cmd6": {
    "a6|startswith": "--cpu-priority"
  },
  "cmd7": {
    "a7|startswith": "--cpu-priority"
  },
  "condition": "1 of cmd*"
}

References:
  - https://xmrig.com/docs/miner/command-line-options
Sigma Detection Rule: Network Sniffing - Linux
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Timur Zinniatullin, oscd.community
Date: 2019-10-21
ATT&CK techniques: T1040
Log source: linux/

Description:
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.


Detection logic:
{
  "selection_1": {
    "type": "execve",
    "a0": "tcpdump",
    "a1": "-c",
    "a3|contains": "-i"
  },
  "selection_2": {
    "type": "execve",
    "a0": "tshark",
    "a1": "-c",
    "a3": "-i"
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1040/T1040.md
Sigma Detection Rule: Screen Capture with Xwd
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Pawel Mazur
Date: 2021-09-13
ATT&CK techniques: T1113
Log source: linux/

Description:
Detects adversary creating screen capture of a full with xwd. Highly recommended using rule on servers, due high usage of screenshot utilities on user workstations

Detection logic:
{
  "selection": {
    "type": "EXECVE",
    "a0": "xwd"
  },
  "xwd_root_window": {
    "a1": "-root",
    "a2": "-out",
    "a3|endswith": ".xwd"
  },
  "xwd_no_root_window": {
    "a1": "-out",
    "a2|endswith": ".xwd"
  },
  "condition": "selection and 1 of xwd_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md#atomic-test-3---x-windows-capture
  - https://linux.die.net/man/1/xwd
Sigma Detection Rule: Masquerading as Linux Crond Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Timur Zinniatullin, oscd.community
Date: 2019-10-21
ATT&CK techniques: T1036.003
Log source: linux/

Description:
Masquerading occurs when the name or location of an executable, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation.
Several different variations of this technique have been observed.


Detection logic:
{
  "selection": {
    "type": "execve",
    "a0": "cp",
    "a1": "/bin/sh",
    "a2|endswith": "/crond"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/8a82e9b66a5b4f4bc5b91089e9f24e0544f20ad7/atomics/T1036.003/T1036.003.md#atomic-test-2---masquerading-as-linux-crond-process
Sigma Detection Rule: Bpfdoor TCP Ports Redirect
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Rafal Piasecki
Date: 2022-08-10
ATT&CK techniques: T1686
Log source: linux/

Description:
All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392'
The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.


Detection logic:
{
  "cmd": {
    "type": "EXECVE",
    "a0|endswith": "iptables",
    "a1": "-t",
    "a2": "nat"
  },
  "keywords": [
    "--to-ports 42",
    "--to-ports 43"
  ],
  "condition": "cmd and keywords"
}

References:
  - https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/
  - https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor
Sigma Detection Rule: Suspicious Commands Linux
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-12-12
ATT&CK techniques: T1059.004
Log source: linux/

Description:
Detects relevant commands often related to malware or hacking activity

Detection logic:
{
  "cmd1": {
    "type": "EXECVE",
    "a0": "chmod",
    "a1": 777
  },
  "cmd2": {
    "type": "EXECVE",
    "a0": "chmod",
    "a1": "u+s"
  },
  "cmd3": {
    "type": "EXECVE",
    "a0": "cp",
    "a1": "/bin/ksh"
  },
  "cmd4": {
    "type": "EXECVE",
    "a0": "cp",
    "a1": "/bin/sh"
  },
  "condition": "1 of cmd*"
}

References:
  - Internal Research - mostly derived from exploit code including code in MSF
Sigma Detection Rule: Steganography Unzip Hidden Information From Picture File
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Pawel Mazur
Date: 2021-09-09
ATT&CK techniques: T1027.003
Log source: linux/

Description:
Detects extracting of zip file from image file

Detection logic:
{
  "commands": {
    "type": "EXECVE",
    "a0": "unzip"
  },
  "a1": {
    "a1|endswith": [
      ".jpg",
      ".png"
    ]
  },
  "condition": "commands and a1"
}

References:
  - https://zerotoroot.me/steganography-hiding-a-zip-in-a-jpeg-file/
Sigma Detection Rule: Credentials In Files - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Igor Fits, oscd.community
Date: 2020-10-15
ATT&CK techniques: T1552.001
Log source: linux/

Description:
Detecting attempts to extract passwords with grep

Detection logic:
{
  "selection": {
    "type": "EXECVE"
  },
  "keywords": {
    "|all": [
      "grep",
      "password"
    ]
  },
  "condition": "selection and keywords"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md
Sigma Detection Rule: Clipboard Collection with Xclip Tool - Auditd
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Pawel Mazur
Date: 2021-09-24
ATT&CK techniques: T1115
Log source: linux/

Description:
Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool.
Xclip has to be installed.
Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.


