Sysmon-for-Linux Event ID 1

Sigma (141)

• Access of Sudoers File Content severity medium T1592, T1592.004
• Apache Spark Shell Command Injection - ProcessCreation severity high T1190
• Atlassian Confluence CVE-2022-26134 severity high T1059, T1190
• Audit Rules Deleted Via Auditctl severity high T1685, T1685.004
• Axios NPM Compromise Indicators - Linux severity high T1059, T1059.004, T1059.006, T1105, T1195, T1195.002
• Bash Interactive Shell severity low
• BPFtrace Unsafe Option Usage severity medium T1059, T1059.004
• Capabilities Discovery - Linux severity low T1083
• Capsh Shell Invocation - Linux severity high T1059
• Chmod Targeting Sensitive Directories severity medium T1222, T1222.002
• Clipboard Collection with Xclip Tool severity low T1115
• Connection Proxy severity low T1090
• Container Residence Discovery Via Proc Virtual FS severity low T1082
• Copy Passwd Or Shadow From TMP Path severity high T1552, T1552.001
• Crontab Enumeration severity low T1007
• Curl Usage on Linux severity low T1105
• CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux) severity high T1059, T1190
• DD File Overwrite severity low T1485
• Decode Base64 Encoded Text severity low T1027
• Disable Or Stop Services severity medium T1489, T1685
• Disabling Security Tools severity medium T1686
• Docker Container Discovery Via Dockerenv Listing severity low T1082
• Download File To Potentially Suspicious Directory Via Wget severity medium T1105
• Enable BPF Kprobes Tracing severity medium
• ESXi Account Creation Via ESXCLI severity medium T1059, T1059.012, T1136
• ESXi Admin Permission Assigned To Account Via ESXCLI severity high T1059, T1059.012, T1098
• ESXi Network Configuration Discovery Via ESXCLI severity medium T1007, T1033, T1059, T1059.012
• ESXi Storage Information Discovery Via ESXCLI severity medium T1007, T1033, T1059, T1059.012
• ESXi Syslog Configuration Change Via ESXCLI severity medium T1059, T1059.012, T1685, T1690
• ESXi System Information Discovery Via ESXCLI severity medium T1007, T1033, T1059, T1059.012
• ESXi VM Kill Via ESXCLI severity medium T1059, T1059.012, T1529
• ESXi VM List Discovery Via ESXCLI severity medium T1007, T1033, T1059, T1059.012
• ESXi VSAN Information Discovery Via ESXCLI severity medium T1007, T1033, T1059, T1059.012
• Execution Of Script Located In Potentially Suspicious Directory severity medium
• File and Directory Discovery - Linux severity informational T1083
• File Deletion severity informational T1070, T1070.004
• Flush Iptables Ufw Chain severity medium T1686
• Group Has Been Deleted Via Groupdel severity medium T1531
• History File Deletion severity high T1565, T1565.001
• Inline Python Execution - Spawn Shell Via OS System Library severity high T1059
• Install Root Certificate severity low T1553, T1553.004
• Interactive Bash Suspicious Children severity medium T1036, T1059, T1059.004
• Kaspersky Endpoint Security Stopped Via CommandLine - Linux severity high T1685
• Linux Base64 Encoded Pipe to Shell severity medium T1140
• Linux Base64 Encoded Shebang In CLI severity medium T1140
• Linux Crypto Mining Indicators severity high T1496
• Linux Doas Tool Execution severity low T1548
• Linux HackTool Execution severity high T1587
• Linux Logs Clearing Attempts severity medium T1685, T1685.006
• Linux Network Service Scanning Tools Execution severity low T1046
• Linux Package Uninstall severity low T1070
• Linux Recon Indicators severity high T1552, T1552.001, T1592, T1592.004
• Linux Remote System Discovery severity low T1018
• Linux Setgid Capability Set on a Binary via Setcap Utility severity low T1548, T1554
• Linux Setuid Capability Set on a Binary via Setcap Utility severity low T1548, T1554
• Linux Shell Pipe to Shell severity medium T1140
• Linux Sudo Chroot Execution severity low T1068
• Linux Suspicious Child Process from Node.js - React2Shell severity high T1059, T1190
• Linux Webshell Indicators severity high T1505, T1505.003
• LiteLLM / TeamPCP Supply Chain Attack Indicators severity high T1195, T1195.002, T1543, T1543.002, T1560, T1560.001
• Local Groups Discovery - Linux severity low T1069, T1069.001
• Local System Accounts Discovery - Linux severity low T1087, T1087.001
• Mask System Power Settings Via Systemctl severity high T1653
• Mount Execution With Hidepid Parameter severity medium T1564
• Named Pipe Created Via Mkfifo severity low
• Nohup Execution severity medium T1059, T1059.004
• OMIGOD SCX RunAsProvider ExecuteScript severity high T1068, T1190, T1203
• OMIGOD SCX RunAsProvider ExecuteShellCommand severity high T1068, T1190, T1203
• OS Architecture Discovery Via Grep severity low T1082
• Pnscan Binary Data Transmission Activity severity medium T1046
• Potential Container Discovery Via Inodes Listing severity low T1082
