Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
3
3
1
1
Contributors
4
2
2
Categories
3
3
2
1
1
Platforms
6
1
1
1
Products / Services
4
1
1
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
1
IDS Protocols
1
Detects modification of udev rules for persistent command execution on device events
This rule detects network traffic containing the string "/etc/udev/rules.d/" over TCP port 22 (SSH). This string is indicative of an attempt to modify udev rules, which can be used for Linux persistence by executing malicious scripts or commands when specific hardware events occur. The detection is focused on traffic flowing from the home network to a server on the home network, suggesting an internal system attempting to modify udev rules on another internal system via SSH.
Detects usage udev rules launching at jobs or cron jobs for persistence
Detects the creation or modification of udev rules that execute suspicious commands or scripts from unusual locations. Udev rules are used by the Linux kernel device manager to handle hardware events and can be abused for persistence.
Detects usage udev rules launching at jobs or cron jobs for persistence
Detects malicious udev rules for persistence
This query helps hunting for Inbox rule changes which forward-redirect email
Get stats on ASR audit events - count events and machines per rule.