Detection logic:
{
  "selection": {
    "type": "EXECVE",
    "a0": "xclip",
    "a1": [
      "-selection",
      "-sel"
    ],
    "a2": [
      "clipboard",
      "clip"
    ],
    "a3": "-o"
  },
  "condition": "selection"
}

References:
  - https://linux.die.net/man/1/xclip
  - https://www.cyberciti.biz/faq/xclip-linux-insert-files-command-output-intoclipboard/
Sigma Detection Rule: File or Folder Permissions Change
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Jakob Weinzettl, oscd.community
Date: 2019-09-23
ATT&CK techniques: T1222.002
Log source: linux/

Description:
Detects file and folder permission changes.

Detection logic:
{
  "selection": {
    "type": "EXECVE",
    "a0|contains": [
      "chmod",
      "chown"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md
Sigma Detection Rule: Linux Capabilities Discovery
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Pawel Mazur
Date: 2021-11-28
ATT&CK techniques: T1083, T1548
Log source: linux/

Description:
Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.

Detection logic:
{
  "selection": {
    "type": "EXECVE",
    "a0": "getcap",
    "a1": "-r",
    "a2": "/"
  },
  "condition": "selection"
}

References:
  - https://man7.org/linux/man-pages/man8/getcap.8.html
  - https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/
  - https://mn3m.info/posts/suid-vs-capabilities/
  - https://int0x33.medium.com/day-44-linux-capabilities-privilege-escalation-via-openssl-with-selinux-enabled-and-enforced-74d2bec02099
Sigma Detection Rule: Suspicious History File Operations - Linux
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Mikhail Larin, oscd.community
Date: 2020-10-17
ATT&CK techniques: T1552.003
Log source: linux/

Description:
Detects commandline operations on shell history files

Detection logic:
{
  "execve": {
    "type": "EXECVE"
  },
  "history": [
    ".bash_history",
    ".zsh_history",
    ".zhistory",
    ".history",
    ".sh_history",
    "fish_history"
  ],
  "condition": "execve and history"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md
Sigma Detection Rule: Data Compressed
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Timur Zinniatullin, oscd.community
Date: 2019-10-21
ATT&CK techniques: T1560.001
Log source: linux/

Description:
An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Detection logic:
{
  "selection1": {
    "type": "execve",
    "a0": "zip"
  },
  "selection2": {
    "type": "execve",
    "a0": "gzip",
    "a1": "-k"
  },
  "selection3": {
    "type": "execve",
    "a0": "tar",
    "a1|contains": "-c"
  },
  "condition": "1 of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/a78b9ed805ab9ea2e422e1aa7741e9407d82d7b1/atomics/T1560.001/T1560.001.md
Sigma Detection Rule: Steganography Extract Files with Steghide
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Pawel Mazur
Date: 2021-09-11
ATT&CK techniques: T1027.003
Log source: linux/

Description:
Detects extraction of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.

Detection logic:
{
  "selection": {
    "type": "EXECVE",
    "a0": "steghide",
    "a1": "extract",
    "a2": "-sf",
    "a3|endswith": [
      ".jpg",
      ".png"
    ]
  },
  "condition": "selection"
}

References:
  - https://vitux.com/how-to-hide-confidential-files-in-images-on-debian-using-steganography/
Sigma Detection Rule: File Time Attribute Change - Linux
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Igor Fits, oscd.community
Date: 2020-10-15
ATT&CK techniques: T1070.006
Log source: linux/

Description:
Detect file time attribute change to hide new or changes to existing files.

Detection logic:
{
  "execve": {
    "type": "EXECVE"
  },
  "touch": [
    "touch"
  ],
  "selection2": [
    "-t",
    "-acmr",
    "-d",
    "-r"
  ],
  "condition": "execve and touch and selection2"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md
Sigma Detection Rule: Binary Padding - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Igor Fits, oscd.community
Date: 2020-10-13
ATT&CK techniques: T1027.001
Log source: linux/

Description:
Adversaries may use binary padding to add junk data and change the on-disk representation of malware.
This rule detect using dd and truncate to add a junk data to file.


