Every published rule

This rule detects use of the PHP CLI with the "-r" flag which enables it to run inline PHP code. The rule looks for calls to the "fsockopen" function which enables the creation of sockets. Attackers frequently abuse this in combination with functions such as "exec" or "fopen" to initiate a reverse shell connection.

This rule detects use of "xterm" as a potential reverse shell tunnel

This rule detects the use of the "ssh" utility to execute a shell. Such behavior may be linked with privilege escalation, unauthorized command execution, or to break out from restricted environments.

This rule detects the use of the "nice" utility to execute a shell. Such behavior may be linked with privilege escalation, unauthorized command execution, or to break out from restricted environments.

This rule detects disabling security tools

This rule detects relevant ClamAV messages

This rule detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

This rule detects execution of "git" to clone a remote repository that contain anomalous keywords which might be anomalous

This rule detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts. These filenames exploit shell interpretation quirks to trigger hidden commands, a method observed in VShell malware campaigns.

This rule detects the use of wget to download content to an anomalous directory

This rule detects the use of the env command to invoke a shell. This may indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands.

This rule detects execution of inline Python code via the "-c" to call the "system" function from the "os" library, and spawn a shell.

This rule detects anomalous shell commands used in various Equation Group scripts and tools

This rule detects a creation of systemd services which could be used by threat actors to execute hostile code.

This rule detects the creation of the file "rootlog" which is used by the TripleCross rootkit as a way to check if the backdoor is already running.

This rule detects loading of kernel modules with insmod command. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Adversaries may use LKMs to obtain persistence within the system or elevate the privileges.

This rule detects enumeration of local or remote network services.

This rule detects use of the 'chattr' utility to remove immutable file attribute.

This rule detects the potential misuse of the Linux Magic SysRq (System Request) key by threat actors with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.

This rule detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.