Every published rule

This rule detects overwriting (effectively wiping/deleting) of a file.

This rule detects an executable accessing a ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by hostile actors

This rule detects the execution of a binary from the Linux shared memory directory /dev/shm. This directory is a tmpfs mount backed entirely by RAM and is misused by adversaries for fileless malware staging because files written there never touch physical disk and may evade disk-based detection.

This rule detects the use of Python's base64 decoding functions in command line executions on Linux systems. Malicious scripts frequently use python one-liners to decode and execute base64-encoded payloads, which is a common method for obfuscation and evasion.

This rule detects an adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration to make it portable and minimize the amount of data sent over the network.

This rule detects anomalous SSH / SSHD error messages that indicate a fatal or anomalous error that could be caused by exploiting attempts

This rule detects use of iptables to flush all firewall rules, tables and chains and enable all network traffic

This rule detects use of crontab to list the tasks of the user

This rule detects the use of the "flock" command to execute a shell. Such behavior may be linked with privilege escalation, unauthorized command execution, or to break out from restricted environments.

This rule detects threat actors may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.