Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,081 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects interactive shell execution within a container in a production, using 'exec'. The execution of `cat`, followed by network connections. This could be communicating with a service that runs arbitrary commands.
Linux VNC Install
Sigma
Detects VNC-based lateral movement activities. Looking for the initial install
Detects VNC-based activities. Looking for specific VNC processes
Detects chmod usage that sets SUID or SGID bits, which can be abused for privilege escalation.
2 is the special bit for SGID
4 is the special bit for SetUID
6 combines the special bits for SetUID and SGID
2 is the special bit for SGID
4 is the special bit for SetUID
6 combines the special bits for SetUID and SGID
Detects active SSH session takeover attempts.
When the process of one user accesses another user's SSH agent
When the process of one user accesses another user's SSH agent
Docker Run/Exec Guardrails Bypass
Cortex XDR
This rule detects the execution of a Docker command with the '--privileged' flag on a Linux system, combined with the execution of specific system information gathering commands. This combination is often indicative of an attempt to escape a container or gain elevated privileges within a containerized environment, potentially leading to host compromise. The '--privileged' flag grants a container nearly all capabilities of the host machine, making it a critical security concern when used maliciously.
Linux Timestomping via Reference FIle
Cortex XDR
Detects the use of the 'touch' command on Linux with '-m' and '-r' (reference file) or '--reference' arguments. This combination can be used for timestomping, a technique to modify file timestamps to evade detection or forensic analysis by making malicious files appear to have legitimate creation/modification times.
Linux SELinux Setenforce
Cortex XDR
Detects attempts to disable SELinux by executing the 'setenforce 0' command on Linux systems. Disabling SELinux can reduce the security posture of a system and is often performed by attackers to bypass security controls.
Awk System Execution
Cortex XDR
This rule detects the execution of 'awk' on Linux systems when its command line contains includes suspicious functions like. This pattern is often indicativeof malicious script execution or command injection attempts using awk.
Correlation rule that counts the events produced by Kubernetes Audit Event Deletion base rule
Page 18 of 38