Every published rule

This rule detects anomalous sub processes of web server processes

This rule detects anomalous modification of crontab file.

This rule detects attempts to post the file with the use of wget utility. The adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could enable them to read files like /etc/shadow.

This rule detects the use of grep to identify information about the operating system architecture. Frequently combined beforehand with the execution of "uname" or "cat /proc/cpuinfo"

This rule detects disabling security tools

This rule detects file deletion using "rm", "shred" or "unlink" commands which are used frequently by threat actors to delete files left behind by the actions of their intrusion behavior

This rule detects chmod targeting files in sensitive directory paths on Linux systems. Attackers may use chmod to change permissions of files in these directories to maintain persistence, escalate privileges, or disrupt system operations.

This rule detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems. UFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules. Disabling UFW can leave a system vulnerable to attacks, as it may enable unauthorized access to network services and resources.

This rule detects the use of at/atd which are utilities that are leveraged to schedule tasks. They are frequently misused by threat actors to maintain persistence or to perform task scheduling for initial or recurring execution of hostile code

This rule detects the use of the "rsync" utility to execute a shell. Such behavior may be linked with privilege escalation, unauthorized command execution, or to break out from restricted environments.

This rule detects setting proxy configuration

This rule detects execution of the "esxcli" command with the "system" flag to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.

This rule detects detecting attempts to extract passwords with grep

This rule detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including: - Use of the `personality` syscall with the ADDR_NO_RANDOMIZE flag (0x0040000) - Modification of the /proc/sys/kernel/randomize_va_space file - Execution of the `sysctl` command to set `kernel.randomize_va_space=0` Disabling ASLR is frequently used by adversaries during exploit development or to bypass memory protection mechanisms. A successful use of these methods can reduce the effectiveness of ASLR and make memory corruption attacks more reliable.

This rule detects use of "find" binary in an anomalous manner to perform discovery

This rule detects the creation of cron files in Cron directories, which could indicate potential persistence mechanisms being established by an attacker. Note that not all cron file creations are hostile - legitimate system administration activities and software installations may also create cron files. This detection should be investigated in context, considering factors such as the user creating the file, the timing of creation, and the contents of the cron job. Focus investigation on unexpected cron files created by non-administrative users or during anomalous timeframes. Additionally, it is recommended to review the contents of the newly created cron files to assess their intent. Furthermore, it is suggested to baseline normal cron file creation and apply additional filters to reduce false positives based on the specific environment.

This rule detects disabling of system firewalls which could be used by threat actors to bypass controls that limit use of the network.

This rule detects misuse of the cron utility to perform task scheduling for initial or recurring execution of hostile code. Detection will focus on crontab jobs uploaded from the tmp folder.

This rule detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem

This rule detects anomalous interactive bash as a parent to rather uncommon child processes