Every published rule

This rule detects the use of wget to download content in a temporary directory such as "/tmp" or "/var/tmp"

This rule detects use of system utilities to discover system network connections

This rule detects the use of the "git" utility to execute a shell. Such behavior may be linked with privilege escalation, unauthorized command execution, or to break out from restricted environments.

This rule detects BPFDoor .lock and .pid files access in temporary file storage facility

This rule detects embedding of files with use of steghide binary, the threat actors may use this method to prevent the detection of hidden information.

This rule detects process connections to a Monero crypto mining pool

This rule detects all TCP traffic on particular port from adversary is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392' The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the adversary host only.

This rule detects masquerading occurs when the name or location of an executable, legitimate or malicious, is manipulated or misused for the sake of evading defenses and observation. Several different variations of this method have been observed.

This rule detects execution of the bash shell with the interactive flag "-i".

This rule detects use of the `mknod` syscall to create special files (e.g., character or block devices). Attackers or malware might use `mknod` to create fake devices, interact with kernel interfaces, or establish covert channels in Linux systems. Monitoring the use of `mknod` is important because this syscall is rarely used by legitimate applications, and it can be misused to bypass file system restrictions or create backdoors.

This rule detects unix shell configuration modification. Threat actors may establish persistence through running hostile commands triggered when a new shell is opened.

This rule detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg".

This rule detects the creation or modification of files within the "sudoers.d" directory on Linux systems. Such behavior may indicate an attempt to establish or maintain privilege escalation by granting specific users elevated permissions. Unauthorized changes to sudoers files are a common method used by adversaries to persist administrative access.

This rule detects anomalous command lines that look as if they would create symbolic links to /etc/passwd

This rule detects the execution of 'auditctl' with the '-D' command line parameter, which deletes all configured audit rules and watches on Linux systems. This method is frequently used by adversaries to disable audit logging and cover their tracks by removing monitoring capabilities. Removal of audit rules can significantly impair detection of hostile activities on the affected system.

This rule detects execution of network scanning and reconnaisance tools. These tools can be used for the enumeration of local or remote network services for example.

This rule detects use of the "touch" process in service file.

This rule detects the use of the unsafe bpftrace option

This rule detects rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

This rule detects java process spawning anomalous children