Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
2
1
1
1
Contributors
3
1
1
Categories
3
2
2
1
1
Platforms
5
1
Products / Services
2
1
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
1
IDS Protocols
1
1
Detects persistence mechanisms used by the CARBONATO botnet on Linux-based Docker hosts. The rule monitors for the application of immutable file attributes using 'chattr +i' on identified watchdog binaries (specifically '.docker-network-monitor'), the creation of malicious cron jobs, the enabling of suspicious systemd timers ('docker-network-resolver'), and the execution of specific persistence-related shell scripts.
Detects systemd timer unit file creation for Linux scheduled task persistence
This rule detects the creation of a systemd timer via a remote SSH session. It specifically looks for TCP traffic on port 22 (SSH) containing the commands 'systemctl enable' and '.timer' (case-insensitive), indicating an attempt to enable a systemd timer unit.
This rule detects attempts to drop a systemd timer unit file via a web shell. It specifically looks for HTTP POST requests (flow:to_server) containing both '.timer' and '[Timer]' in the client body, indicating the creation or modification of a systemd timer unit.
This analytic detects the restarting or re-enabling of services on Linux systems using the `systemctl` or `service` commands. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line execution logs. This activity is significant as adversaries may use it to maintain persistence or execute unauthorized actions. If confirmed malicious, this behavior could lead to repeated execution of malicious payloads, unauthorized access, or data destruction. Security analysts should investigate these events to mitigate risks and prevent further compromise.
