# Hydra Bot v5 — Redis Exploitation Detection Rules (Sigma v2)
# Reference: research.ohiiho.com
# Date: 2026-09-01
# License: Free to use with attribution.
#
# Note: Redis does not log commands by default. These rules require
# Redis slowlog, MONITOR output, or a network-level Redis command parser
# (e.g., Suricata redis-log, Zeek redis analyzer, or custom RESP decoder).
# False positives are possible in environments with legitimate Redis
# administration — tune thresholds to your baseline.

---
title: Redis CONFIG SET Directory Traversal
id: a1b2c3d4-0001-4000-8000-hydrabotv5001
status: experimental
description: |
  Detects rapid CONFIG SET dir + CONFIG SET dbfilename sequence, used to
  redirect Redis RDB persistence to arbitrary paths (cron, SSH, /tmp/).
  Hydra Bot v5 uses this for SLAVEOF module delivery.
author: OHIIHO Research
date: 2026-09-01
tags:
  - attack.execution
  - attack.t1053.003
  - attack.persistence
  - attack.t1098.004
  - cve.2022-0543
logsource:
  product: redis
  service: command_log
detection:
  config_dir:
    command|contains: 'CONFIG SET dir'
  config_dbfilename:
    command|contains: 'CONFIG SET dbfilename'
  condition: config_dir and config_dbfilename
  timeframe: 30s
falsepositives:
  - Legitimate Redis backup configuration changes
  - Redis cluster rebalancing operations
level: high

---
title: Redis SLAVEOF/REPLICAOF from Unexpected Source
id: a1b2c3d4-0002-4000-8000-hydrabotv5002
status: experimental
description: |
  Detects SLAVEOF or REPLICAOF commands, used by attackers to force
  replication from a rogue Redis master for file delivery.
author: OHIIHO Research
date: 2026-09-01
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  product: redis
  service: command_log
detection:
  selection:
    command|contains:
      - 'SLAVEOF'
      - 'REPLICAOF'
  filter_localhost:
    command|contains: '127.0.0.1'
  condition: selection and not filter_localhost
falsepositives:
  - Legitimate Redis replica configuration
  - Redis Sentinel failover
level: critical

---
title: Redis MODULE LOAD from Temporary Directory
id: a1b2c3d4-0003-4000-8000-hydrabotv5003
status: experimental
description: |
  Detects MODULE LOAD from /tmp/ or other world-writable paths.
  Hydra Bot v5 loads exp.so from /tmp/ after SLAVEOF delivery.
author: OHIIHO Research
date: 2026-09-01
tags:
  - attack.execution
  - attack.t1129
logsource:
  product: redis
  service: command_log
detection:
  selection:
    command|contains: 'MODULE LOAD'
  suspicious_path:
    command|contains:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
  condition: selection and suspicious_path
falsepositives:
  - Development/testing environments loading modules from temporary paths
level: critical

---
title: Process Execution from Systemd Cache Masquerade Directory
id: a1b2c3d4-0004-4000-8000-hydrabotv5004
status: experimental
description: |
  Detects process creation from /var/lib/systemd/.cache/, used by
  Hydra Bot v5 for persistence masquerading as a systemd cache.
author: OHIIHO Research
date: 2026-09-01
tags:
  - attack.defense_evasion
  - attack.t1036.005
  - attack.persistence
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|contains: '/var/lib/systemd/.cache/'
  selection_alt:
    CommandLine|contains: '/var/lib/systemd/.cache/'
  condition: selection or selection_alt
falsepositives:
  - Legitimate systemd cache operations (rare — systemd does not typically use this exact path)
level: high

---
title: Cron Job with dev-tcp or C2 Download
id: a1b2c3d4-0005-4000-8000-hydrabotv5005
status: experimental
description: |
  Detects cron job entries containing /dev/tcp/ bash builtin (used to
  bypass wget/curl) or curl/wget to known Hydra Bot v5 C2 IPs.
author: OHIIHO Research
date: 2026-09-01
tags:
  - attack.execution
  - attack.t1053.003
  - attack.command_and_control
  - attack.t1105
logsource:
  category: file_change
  product: linux
detection:
  cron_path:
    TargetFilename|contains:
      - '/var/spool/cron/'
      - '/etc/cron.d/'
      - '/etc/crontab'
  dev_tcp:
    FileContent|contains: '/dev/tcp/'
  known_c2:
    FileContent|contains:
      - '47.95.111.169'
      - '152.89.236.100'
      - 'ha-fixed.sh'
  condition: cron_path and (dev_tcp or known_c2)
falsepositives:
  - Legitimate use of /dev/tcp/ in cron (very rare)
level: critical

---
title: CVE-2022-0543 Redis Lua Sandbox Escape
id: a1b2c3d4-0006-4000-8000-hydrabotv5006
status: experimental
description: |
  Detects EVAL commands exploiting CVE-2022-0543 (Debian/Ubuntu Redis
  Lua sandbox escape via package.loadlib + luaopen_io).
author: OHIIHO Research
date: 2026-09-01
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2022-0543
tags:
  - attack.execution
  - attack.t1059.004
  - cve.2022-0543
logsource:
  product: redis
  service: command_log
detection:
  eval_cmd:
    command|contains: 'EVAL'
  loadlib:
    command|contains: 'package.loadlib'
  luaopen:
    command|contains: 'luaopen_io'
  io_popen:
    command|contains: 'io.popen'
  condition: eval_cmd and (loadlib or luaopen or io_popen)
falsepositives:
  - Legitimate Lua scripting in Redis that references io libraries (should not occur in production)
level: critical
