Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,599 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
This rule detects potential persistence mechanisms on Linux systems by identifying the creation of new systemd service files, modifications to init.d scripts, or the use of systemctl to enable or start services. The rule specifically excludes standard package management activities (apt, yum, dnf, dpkg) and flags if the triggered service operation involves suspicious file paths.
This rule detects unauthorized write, modification, or creation events on critical SSH binary files (sshd, ssh, scp) on Linux systems. It excludes legitimate package management tools (e.g., apt, yum, dpkg, rpm) from triggering alerts to reduce noise from system updates.
This rule monitors for modifications to critical Name Service Switch (NSS) configuration files (/etc/nsswitch.conf) or the creation/loading of NSS shared library files (/lib/libnss_*.so). Adversaries may target these files to manipulate identity management, gain persistence, or escalate privileges by intercepting authentication requests.
Detects suspicious activity involving the uptime utility on Linux systems. This includes execution from non-standard paths, invocation with unexpected command-line arguments, execution with unusual parent processes, or evidence of the uptime binary being overwritten or written to a non-standard location. Such behavior is often indicative of masquerading or attempts to hide malicious activities.
Detects instances where the Windows Subsystem for Linux (WSL) process (wsl.exe) is used to execute native Windows command-line interpreters or utilities. This behavior is often associated with attackers using WSL as a living-off-the-land technique to evade security monitoring, run obfuscated payloads, or bypass execution restrictions by crossing the Linux/Windows boundary.
Detects the deployment and execution of GS-Netcat (gsocket), a tool often used for creating persistent reverse shells or backdoors. The rule identifies processes associated with gsocket, instances where the 'uptime' command is masqueraded with suspicious command-line arguments, and unauthorized creation or modification of systemd service files designed for persistence.
Detects potential credential harvesting activities targeting the SSH and PAM authentication stacks. The rule identifies suspicious file operations (creation/modification/read) by authentication-related processes (sshd, login, su, sudo) involving sensitive files like /etc/shadow or non-standard file paths in temporary directories, as well as the spawning of interpreters that write to these suspicious locations.
Detects two suspicious behaviors related to OpenSSH. The first scenario identifies unauthorized modifications, creations, or renames of core OpenSSH binaries (/usr/sbin/sshd, /usr/bin/ssh, /usr/bin/scp) that are not initiated by common package managers, which could indicate persistence mechanisms or backdooring. The second scenario monitors ssh/sshd/scp processes creating or modifying files in common temporary or world-writable directories (/tmp, /var/tmp, /dev/shm, etc.), which is often indicative of credential harvesting or data staging.
This rule detects low-frequency, external network connections originating from Linux processes that are either explicitly known to be associated with malicious tools (e.g., gs-netcat, gsocket, atlasd) or are masquerading as legitimate system utilities (e.g., uptime, smbd) in a manner consistent with the Velvet Ant Operation Highland activity. The detection aggregates connections by process metadata and flags low-frequency outbound traffic, which is indicative of C2 beaconing.
This rule detects potentially malicious or masqueraded Samba (smbd) activity on Linux systems. It monitors for three conditions: smbd processes launched from non-standard binary paths, smbd process network activity from non-standard binary paths, and smbd processes spawned by unauthorized or unexpected parent processes. These patterns are often associated with unauthorized SMB service deployment, malware persistence, or masquerading techniques.
Page 811 of 1168