Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
111 detections
Filters
Last updated
All Time
Detection languages
54
23
7
6
6
Contributors
38
26
8
5
4
Categories
61
58
51
45
31
Platforms
106
12
3
1
1
Products / Services
63
23
20
11
8
MITRE Techniques
18,108
15,617
12,573
8,385
6,207
CVEs
1
1
1
IDS Classtypes
1
IDS Protocols
1
Detects the deployment and execution of GS-Netcat (gsocket), a tool often used for creating persistent reverse shells or backdoors. The rule identifies processes associated with gsocket, instances where the 'uptime' command is masqueraded with suspicious command-line arguments, and unauthorized creation or modification of systemd service files designed for persistence.
Detects Linux processes running from non-standard directories that exhibit network beaconing behavior, correlated with the concurrent creation or modification of systemd unit files on the same host. This pattern is indicative of a remote access trojan (RAT) or backdoor establishing persistent command-and-control.
Detects unauthorized systemd service unit installation or modification, specifically targeting reverse shells or encrypted tunneling tools (e.g., gs-netcat, netcat) by monitoring systemctl commands referencing suspicious paths (/tmp, /var/tmp, etc.) that bypass standard package management workflows. This behavior is associated with the Velvet Ant threat group's persistence tactics on compromised Linux systems.
Detects creation of systemd service unit files for Linux persistence
Detects attackers creating transient systemd units via systemd-run to persist malware or
reverse shells outside normal unit files. Linux malware families including cryptominers and
botnets use --remain-after-exit and custom unit names under /tmp or /dev/shm to survive
logout while evading static service file inspection.
reverse shells outside normal unit files. Linux malware families including cryptominers and
botnets use --remain-after-exit and custom unit names under /tmp or /dev/shm to survive
logout while evading static service file inspection.
This rule detects potentially malicious activity involving the Linux 'uptime' utility, including abnormal network connections to non-private IP addresses, execution with command-line flags often associated with non-standard utility behavior, and the creation of systemd service files, which may indicate a persistence mechanism.
Detects the creation or modification of files within /etc/systemd/system/ or /etc/init.d/ by non-standard management processes. Attackers often use these paths to establish persistence by creating or altering service unit files to execute malicious code automatically upon system boot or service restart. The rule specifically excludes common system management tools.
Detects the execution of GSocket (gs-netcat), a network tool often used for establishing persistent backdoors, interactive shells, or SOCKS proxies. The rule identifies execution with common flags for daemonization, interactive shell access, or SOCKS proxying, as well as instances where the process masquerades as common system binaries (e.g., smbd, sshd) or is initiated from system persistence directories like systemd or init.d.
Detects the use of a masquerading binary named 'uptime' for persistence or malicious activity on Linux systems. This rule monitors for unauthorized 'uptime' process activity such as network connections, spawning of shell/interpreter processes, creation of systemd service unit files, and manipulation via systemctl, as well as execution from non-standard directories.
Detects potential persistence via the creation of suspicious systemd service files. The rule monitors for new service files created by non-package manager processes, correlates these with subsequent 'systemctl enable' or 'start' operations, and identifies the execution of binaries from non-standard directories (e.g., /tmp, /dev/shm) by the systemd process.
Detects indicators of persistence activity associated with the MYRA RAT. This includes unauthorized modifications to shared library preload mechanisms (/etc/ld.so.preload), creation of malicious shared objects in systemd user paths by common interpreter/shell processes, suspicious modification of cron job files by those same processes, and the execution of the 'systemd-userdbd' process from non-standard, unauthorized filesystem locations.
Detects attackers creating transient systemd units via systemd-run to persist malware or
reverse shells outside normal unit files. Linux malware families including cryptominers and
botnets use --remain-after-exit and custom unit names under /tmp or /dev/shm to survive
logout while evading static service file inspection.
reverse shells outside normal unit files. Linux malware families including cryptominers and
botnets use --remain-after-exit and custom unit names under /tmp or /dev/shm to survive
logout while evading static service file inspection.
Detects the creation of a 'protocal.cjs' file within the '~/.config/systemd/nvmconf/' directory. This activity is associated with the 'easy-day-js' supply chain attack, where a malicious Node.js script is established as a persistent user-level systemd service named 'nvmconf'.
Detects the MYRA RAT (Operation Friday Harvest) establishing persistence by creating systemd user services disguised as legitimate system daemons (colord, haveged) under ~/.config/systemd/user/, enabling the service via systemctl --user enable, and dropping binaries to ~/.local/bin/. Also covers related persistence artifacts including /usr/local/lib/.libcache.so and /etc/profile.d/.sh.local. The rule also identifies node or node.exe spawning systemctl with the --user flag.
Detects the creation of 'update-monitor.service' in the systemd directory, a known persistence mechanism for the Miasma toolkit.
Detects the creation of systemd unit files masquerading as Google Chrome components used to launch the GS-Netcat backdoor on boot.
Detects attackers creating transient systemd units via systemd-run to persist malware or
reverse shells outside normal unit files. Linux malware families including cryptominers and
botnets use --remain-after-exit and custom unit names under /tmp or /dev/shm to survive
logout while evading static service file inspection.
reverse shells outside normal unit files. Linux malware families including cryptominers and
botnets use --remain-after-exit and custom unit names under /tmp or /dev/shm to survive
logout while evading static service file inspection.
Detects the creation of a systemd service explicitly named 'gh-token-monitor.service'. This service name is indicative of a credential harvester designed to run as a background daemon, likely targeting GitHub tokens or similar credentials.
Detects commands enabling the malicious update-monitor or gh-token-monitor systemd services to start automatically on system boot.
This rule detects network traffic that contains specific strings indicative of a Systemd service unit being created for persistence. Specifically, it looks for the string "/etc/systemd/system" and ".service" within TCP traffic directed to the home network on port 22 (SSH). This combination suggests an attempt to establish persistence on a Linux system by creating a new Systemd service.
Detects systemctl used to enable or start services for Linux execution
Page 4 of 6