Suspicious Log Entries (via linux)

title: Suspicious Log Entries (via linux)
id: e9e32106-4cf0-5a98-8e82-a1ae36543e45
status: stable
description: This rule detects anomalous log entries in Linux log files
references:
    - https://github.com/ossec/ossec-hids/blob/f6502012b7380208db81f82311ad4a1994d39905/etc/rules/syslog_rules.xml
author: Huntrule Team
date: 2026-06-03
tags:
    - attack.impact
    - attack.credential-access
    - attack.discovery
    - attack.t1040
logsource:
    product: linux
detection:
    keywords:
        - 'entered promiscuous mode'
        - 'Deactivating service'
        - 'Oversized packet received from'
        - 'imuxsock begins to drop messages'
    condition: keywords
falsepositives:
    - Unknown
level: medium