Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,082 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
This rule detects the presence of suspicious script content (e.g., 'system(', 'exec(', '/dev/tcp/') within Python (.py) or shell (.sh) files located in common plugin directories on Linux systems. This could indicate an attempt to inject malicious code into package management configurations for persistence or privilege escalation.
This rule detects the execution of common system enumeration commands (lsblk, hostname, mount, uname) within a Docker container, when the container is run with privileged access. This activity could indicate an adversary attempting to glean information about the container environment.
Detects the execution of 'awk' with command-line arguments that indicate it's being used to execute system commands or scripts. This often signifies malicious activity where 'awk' is leveraged for arbitrary command execution.
This rule detects the execution of SUID binaries by a non-root user, immediately followed by the creation of a persistence mechanism such as a systemd service file or a cron job. This correlation aims to identify potential privilege escalation attempts where an attacker uses an SUID binary to gain elevated privileges and then establishes persistence on the system.
This rule detects the use of 'openssl' or 'base64' for decoding data piped into a shell (bash, sh, zsh) or scripting interpreter (python, perl). This pattern is often used by adversaries to decode obfuscated commands or payloads directly into memory for execution, bypassing disk-based detection.
This rule detects the execution of a Linux process where the command line contains environment variables related to dynamic linker debugging (LD_AUDIT, LD_DEBUG, or LD_DEBUG_OUTPUT). These variables can be abused by adversaries to load malicious libraries, bypass security controls.
Detects awk one-liners invoking system/exec, a common LOLBIN-style execution guardrail bypass.
For example, using environmental variables where an attacker modifies the environment variable to point to a malicious binary.
For example, using environmental variables where an attacker modifies the environment variable to point to a malicious binary.
This rule detects the execution of the 'strip' utility on Linux systems, when it is used on a file located in common temporary directories or user home directories. Adversaries may use 'strip' to remove symbols from compiled binaries, making reverse engineering more difficult and potentially reducing file size, which can aid in obfuscation or evasion.
Detects copying or writing certificate material and modifications to system keychains. Execution of `security add-trusted-cert`.
Detects unauthorized processes attempting to access or interact with the dynamically generated Azure Arc identity token .key files. These files reside in a protected directory and are limited to SYSTEM-level ARC agent processes
(CVE-2026-26117)
(CVE-2026-26117)
Page 21 of 38