Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,082 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects command-line execution that attempts to access GitHub authentication tokens outside of expected CI/CD or development environments. This could indicate an attempt to steal or misuse credentials.
This rule detects processes with a command line containing 'socket' and various cryptographic keywords (copy.fail, algif_aead, authencesn, hmac.*sha256.*cbc.*aes). This combination can indicate suspicious related to Copy Fail CVE-2026-3143
This rule detects attempts to install custom Certificate Authority (CA) certificates on Linux systems using common utilities. Adversaries may install root certificates to subvert trust controls, allowing them to intercept encrypted traffic or sign malicious code without triggering security warnings. The rule specifically looks for these utilities being used to interact with common CA certificate directories, while excluding a placeholder for legitimate custom CA installations depending on your environment.
Detects process creation for common RMM tools.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious/malicious.
Note: Not using the in(field=ImageFileName, values=["values"]) logic here due to needing regex and variations of the RMM names, and not exact values.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious/malicious.
Note: Not using the in(field=ImageFileName, values=["values"]) logic here due to needing regex and variations of the RMM names, and not exact values.
For network requests to the GitHub API containing specific staging and fallback markers (LongLiveTheResistanceAgainstMachines or beautifulcastle) used by TeamPCP in the Bitwarden CLI campaign to retrieve C2 instructions.
Susp AWK Command Execution
Gravwell
This rule detects suspicious execution of the 'awk' command on Linux systems. Specifically, it looks for 'awk' commands that include suspicious patterns. This pattern is often indicative of malicious script execution or code injection attempts using 'awk' for arbitrary command execution.
This rule detects the creation, patching, or updating of Kubernetes ClusterRoleBindings, RoleBindings, or Roles within the 'prod', 'production', or 'default' namespaces. It specifically excludes actions performed by the 'system:clusterrole-aggregation-controller' to reduce noise from legitimate system operations. This activity can indicate an attempt to manipulate access controls within the Kubernetes cluster, potentially for privilege escalation or persistence.
This rule detects the execution of specific Linux utilities that can be used to gather system information, related to virtualization and hardware details. Adversaries often use these tools during the discovery phase to understand the environment they have compromised and adjust accordingly.
Detects the execution of 'awk' with command-line arguments that indicate it's being used to execute system commands or scripts. This often signifies malicious activity where 'awk' is leveraged for arbitrary command execution.
This rule detects attempts to modify GRUB configuration files using common text editors. Adversaries may modify GRUB configuration to establish persistence, disable security features, or alter the boot process for malicious purposes.
Page 20 of 38