Detection logic:
{
  "selection_execve": {
    "type": "EXECVE"
  },
  "keywords_truncate": {
    "|all": [
      "truncate",
      "-s"
    ]
  },
  "keywords_dd": {
    "|all": [
      "dd",
      "if="
    ]
  },
  "keywords_filter": [
    "of="
  ],
  "condition": "selection_execve and (keywords_truncate or (keywords_dd and not keywords_filter))"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.001/T1027.001.md
Sigma Detection Rule: Service Reload or Start - Linux
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Jakob Weinzettl, oscd.community, CheraghiMilad
Date: 2019-09-23
ATT&CK techniques: T1543.002
Log source: linux/

Description:
Detects the start, reload or restart of a service.

Detection logic:
{
  "selection": {
    "type": "EXECVE",
    "a0|contains": [
      "systemctl",
      "service"
    ],
    "a1|contains": [
      "reload",
      "start"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.002/T1543.002.md
Sigma Detection Rule: System Shutdown/Reboot - Linux
Repository: SigmaHQ/sigma
Severity: informational
Status: test
Author: Igor Fits, oscd.community
Date: 2020-10-15
ATT&CK techniques: T1529
Log source: linux/

Description:
Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.

Detection logic:
{
  "execve": {
    "type": "EXECVE"
  },
  "shutdowncmd": [
    "shutdown",
    "reboot",
    "halt",
    "poweroff"
  ],
  "init": [
    "init",
    "telinit"
  ],
  "initselection": [
    0,
    6
  ],
  "condition": "execve and (shutdowncmd or (init and initselection))"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md
Sigma Detection Rule: Steganography Hide Files with Steghide
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Pawel Mazur
Date: 2021-09-11
ATT&CK techniques: T1027.003
Log source: linux/

Description:
Detects embedding of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.

Detection logic:
{
  "selection": {
    "type": "EXECVE",
    "a0": "steghide",
    "a1": "embed",
    "a2": [
      "-cf",
      "-ef"
    ],
    "a4": [
      "-cf",
      "-ef"
    ]
  },
  "condition": "selection"
}

References:
  - https://vitux.com/how-to-hide-confidential-files-in-images-on-debian-using-steganography/
Sigma Detection Rule: Screen Capture with Import Tool
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Pawel Mazur
Date: 2021-09-21
ATT&CK techniques: T1113
Log source: linux/

Description:
Detects adversary creating screen capture of a desktop with Import Tool.
Highly recommended using rule on servers, due to high usage of screenshot utilities on user workstations.
ImageMagick must be installed.


Detection logic:
{
  "import": {
    "type": "EXECVE",
    "a0": "import"
  },
  "import_window_root": {
    "a1": "-window",
    "a2": "root",
    "a3|endswith": [
      ".png",
      ".jpg",
      ".jpeg"
    ]
  },
  "import_no_window_root": {
    "a1|endswith": [
      ".png",
      ".jpg",
      ".jpeg"
    ]
  },
  "condition": "import and (import_window_root or import_no_window_root)"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md
  - https://linux.die.net/man/1/import
  - https://imagemagick.org/
Sigma Detection Rule: Remove Immutable File Attribute - Auditd
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Jakob Weinzettl, oscd.community
Date: 2019-09-23
ATT&CK techniques: T1222.002
Log source: linux/

Description:
Detects removing immutable file attribute.

Detection logic:
{
  "selection": {
    "type": "EXECVE",
    "a0|contains": "chattr",
    "a1|contains": "-i"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md
Sigma Detection Rule: System Info Discovery via Sysinfo Syscall
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: Milad Cheraghi
Date: 2025-05-30
ATT&CK techniques: T1057, T1082
Log source: linux/

Description:
Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes.
Malware or reconnaissance tools might leverage sysinfo to fingerprint the system - gathering data to determine if it's a viable target.