• Potential Discovery Activity Using Find - Linux severity medium T1083
• Potential Exploitation of CVE-2024-3094 - Suspicious SSH Child Process severity high
• Potential Exploitation of CVE-2025-5054 or CVE-2025-4598 severity medium T1003, T1548
• Potential GobRAT File Discovery Via Grep severity high T1082
• Potential Linux Amazon SSM Agent Hijacking severity medium T1219, T1219.002
• Potential Linux Process Code Injection Via DD Utility severity medium T1055, T1055.009
• Potential Netcat Reverse Shell Execution severity high T1059
• Potential Perl Reverse Shell Execution severity high
• Potential PHP Reverse Shell severity high
• Potential Ruby Reverse Shell severity medium
• Potential Suspicious Change To Sensitive/Critical Files severity medium T1565, T1565.001
• Potential Xterm Reverse Shell severity medium T1059
• Potentially Suspicious Execution From Tmp Folder severity medium T1036
• Potentially Suspicious Named Pipe Created Via Mkfifo severity medium
• Print History File Contents severity medium T1592, T1592.004
• Process Discovery severity low T1057
• PUA - TruffleHog Execution - Linux severity medium T1083, T1552, T1552.001
• Python One-Liners with Base64 Decoding - Linux severity high T1027, T1027.010, T1059, T1059.006
• Python Reverse Shell Execution Via PTY And Socket Modules severity high
• Python Spawning Pretty TTY Via PTY Module severity medium T1059
• Python WebServer Execution - Linux severity medium T1048, T1048.003
• Remote Access Tool - Team Viewer Session Started On Linux Host severity low T1133
• Remove Immutable File Attribute severity medium T1222, T1222.002
• Remove Scheduled Cron Task/Job severity medium
• Scheduled Cron Task/Job - Linux severity medium T1053, T1053.003
• Scheduled Task/Job At severity low T1053, T1053.002
• Script Interpreter Spawning Credential Scanner - Linux severity high T1005, T1059, T1059.004, T1552
• Security Software Discovery - Linux severity low T1518, T1518.001
• Setuid and Setgid severity low T1548, T1548.001
• Shai-Hulud 2.0 Malicious NPM Package Installation - Linux severity high T1195, T1195.002
• Shai-Hulud Malicious Bun Execution - Linux severity high T1195, T1195.002, T1203
• Shai-Hulud Malware Indicators - Linux severity high T1059
• Shai-Hulud NPM Package Malicious Exfiltration via Curl severity high T1005, T1041
• Shell Execution GCC - Linux severity high T1083
• Shell Execution Of Process Located In Tmp Directory severity high
• Shell Execution via Find - Linux severity high T1083
• Shell Execution via Flock - Linux severity high T1083
• Shell Execution via Git - Linux severity high T1059
• Shell Execution via Nice - Linux severity high T1083
• Shell Execution via Rsync - Linux severity high T1059
• Shell Invocation via Apt - Linux severity medium T1083
• Shell Invocation via Env Command - Linux severity high T1059, T1059.004
• Shell Invocation Via Ssh - Linux severity high T1059
• Sudo Privilege Escalation CVE-2019-14287 severity high T1068, T1548, T1548.003
• Suspicious Child Process of SAP NetWeaver - Linux severity medium T1059, T1059.003, T1190
• Suspicious Curl Change User Agents - Linux severity medium T1071, T1071.001
• Suspicious Curl File Upload - Linux severity medium T1105, T1567
• Suspicious Download and Execute Pattern via Curl/Wget severity high T1059, T1059.004, T1203
• Suspicious Git Clone - Linux severity medium T1593, T1593.003
• Suspicious Invocation of Shell via AWK - Linux severity high T1059
• Suspicious Invocation of Shell via Rsync severity high T1059, T1203
• Suspicious Java Children Processes severity high T1059
• Suspicious Nohup Execution severity high
• Suspicious Package Installed - Linux severity medium T1553, T1553.004
• Syslog Clearing or Removal Via System Utilities severity high T1685, T1685.006
• System Information Discovery severity informational T1082
• System Network Connections Discovery - Linux severity low T1049
• System Network Discovery - Linux severity informational T1016
• Terminate Linux Process Via Kill severity medium T1685
• Touch Suspicious Service File severity medium T1070, T1070.006
• Triple Cross eBPF Rootkit Execve Hijack severity high
• Triple Cross eBPF Rootkit Install Commands severity high T1014
• UFW Disable Attempt severity medium T1686
• UNC4841 - Download Compressed Files From Temp.sh Using Wget severity high T1140
• UNC4841 - Download Tar File From Untrusted Direct IP Via Wget severity high T1140
• UNC4841 - Potential SEASPY Execution severity critical
• UNC4841 - SSL Certificate Exfiltration Via Openssl severity high T1140
• User Added To Root/Sudoers Group Using Usermod severity medium
• User Has Been Deleted Via Userdel severity medium T1531
• Vim GTFOBin Abuse - Linux severity high T1059, T1083