Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,082 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects make explicitly loading a Makefile from temporary or non-standard locations, often used to run arbitrary commands (due to writeable capability) via a trusted build utility.
Detects mount(8) bind operations from writable temp directories onto sensitive system subtrees, sometimes used to bypass integrity expectations or overlay binaries.
Linux Interpreter with Command Execution
Cortex XDR
Detects the execution of PHP, Perl, or Ruby script interpreters on Linux systems when they are invoked with command-line arguments that suggest direct execution of code, especially when combined with commands or functions commonly used for remote code execution or data exfiltration. This rule aims to identify potential web shell activity or other forms of arbitrary command execution.
Detects the execution of the public Dirty Frag exploit tool by monitoring for its hardcoded command-line arguments (--force-esp, --force-rxrpc). This vulnerability allows local attackers to gain root privileges via page-cache tampering in the Linux kernel without race conditions.
Entra ID TAP Sign In
Cortex XDR
Looks for a Temporary Access Pass in Entra ID
This rule detects potential log tampering activities on Linux systems followed by service manipulation within a 20-minute window on the same host.
This rule detects the execution of commands that include 'splice' in conjunction with common privilege escalation utilities such as 'su', 'sudo', or 'passwd', or attempts to access '/etc/passwd'. This privilege escalation resembles Copy Fail.
Detects the execution of the 'gh auth token' command. This behavior was observed being used by the TeamPCP malicious npm package (hijacked @bitwarden/cli) via a shell collector script to harvest active GitHub CLI authentication tokens from developer endpoints.
This rule detects the execution of the 'su' command on Linux systems. The 'su' command is used to run commands with a substitute user and group ID, most commonly to switch to the root user. Related to Copy Fail
Detects suspicious command-line arguments indicative of potential credential access attempts (cmdkey /list), or execution of hidden processes (excluding Java applications), or communication with a known malicious domain (staybud.dpdns.org).
Page 19 of 38