Every published rule

This rule detects password policy discovery commands

This rule detects the start, reload or restart of a service.

This rule detects system information discovery commands

This rule detects programs that connect to known malware callback ports based on threat intelligence reports.

This rule detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.

This rule detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl. This behavior may indicate a manual interruption of the antivirus service by an administrator, or it could be a sign of potential tampering or evasion attempts by hostile actors.

This rule detects an anomalous curl process start on linux with set useragent options

This rule detects execution of the "esxcli" command with the "storage" flag to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.

This rule detects the ld.so preload persistence file. See `man ld.so` for more information.

This rule detects file and folder permission changes.

This rule detects use of system utilities (only grep and egrep for now) to discover security software discovery

This rule detects installation of anomalous packages using system installation utilities

This rule detects adversary creating hidden file or directory, by detecting directories or files with . as the first character

This rule detects anomalous log entries in Linux log files

This rule detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance

This rule detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

This rule detects use of nohup which could be leveraged by an adversary to keep a process running or break out from restricted environments

This rule detects the use of the "gcc" utility to execute a shell. Such behavior may be linked with privilege escalation, unauthorized command execution, or to break out from restricted environments.

This rule detects use of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.

This rule detects command line parameters or strings frequently used by crypto miners