Every published rule

This rule detects anomalous change of file privileges with chown and chmod commands

This rule detects anomalous process command line that uses base64 encoded input for execution with a shell

This rule detects listing or file reading of ".dockerenv" that can be a sing of potential container discovery

This rule detects network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

This rule detects the enumeration of other remote systems.

This rule detects user account creation on ESXi system via esxcli

This rule detects anomalous DNS error messages that indicate a fatal or anomalous error that could be caused by exploiting attempts

This rule detects the use of systemctl mask to disable system power management targets such as suspend, hibernate, or hybrid sleep. Adversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their hostile processes remain active and uninterrupted. This behavior can be linked with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of hostile activity.

This rule detects enumeration of local network configuration

This rule detects execution of binaries located in potentially anomalous locations via "nohup"

This rule detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers to potentially list all users that have sudo rights.

This rule detects the execution of python with calls to the socket and pty module to connect and spawn a potential reverse shell.

This rule detects the addition of a new user to a privileged group such as "root" or "sudo"

This rule detects the use of grep to discover specific files created by the GobRAT malware

This rule detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

This rule detects possible command execution by web application/web shell

This rule detects commandline operations on shell history files

This rule detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands. Such behavior may be linked with privilege escalation, unauthorized command execution, or to break out from restricted environments.

This rule detects the creation of doas.conf file in linux host platform.

This rule detects specific commands frequently used to remove or empty the syslog. Which is a method frequently used by adversary as a method to hide their tracks