Every published rule

This rule detects when the file "passwd" or "shadow" is copied from tmp path

This rule detects changes to the ESXi syslog configuration via "esxcli"

This rule detects attempts to collect data stored in the clipboard from users with the use of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high use of clipboard utilities on user workstations.

This rule detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

This rule detects enumeration of local system groups. Threat actors may attempt to find local system groups and permission settings

This rule detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes. Malware or reconnaissance tools might abuse sysinfo to fingerprint the system - gathering data to determine if it's a viable target.

This rule detects use of "getcap" binary. This is frequently used during recon behavior to determine potential binaries that can be misused as GTFOBins or other.

This rule detects removing immutable file attribute.

This rule detects default install commands of the Triple Cross eBPF rootkit based on the "deployer.sh" script

This rule detects the use of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux systems. Attackers may stop or disable security tools and services to evade detection, maintain persistence, or disrupt system operations.

This rule detects logs clearing attempts on Linux systems via utilities such as 'rm', 'rmdir', 'shred', and 'unlink' targeting log files and directories. Adversaries frequently try to clear logs to cover their tracks after performing hostile activities.

This rule detects buffer overflow attempts in Unix system log files

This rule detects execution of the file "execve_hijack" which is used by the Triple Cross rootkit as a way to elevate privileges

This rule detects execution of the "esxcli" command with the "vm" and "kill" flag to kill/shutdown a specific VM.

This rule detects anomalous use of command-line tools such as curl or wget to download remote content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by immediate execution, suggesting potential hostile activity. This pattern is frequently used by hostile scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.

This rule detects a potentially anomalous execution of a process located in the '/tmp/' folder

This rule detects attempts to record audio using the arecord and ecasound utilities.

This rule detects the use of tools that copy files from or to remote systems

This rule detects the removal of system firewall rules. Threat actors may only delete or modify a specific system firewall rule to bypass controls limiting network use or access. Detection rules that match only on the disabling of firewalls will miss this.

This rule detects anomalous session with two users present