Every published rule

This rule detects the use of the find command to execute a shell. Such behavior may be linked with privilege escalation, unauthorized command execution, or exploitation attempt.

This rule detects relevant commands frequently related to malware or hacking behavior

This rule detects threat actors may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.

This rule detects potential overwriting and deletion of a file using DD.

This rule detects anomalous shell commands or program code that may be executed or used in command line to establish a reverse shell

This rule detects execution of the "groupdel" binary. Which is leveraged to delete a group. This is sometimes misused by threat actors to cover their tracks

This rule detects command line parameter very frequently used with coin miners

This rule detects the creation of "ebpfbackdoor" files in both "cron.d" and "sudoers.d" directories. Which both are related to the TripleCross persistence method

This rule detects enumeration of local system accounts. This information can help threat actors determine which local accounts exist on a system to aid in follow-on behavior.

This rule detects the presence of a base64 version of the shebang in the commandline, which could indicate a hostile payload about to be decoded

This rule detects executions of scripts located in potentially anomalous locations such as "/tmp" via a shell such as "bash", "sh", etc.

This rule detects the use of the `syslog` syscall with action code 5 (SYSLOG_ACTION_CLEAR), (4 is SYSLOG_ACTION_READ_CLEAR and 6 is SYSLOG_ACTION_CONSOLE_OFF) which clears the kernel ring buffer (dmesg logs). This can be used by adversaries to hide traces after exploitation or privilege escalation. A common method is running `dmesg -c`, which triggers this syscall internally.

This rule detects specific commands frequently used to remove or empty the syslog

This rule detects attempt to enable auditing of TTY input

This rule detects rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

This rule detects use of the 'crontab' utility to remove the current crontab. This is a common occurrence where cryptocurrency miners compete against each other by removing traces of other miners to hijack the maximum amount of resources possible

This rule detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of hostile behavior

This rule detects use of base64 utility to decode arbitrary base64-encoded text

This rule detects anomalous process command line that starts with a shell that runs something and finally gets piped into another shell

This rule detects System Information Discovery commands