Every published rule

Linux Docker Container Discovery via .dockerenv File Listing or Reads

Detects Linux process executions using common utilities to read or list .dockerenv, indicating potential container environment discovery.

Linux Container Discovery via /proc Virtual Filesystem Probing with CLI Text Tools

Flags Linux process executions using standard text tools to enumerate /proc for container-related discovery signals.

macOS: JAMF CLI (jamf) execution for account and MDM management

Flags macOS executions of the JAMF CLI with command-line actions tied to account, MDM, and framework changes.

Windows PowerShell Script Modifies File Permissions with Set-Acl

Flags PowerShell scripts that call Set-Acl to change ACL permissions on a specified path.

PowerShell NetFirewallRule Cmdlet Enumeration of Local Windows Firewall Rules

Flags PowerShell attempts to enumerate local Windows firewall rules via Get-NetFirewallRule or Show-NetFirewallRule.

Linux Named Pipe Creation via mkfifo Process Execution

Flags Linux process executions of /mkfifo that create named pipes.

Windows DLL Sideloading Indicators: 7za.dll Loaded from Non-Program Files Paths

Alerts when a process loads 7za.dll from a non-Program Files path, indicating potential DLL sideloading.

Linux OS Architecture Discovery Using grep

Flags grep executions on Linux whose command line ends with known CPU/architecture identifiers.

Linux Process Creation: crontab -l Enumeration

Flags Linux executions of /crontab with the -l option to list a user’s scheduled cron tasks.

Linux Shell Script Creation in /etc/profile.d/ for Persistence

Alerts on creation of .sh/.csh scripts in /etc/profile.d, a common place for persistence via shell startup.

Windows Registry: New ODBC Driver Registration via ODBCINST.INI

Flags Windows registry changes that add ODBC driver entries under ODBCINST.INI, with exclusions for specific known benign cases.

Windows Excel Loads .XLL Add-In Files

Flags excel.exe loading a .XLL add-in module, an execution indicator for potential malicious add-in activity.

Windows file events matching SNAKE-related installer filename indicators

Flags Windows file events with target filenames ending in common SNAKE installer indicators like jpsetup.exe and jpinst.exe.

Windows PowerShell Module File Creation via PowerShell Processes

Alert when PowerShell creates module-related files under WindowsPowerShell or PowerShell 7 module directories.

Windows PowerShell dropping a .ps1 script from powershell.exe or pwsh.exe

Alerts when PowerShell creates a dropped .ps1 script file on Windows, excluding common benign temp and test outputs.

Windows PowerShell Import-Module Cmdlet Execution

Flags PowerShell command lines containing Import-Module, indicating module loading into the current session.

Windows: File Creation of NTDS.DIT (Active Directory Database)

Flags creation of an ntds.dit file on Windows, an Active Directory database artifact often associated with credential access.

Windows Non-Browser Process Network Connection to api.notion.com

Alerts when a non-browser Windows process connects to api.notion.com, excluding common browsers and the Notion desktop app.

Windows Security: Security-Enabled Global Group Deletion (Event ID 4730/634)

Alerts on Windows Security audit events indicating a security-enabled global group was deleted.

Windows Security Log: Member Removed from Security-Enabled Global Group

Flags Windows Security Log events showing a member was removed from a security-enabled global group.