Sysmon-for-Linux Event ID 11

Sigma (17)

• Axios NPM Compromise File Creation Indicators - Linux severity high T1105, T1195, T1195.002
• Linux Doas Conf File Creation severity medium T1548
• New Cron File Created severity low T1053, T1053.003
• Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation severity high T1068
• Persistence Via Sudoers.d Files severity medium T1548, T1548.003
• Potential SAP NetWeaver Webshell Creation - Linux severity medium T1059, T1059.003, T1190
• Potentially Suspicious Long Filename Pattern - Linux severity low T1027, T1059, T1059.004
• Potentially Suspicious Shell Script Creation in Profile Folder severity low
• Python Path Configuration File Creation - Linux severity medium T1059, T1059.006
• Shai-Hulud Malicious GitHub Workflow Creation severity high T1119, T1552, T1552.001
• Suspicious Filename with Embedded Base64 Commands severity high T1027, T1059, T1059.004
• TeamPCP LiteLLM Supply Chain Attack Persistence Indicators severity high T1195, T1195.002, T1543, T1543.002
• Triple Cross eBPF Rootkit Default LockFile severity high
• Triple Cross eBPF Rootkit Default Persistence severity high T1053, T1053.003
• UNC4841 - Barracuda ESG Exploitation Indicators severity high
• UNC4841 - Email Exfiltration File Pattern severity high
• Wget Creating Files in Tmp Directory severity medium T1105