Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Contributors
2
1
Categories
2
1
1
Platforms
3
Products / Services
2
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
This rule detects the Linux GobRAT backdoor by identifying specific byte patterns associated with its functions for getting local IP addresses, MAC addresses, handling TCP network communication, and managing telnet tasks. The rule specifically targets ELF executable files.
Detects the execution of binaries located in potentially suspicious locations, specifically within the '/tmp/' directory, using the 'nohup' command. This behavior is often associated with malware attempting to maintain execution even after a user logs off or a session terminates.
This rule detects the execution of the 'grep' command on Linux systems when it is used to search for specific filenames associated with the GobRAT malware. The filenames include 'apached', 'frpc', 'sshd.sh', and 'zone.arm'. This activity indicates that an attacker, potentially using GobRAT, is attempting to discover files related to their malware deployment or persistence mechanisms.