Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
13 detections
Filters
Last updated
All Time
Detection languages
5
4
2
1
1
Contributors
6
3
2
2
Categories
6
6
5
3
3
Platforms
13
Products / Services
2
2
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
1
1
This rule detects common web application processes (such as nginx, python, node, etc.) accessing the /proc/[pid]/environ file, which contains environment variables that may include sensitive information like credentials or configuration secrets. The rule correlates this access with subsequent external network connections initiated by the same process, which is highly indicative of data exfiltration after sensitive information has been retrieved.
Hunting rule for Linux procfs heap credential harvesting: resolve a target PID
(pgrep), locate the heap mapping in /proc/<pid>/maps, then copy a bounded region
from /proc/<pid>/mem with dd (ibs=1 skip= count=). Matches Atomic Red Team
T1003.007 "Dump individual process memory with sh (Local)".
Prioritize output under /tmp, /var/tmp, or /dev/shm and parent shells that are
not debuggers or crash-analysis tooling.
(pgrep), locate the heap mapping in /proc/<pid>/maps, then copy a bounded region
from /proc/<pid>/mem with dd (ibs=1 skip= count=). Matches Atomic Red Team
T1003.007 "Dump individual process memory with sh (Local)".
Prioritize output under /tmp, /var/tmp, or /dev/shm and parent shells that are
not debuggers or crash-analysis tooling.
Hunting rule for Linux procfs heap credential harvesting: resolve a target PID
(pgrep), locate the heap mapping in /proc/<pid>/maps, then copy a bounded region
from /proc/<pid>/mem with dd (ibs=1 skip= count=). Matches Atomic Red Team
T1003.007 "Dump individual process memory with sh (Local)".
Prioritize output under /tmp, /var/tmp, or /dev/shm and parent shells that are
not debuggers or crash-analysis tooling.
(pgrep), locate the heap mapping in /proc/<pid>/maps, then copy a bounded region
from /proc/<pid>/mem with dd (ibs=1 skip= count=). Matches Atomic Red Team
T1003.007 "Dump individual process memory with sh (Local)".
Prioritize output under /tmp, /var/tmp, or /dev/shm and parent shells that are
not debuggers or crash-analysis tooling.
This rule detects unauthorized or suspicious processes accessing sensitive files within the Linux /proc filesystem or application-specific directories (such as graph_api.py, main.py, or requirements.txt). By excluding standard administrative tools like systemd, rpm, dpkg, and apt, this rule highlights processes that may be performing reconnaissance, credential harvesting, or attempting to read source code in an abnormal manner.
Detects the 'strings' command being run directly against /proc/*/mem to extract human-readable strings (such as tokens or passwords) from raw memory. This activity is often associated with credential dumping techniques on Linux systems.
Detects the use of 'pgrep' to search for the 'Runner.Worker' process. This activity is often a precursor to an attacker attempting to access the process's memory via '/proc/[pid]/mem' for credential dumping or other malicious purposes.
Detects memory dumps piped to 'tr -d' to strip null bytes. This specific shell pipeline is a known Miasma technique used to parse raw process memory for readable secrets.
Detects reading of process memory via /proc filesystem for credential extraction
Detects the use of the GNU Debugger (gdb) to dump process memory (gcore) to disk, a technique abused by attackers to extract credentials residing in Runner.Worker. The rule specifically looks for process creation events where 'gdb' is in the command line along with process ID flags ('-p' or '--pid') and memory dumping commands ('dump memory' or 'gcore').
This rule detects attempts to harvest credentials from process memory on Linux systems. It specifically looks for HTTP traffic (flow:to_client,established) containing both the string "/proc/self/mem" and "password" (case-insensitive) within the file data. This combination suggests a tool or script is attempting to read memory for credential extraction, often associated with techniques like credential dumping.
This rule detects attempts to extract credentials from the Linux /proc filesystem over an SSH connection. Specifically, it looks for network traffic containing "/proc/", "/mem", and "ssh" (case-insensitive) within the same TCP flow to a server on port 22. This combination suggests an attacker might be trying to read sensitive memory regions or files related to SSH processes to dump credentials.
Detects a Python process attempting to access the memory of another process via the /proc filesystem. This behavior was observed in the Shai-Hulud SAP CAP supply chain attack, where a Python script dumped the Runner.Worker process memory to extract short-lived, high-value tokens passed between CI workflow steps.
Detects the use of GDB (GNU Debugger) to dump the memory of a running process. This technique is used by frameworks like ShadowHS to extract credentials and other secrets from live processes without writing traditional credential dumping tools to disk.