Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
4
1
1
1
Contributors
2
2
2
1
Categories
4
2
1
1
1
Platforms
4
2
1
Products / Services
2
2
1
1
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
1
IDS Protocols
1
Detects bind mounts used to hide malware in obscured filesystem paths
This rule detects the string "mount --bind" within TCP traffic on port 22 (SSH). This string indicates an attempt to create a bind mount, which can be used by attackers to obscure the true location of malicious files or to manipulate file system access. The rule specifically looks for this activity on the home network, suggesting an internal system being targeted or used for malicious purposes.
Detects mount(8) bind operations from writable temp directories onto sensitive system subtrees, sometimes used to bypass integrity expectations or overlay binaries.
This rule detects attempts to mount a bind from a temporary directory or other sensitive system directories on Linux systems. This behavior can be indicative of an attacker trying to hide malicious activity or gain persistence by mounting a bind from a compromised location to a system directory.
KQL Query from file: M365 Copilot Chat SafeLink Monitoring
This query searches for not onboarded devices with a specific Suffix
Finding attackers hiding malware in the recycle bin.
Read more here: https://azure.microsoft.com/blog/how-azure-security-center-helps-reveal-a-cyberattack/.
Tags: #execution #SuspiciousPath.
Read more here: https://azure.microsoft.com/blog/how-azure-security-center-helps-reveal-a-cyberattack/.
Tags: #execution #SuspiciousPath.