Every published rule

This rule detects the use of the 'setcap' utility to set the 'setgid' capability (cap_setgid) on a binary file. This capability enables a non privileged process to make arbitrary manipulations of group IDs (GIDs), including setting its current GID to a value that would otherwise be restricted (i.e. GID 0, the root group). This behavior can be used by threat actors to backdoor a binary to escalate privileges again in the future if needed.

This rule detects known hacktool execution based on image name.

This rule detects the execution of "awk" or it's sibling commands, to invoke a shell using the system() function. This behavior is frequently linked with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.

This rule detects installation of new certificate on the system which adversaries may use to avoid warnings when connecting to controlled web servers or C2s

This rule detects execution of the "esxcli" command with the "vsan" flag to retrieve information about virtual storage. Seen used by malware such as DarkSide.

This rule detects attempts to collect image data stored in the clipboard from users with the use of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high use of clipboard utilities on user workstations.

This rule detects a curl process start on linux, which suggests a file download from a remote location or a simple web request to a remote server

This rule detects the execution of Python web servers via command line interface (CLI). After gaining access to target systems, threat actors may use Python's built-in HTTP server modules to quickly establish a web server without requiring additional software. This method is frequently used in post-exploitation scenarios as it provides a simple method for transferring files between the compromised host and attacker-controlled systems.

This rule detects file time attribute change to hide new or changes to existing files.

This rule detects use of the "usermod" binary to add users add users to the root or suoders groups

This rule detects execution of the "esxcli" command with the "system" and "permission" flags to assign admin permissions to an account.

This rule detects the use of the 'setcap' utility to set the 'setuid' capability (cap_setuid) on a binary file. This capability enables a non privileged process to make arbitrary manipulations of user IDs (UIDs), including setting its current UID to a value that would otherwise be restricted (i.e. UID 0, the root user). This behavior can be used by threat actors to backdoor a binary to escalate privileges again in the future if needed.

This rule detects anomalous command with /dev/tcp

This rule detects commands that try to clear or tamper with the Linux command history. This method is used by threat actors to evade defenses and execute commands without them being recorded in files such as "bash_history" or "zsh_history".

This rule detects calls to hidden files or files located in hidden directories in NIX systems.

This rule detects changes in auditd configuration files

This rule detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse shell setup.

This rule detects the use of "vim" and it's siblings commands to execute a shell or proxy commands. Such behavior may be linked with privilege escalation, unauthorized command execution, or to break out from restricted environments.

This rule detects changes of syslog daemons configuration files

This rule detects the creation of shell scripts under the "profile.d" path.