Detection logic:
{
  "selection": {
    "type": "SYSCALL",
    "SYSCALL": "sysinfo"
  },
  "filter_optional_splunk": {
    "exe|endswith": "/bin/splunkd"
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/sysinfo-syscall/README.md
  - https://man7.org/linux/man-pages/man2/sysinfo.2.html
Sigma Detection Rule: Loading of Kernel Module via Insmod
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Pawel Mazur
Date: 2021-11-02
ATT&CK techniques: T1547.006
Log source: linux/

Description:
Detects loading of kernel modules with insmod command.
Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand.
Adversaries may use LKMs to obtain persistence within the system or elevate the privileges.


Detection logic:
{
  "selection": {
    "type": "SYSCALL",
    "comm": "insmod",
    "exe": "/usr/bin/kmod"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.006/T1547.006.md
  - https://linux.die.net/man/8/insmod
  - https://man7.org/linux/man-pages/man8/kmod.8.html
Sigma Detection Rule: Split A File Into Pieces - Linux
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Igor Fits, oscd.community
Date: 2020-10-15
ATT&CK techniques: T1030
Log source: linux/

Description:
Detection use of the command "split" to split files into parts and possible transfer.

Detection logic:
{
  "selection": {
    "type": "SYSCALL",
    "comm": "split"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1030/T1030.md
Sigma Detection Rule: Special File Creation via Mknod Syscall
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: Milad Cheraghi
Date: 2025-05-31
ATT&CK techniques: T1543.003
Log source: linux/

Description:
Detects usage of the `mknod` syscall to create special files (e.g., character or block devices).
Attackers or malware might use `mknod` to create fake devices, interact with kernel interfaces,
or establish covert channels in Linux systems.
Monitoring the use of `mknod` is important because this syscall is rarely used by legitimate applications,
and it can be abused to bypass file system restrictions or create backdoors.


Detection logic:
{
  "selection": {
    "type": "SYSCALL",
    "SYSCALL": "mknod"
  },
  "condition": "selection"
}

References:
  - https://man7.org/linux/man-pages/man2/mknod.2.html
  - https://hopeness.medium.com/master-the-linux-mknod-command-a-comprehensive-guide-1c150a546aa8
Sigma Detection Rule: Webshell Remote Command Execution
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Ilyas Ochkov, Beyu Denis, oscd.community
Date: 2019-10-12
ATT&CK techniques: T1505.003
Log source: linux/

Description:
Detects possible command execution by web application/web shell

Detection logic:
{
  "selection": {
    "type": "SYSCALL",
    "SYSCALL": [
      "execve",
      "execveat"
    ],
    "euid": 33
  },
  "condition": "selection"
}

References:
  - Personal Experience of the Author
  - https://www.vaadata.com/blog/what-is-command-injection-exploitations-and-security-best-practices/
Sigma Detection Rule: Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Milad Cheraghi
Date: 2025-05-27
ATT&CK techniques: T1685.006
Log source: linux/

Description:
Detects the use of the `syslog` syscall with action code 5 (SYSLOG_ACTION_CLEAR),
(4 is SYSLOG_ACTION_READ_CLEAR and 6 is SYSLOG_ACTION_CONSOLE_OFF) which clears the kernel
ring buffer (dmesg logs). This can be used by attackers to hide traces after exploitation
or privilege escalation. A common technique is running `dmesg -c`, which triggers this syscall internally.


Detection logic:
{
  "selection": {
    "type": "SYSCALL",
    "SYSCALL": "syslog",
    "a0": [
      4,
      5,
      6
    ]
  },
  "condition": "selection"
}

References:
  - https://man7.org/linux/man-pages/man2/syslog.2.html
  - https://man7.org/linux/man-pages/man1/dmesg.1.html
Sigma Detection Rule: Program Executions in Suspicious Folders
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2018-01-23
ATT&CK techniques: T1587, T1584
Log source: linux/

Description:
Detects program executions in suspicious non-program folders related to malware or hacking activity

Detection logic:
{
  "selection": {
    "type": "SYSCALL",
    "exe|startswith": [
      "/tmp/",
      "/var/www/",
      "/home/*/public_html/",
      "/usr/local/apache2/",
      "/usr/local/httpd/",
      "/var/apache/",
      "/srv/www/",
      "/home/httpd/html/",
      "/srv/http/",
      "/usr/share/nginx/html/",
      "/var/lib/pgsql/data/",
      "/usr/local/mysql/data/",
      "/var/lib/mysql/",
      "/var/vsftpd/",
      "/etc/bind/",
      "/var/named/"
    ]
  },
  "condition": "selection"
}

References:
  - Internal Research