Linux Logs: Alert on Suspicious Syslog Keywords

Generates alerts when Linux log text contains suspicious keywords indicating possible network, service, or logging disruption.

FreeUnreviewedSigmamediumv1

linux-logs-alert-on-suspicious-syslog-keywords-f64b6e9a

title: "Linux Logs: Alert on Suspicious Syslog Keywords"
id: b7bfe07f-dd20-4ead-be8f-44518f8d6d50
status: test
description: This rule flags Linux log entries containing specific strings commonly associated with suspicious or disruptive host activity. Attackers and malware may trigger these conditions to evade monitoring, alter network behavior, or interfere with logging and services. Detection relies on keyword matches within available Linux log text, as provided by the source telemetry.
references:
  - https://github.com/ossec/ossec-hids/blob/f6502012b7380208db81f82311ad4a1994d39905/etc/rules/syslog_rules.xml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_shell_susp_log_entries.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-25
modified: 2021-11-27
tags:
  - attack.impact
logsource:
  product: linux
detection:
  keywords:
    - entered promiscuous mode
    - Deactivating service
    - Oversized packet received from
    - imuxsock begins to drop messages
  condition: keywords
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: f64b6e9a-5d9d-48a5-8289-e1dd2b3876e1
    type: derived

What it detects

This rule flags Linux log entries containing specific strings commonly associated with suspicious or disruptive host activity. Attackers and malware may trigger these conditions to evade monitoring, alter network behavior, or interfere with logging and services. Detection relies on keyword matches within available Linux log text, as provided by the source telemetry.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.