Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
19 detections
Filters
Last updated
All Time
Detection languages
7
7
3
2
Contributors
18
1
Categories
14
7
5
4
3
Platforms
18
1
Products / Services
15
13
4
4
3
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
Detects the execution of the GS-Netcat network utility with flags characteristic of reverse shells (e.g., -e, -i, -S, -D) in conjunction with the creation of a systemd service unit file on the same host, which is a technique used by the Velvet Ant threat actor for persistence.
Detects unauthorized file write or rename operations targeting core OpenSSH binary and library paths, excluding known package manager activities. This behavior is indicative of an adversary replacing legitimate system binaries to create a trojanized version of OpenSSH, as observed in the Velvet Ant 'Operation Highland' campaign, used to harvest credentials and log SSH sessions.
Detects anomalous activity consistent with the Velvet Ant 'Operation Highland' methodology, which leverages Nginx/FastCGI to bridge external requests to internal SSH execution. The rule monitors three conditions: 1) HTTP POST requests to internal endpoints containing SSH-related command parameters; 2) suspicious Nginx configuration modifications or reload events; and 3) spawning of SSH processes by FastCGI handlers. Findings are correlated by time and entity to identify potential persistence or lateral movement mechanisms.
Detects anomalous lateral movement or network pivoting activity originating from an internet-facing Nginx server. The detection identifies an incoming HTTP POST request from an external IP address followed immediately by an outbound network connection from that same Nginx server to an internal RFC1918 host on the FastCGI port (9000). This behavior is consistent with the 'Velvet Ant' operation's technique of abusing proxy_pass configurations to relay traffic into isolated internal network segments via FastCGI request-chaining.
Detects instances where the fcgiwrap or spawn-fcgi processes, commonly used for Nginx FastCGI handling, are observed spawning system utility binaries (such as uptime, id, ps, who, or hostname) from unconventional locations like /tmp, /var/tmp, /dev/shm, or /home. This behavior is associated with the Velvet Ant threat group for lateral movement and reconnaissance within segmented networks.
Detects the execution of GS-Netcat or GSSocket, known tools used by the Velvet Ant threat group to establish encrypted C2 tunnels and SOCKS proxies on Linux systems. The rule identifies suspicious command-line patterns, including secret keys (-s), listener configurations (-l -p), and shell redirection (-e), particularly when executed from volatile directories like /tmp/ or /dev/shm/.
Detects execution and file artifacts associated with the GSocket (gs-netcat) utility, often used by threat actors like Velvet Ant (Operation Highland) for establishing SOCKS proxies, tunneling, and persistent remote access. The rule monitors process creation, file modifications, and network connections related to the tool's binary names, command-line arguments, and specific file paths.
Detects the 'Operation Highland' technique where an attacker-controlled binary named 'uptime' is executed by the 'fcgiwrap' process. This configuration acts as a FastCGI bridge, which subsequently spawns 'ssh' to establish unauthorized network connections into isolated network segments based on parameters received via HTTP POST requests.
Detects successful authentication for a user account immediately following a password change event. This pattern is indicative of a compromised PAM (Pluggable Authentication Modules) component or similar authentication backdoor that utilizes a hardcoded 'master' password to maintain access, bypassing credential rotation. This behavior is associated with the threat actor Velvet Ant (Operation Highland).
Detects execution of GS-Netcat covert C2 tunnels or masqueraded 'uptime' binaries running from non-standard system paths, consistent with persistent implants used by the Velvet Ant threat actor in Operation Highland.
Detects Linux processes masquerading as common daemons (smbd, httpd, sshd, crond) that are executing from non-standard file paths and establishing network connections on non-canonical ports to private (RFC1918) IP addresses. This behavior is indicative of a SOCKS5 proxy or C2 infrastructure masquerading as system services to blend in with legitimate traffic, as observed in Velvet Ant operations.
Detects a Perl-based SOCKS proxy used by the threat actor Velvet Ant that masquerades as the legitimate smbd process by running with 'smbd -D' command line arguments while listening on non-standard port 5000.
Detects the modification or creation of Pluggable Authentication Module (PAM) files or shared libraries in Linux environments. This technique is often used to establish persistence or intercept authentication credentials by replacing legitimate modules like pam_unix.so with malicious counterparts.
Detects the creation or modification of shared object (.so) files within critical Linux PAM library directories (/lib/security/, /lib64/security/, /usr/lib/security/) by processes other than identified system package managers. This behavior is indicative of an adversary replacing legitimate authentication modules with malicious versions to capture credentials or establish persistence, such as the activity documented in Operation Highland (Velvet Ant).
Detects the execution of Perl-based SOCKS proxy tunneling activity on Linux systems, as observed in Velvet Ant operations. The rule identifies Perl processes that contain socket/fork/daemonization indicators when spawned by web server processes like Nginx, Apache, or common shells used in CGI contexts, suggesting the exploitation of a web application to establish an internal network pivot.
This rule detects low-frequency, external network connections originating from Linux processes that are either explicitly known to be associated with malicious tools (e.g., gs-netcat, gsocket, atlasd) or are masquerading as legitimate system utilities (e.g., uptime, smbd) in a manner consistent with the Velvet Ant Operation Highland activity. The detection aggregates connections by process metadata and flags low-frequency outbound traffic, which is indicative of C2 beaconing.
Detects unauthorized systemd service unit installation or modification, specifically targeting reverse shells or encrypted tunneling tools (e.g., gs-netcat, netcat) by monitoring systemctl commands referencing suspicious paths (/tmp, /var/tmp, etc.) that bypass standard package management workflows. This behavior is associated with the Velvet Ant threat group's persistence tactics on compromised Linux systems.
Detects Linux processes masquerading as common system utilities (e.g., sshd, cron, smbd) by executing from non-standard, often high-risk directories such as /tmp, /var/tmp, /dev/shm, /opt, or various home and dot-directories. This behavior is indicative of Velvet Ant's TTPs used to blend malicious binaries with standard system processes to maintain persistence and evade detection.
Find use of Alternate Data Streams (ADS) for anti-forensic purposes.
Alternate Data Streams execution.
Alternate Data Streams execution.
