Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
CVEs
71
71
64
58
49
The detection identifies Linux persistence activity associated with the Cling botnet, where a hidden executable (.cling) is copied to privileged locations, made executable, and registered to run automatically through system startup mechanisms.
The detection identifies Linux persistence activity associated with the Cling botnet, where a hidden executable (.cling) is copied to privileged locations, made executable, and registered to run automatically through system startup mechanisms.