Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,597 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects unauthorized or suspicious write operations to Linux Pluggable Authentication Modules (PAM) configuration files or shared libraries. PAM controls authentication for various system services; unauthorized modification of these files is a common technique used by attackers to establish backdoors, bypass authentication mechanisms, or harvest credentials. The rule excludes common system package management utilities to reduce noise.
This rule detects modifications to Nginx configuration files (nginx.conf, or files within conf.d, sites-enabled, or sites-available directories) by processes other than authorized system management tools (e.g., nginx, apt, ansible). It further correlates these file modifications with subsequent Nginx configuration reloads, which is a common behavior when an adversary attempts to apply malicious configuration changes to a web server.
This rule detects when the Windows Subsystem for Linux (WSL) process (wsl.exe) launches common Windows binaries or scripting engines. This behavior is indicative of potential cross-environment execution, where attackers use the Linux subsystem to bypass Windows-based security controls or to execute malicious payloads, living-off-the-land techniques, or command-and-control activities within the Windows environment.
This rule monitors for signs of Atlas RAT activity on Linux systems, including the execution of processes matching known Atlas RAT naming conventions, unauthorized modifications to system persistence mechanisms (systemd or init.d directories) by non-package management utilities, and anomalous outbound network connections originating from sshd or PAM-related processes.
This rule detects unauthorized modifications or creations of files within critical Linux Pluggable Authentication Module (PAM) directories (such as /etc/pam.d/ and /lib/security/). Attackers often target these files to implement backdoors, bypass authentication mechanisms, or harvest credentials. The rule excludes common package management tools to minimize false positives.
Detects suspicious behavior involving the 'uptime' system utility, including execution from non-standard paths, unexpected outbound network connections, spawning child processes, or replacement of the legitimate /usr/bin/uptime binary. These behaviors are indicative of masquerading or binary hijacking.
This rule monitors web and proxy traffic for patterns indicative of Server-Side Request Forgery (SSRF) attempts. It searches for specific URL parameters designed to manipulate requests toward internal cloud metadata services (e.g., 169.254.169.254), exploit protocol schemes like 'gcs://', or leverage URL parsing discrepancies such as unauthorized authority or fragment-at-sign confusion to bypass security filters.
This rule monitors Linux authentication logs for anomalies related to Pluggable Authentication Modules (PAM). It identifies potential security risks by detecting file operations (read, write, create) within PAM-related processes, references to world-writable or temporary directories that may be used for staging credentials, and unusual authentication event patterns.
Detects instances of the 'smbd' process executing from non-standard locations or initiating network connections on ports other than the default SMB ports (139, 445), which may indicate a rogue service, masquerading, or network pivoting activity.
Detects the execution of known GSocket/GS-Netcat tools or the usage of the 'uptime' command when accompanied by network activity, which may indicate process masquerading.
Page 810 of 1168