mark goldie
@Fraggles0 followers3 downloads6 copies1 like409 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
2
1
1
1
1
Platforms
2
1
Products / Services
1
1
1
1
MITRE Techniques
2
2
1
1
1
Linux Pam Modification
YARA-L
Detects modifications to Linux PAM configuration files or module directories, potentially indicating PAM backdoor installation such as PamDOORa. Assigns higher risk for unusual processes or multiple file modifications.
Detects network connections to malicious domains, associated IPs, execution of related malicious file hashes, registry persistence, and postinstall script executions related to UNC1069 NPM/Axios supply chain attacks deploying SILKBELL and WAVESHAPER.V2. Categorized into risk-scored scenarios.