Every published rule

This rule detects execution of ruby with the "-e" flag and calls to "socket" related functions. This could be an indication of a potential attempt to setup a reverse shell

This rule detects detection use of the command "split" to split files into parts and possible transfer.

This rule detects modification of ld.so.preload for shared object injection. This method is used by adversaries to load arbitrary code into processes.

This rule detects attempts to collect data stored in the clipboard from users with the use of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high use of clipboard utilities on user workstations.

This rule detects execution of the "esxcli" command with the "network" flag to retrieve information about the network configuration.

This rule detects extracting of zip file from image file

This rule detects command line patterns linked with the use of Pnscan for sending and receiving binary data across the network. This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT

This rule detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously. While it is a legitimate tool, intended for use in CI pipelines and security assessments, It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.

This rule detects the presence of "bpf_probe_write_user" BPF helper-generated warning messages. Which could be a sign of anomalous eBPF behavior on the system.

This rule detects system information discovery commands

This rule detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell behavior

This rule detects the injection of code by overwriting the memory map of a Linux process using the "dd" Linux command.

This rule detects anomalous shell commands used in various exploit codes (see references)

This rule detects an anomalous curl process start the adds a file to a web request

This rule detects a python process calling to the PTY module to spawn a pretty tty which could be indicative of potential reverse shell activity.

This rule detects execution of the "userdel" binary. Which is leveraged to delete a user account and related files. This is sometimes misused by threat actors to cover their tracks

This rule detects adversary creating screen capture of a desktop with Import Tool. Highly recommended using rule on servers, due to high use of screenshot utilities on user workstations. ImageMagick must be installed.

This rule detects attempts to discover the files with setuid/setgid capability on them. That would enable adversary to escalate their privileges.

This rule detects anomalous activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'. This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap. These commands match a few methods from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)

This rule detects changes of sensitive and critical files. Monitors files that you don't expect to change without planning on Linux system. These files include, but are not limited to, system configuration files, authentication files, and critical application files. Attackers frequently target these files to maintain persistence, escalate privileges, or disrupt system operations.