Every published rule

Linux auditd: Steghide embeds hidden files via steghide embed with -cf/-ef

Flags steghide embed usage with -cf/-ef on Linux from auditd EXECVE events.

Linux auditd: Unzip files extracted from JPG/PNG images

Alerts when unzip is run against image files (.jpg/.png), consistent with extracting hidden data from steganographic containers.

Linux auditd: cat appends ZIP data to image files

Alerts when cat is used to handle .jpg/.png with an associated .zip argument, consistent with hiding ZIP data in images.

Linux auditd: Hidden file or directory creation via leading-dot paths in execve

Alerts on Linux process executions creating or modifying dot-prefixed (hidden) files/directories.

Linux Audio Capture via arecord and ecasound (auditd execve and memfd_create)

Detects Linux execution of arecord for audio capture and ecasound using memfd_create for in-memory data handling.

Linux auditd System Information Discovery via uname, uptime, lsmod, hostname, env, and release file reads

Triggers on auditd events showing host enumeration commands and system identity file access on Linux.

PowerShell discovery of Win32_PnPEntity via ScriptBlockText

Alerts when PowerShell script blocks reference Win32_PnPEntity to enumerate attached Plug and Play devices.

Microsoft 365 Cloud App Security Alerts on Suspicious Inbox Forwarding Rules

Flags successful Microsoft Cloud App Security alerts for suspicious inbox forwarding behavior.

Zeek DNS Queries Ending in Known Crypto Mining Pool Domains

Alert on Zeek DNS queries ending in mining-pool-related domains, excluding local/rejected answers.

AWS EKS Cluster CreateCluster or DeleteCluster Events (CloudTrail)

Alerts on CloudTrail API activity indicating an EKS cluster was created or deleted.

GCP Audit Alerts for Google Cloud Storage Bucket Enumeration via Listing APIs

Triggers on GCP audit events indicating Storage bucket listing (storage.buckets.list or listChannels).

Azure Activity Logs: Azure Kubernetes Connected Cluster Created or Deleted

Alerts on Azure Activity Log operations that write or delete Kubernetes Connected Clusters.

Azure Activity Logs: Container Registry Created or Deleted

Flags Azure Activity Log events where an Azure Container Registry is created (write) or deleted.

Windows: clip.exe Execution to Copy Data to Clipboard

Flags execution of clip.exe on Windows, a common utility for copying data into the clipboard.

AWS CloudTrail: IAMUser STS GetSessionToken Use

Alerts on CloudTrail STS GetSessionToken calls made by IAM users, indicating potential temporary credential misuse.

AWS CloudTrail: Suspicious STS AssumeRole sessions from Role-issued principals

Alert on CloudTrail AssumeRole events initiated from an already assumed role session.

AWS CloudTrail S3 Bucket/Replication Configuration Tampering via Management API Calls

Flags CloudTrail S3 management API actions that modify bucket protections or move/restore objects.

AWS ElastiCache Cache Security Group Modified or Deleted via CloudTrail

Flags CloudTrail activity indicating an ElastiCache security group was modified or deleted.

AWS CloudTrail: ElastiCache Cache Security Group Created

Flags CloudTrail events indicating a new ElastiCache cache security group was created.

AWS Route 53 Domain Transfer to Another Account via TransferDomainToAnotherAwsAccount

Alerts on Route 53 domain transfer requests in CloudTrail when a domain is moved to another AWS account.