Linux Log File Alerts for Suspicious Messages
Generates alerts when Linux log text contains suspicious keywords indicating possible network, service, or logging disruption.
FreeReviewedSigma · Medium · v3
- Product
- linux
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2017-03-25
- Updated
- 2026-07-31
What it detects
This rule flags Linux log entries containing specific keywords associated with risky system or network states and log anomalies. Attackers and post-compromise activity may produce messages like entering promiscuous mode, service deactivation, oversized packet indicators, or dropped log messages that can reflect reconnaissance, interference, or disruption attempts. Detection relies on text keyword matches within Linux log data streams for the listed phrases.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
linux-logs-alert-on-suspicious-syslog-keywords-f64b6e9a
title: Linux Log File Alerts for Suspicious Messages
id: b7bfe07f-dd20-4ead-be8f-44518f8d6d50
status: test
description: This rule flags Linux log entries containing specific keywords associated with risky system or network states and log anomalies. Attackers and post-compromise activity may produce messages like entering promiscuous mode, service deactivation, oversized packet indicators, or dropped log messages that can reflect reconnaissance, interference, or disruption attempts. Detection relies on text keyword matches within Linux log data streams for the listed phrases.
references:
- https://github.com/ossec/ossec-hids/blob/f6502012b7380208db81f82311ad4a1994d39905/etc/rules/syslog_rules.xml
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_shell_susp_log_entries.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-25
modified: 2021-11-27
tags:
- attack.impact
logsource:
product: linux
detection:
keywords:
- entered promiscuous mode
- Deactivating service
- Oversized packet received from
- imuxsock begins to drop messages
condition: keywords
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: f64b6e9a-5d9d-48a5-8289-e1dd2b3876e1
type: derived