Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,082 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
This rule detects attempts to remove AppArmor profiles on Linux systems. AppArmor is a Linux security module that allows system administrators to restrict program capabilities with per-program profiles. An adversary might attempt to remove or disable AppArmor profiles to bypass restrictions and perform unauthorized actions.
Detects attempts to modify file timestamps on Linux systems using the 'touch' command with the '-r' or '--reference' flags. This technique, known as timestomping, allows adversaries to change the access and modification times of a file to match those of another file, to evade detection or blend malicious files with legitimate ones.
This rule detects attempts to clear or truncate journal logs on Linux systems. Adversaries may clear logs to remove evidence of their activities.
This rule detects attempts to stop or disable critical system services and security mechanisms on Linux systems,.Adversaries may attempt to disable these services to impair defenses, remove logging capabilities, or bypass security controls.
Detects attempts to disable SELinux by executing the 'setenforce 0' command on Linux systems. Disabling SELinux can reduce the security posture of a system and is often performed by attackers to simplify post-exploitation activities or to bypass security controls.
This rule detects attempts to mount a bind from a temporary directory or other sensitive system directories on Linux systems. This behavior can be indicative of an attacker trying to hide malicious activity or gain persistence by mounting a bind from a compromised location to a system directory.
This rule detects the execution of the 'make' command with a '-f' flag pointing to a makefile located in common temporary or writable directories. This behavior can be indicative of an adversary attempting to execute arbitrary commands or escalate privileges by leveraging the 'make' utility to process a malicious makefile from a non-standard location.
This rule detects suspicious command execution patterns involving the Lua interpreter on Linux systems. It specifically looks for Lua interpreter processes executing commands that run suspicious functions. These functions can be abused by adversaries to execute arbitrary commands, establish network connections, or load dynamic libraries, indicating potential malicious activity.
Detects attempts to load kernel modules using common utilities like 'insmod', 'modprobe', or 'kmod'. This activity can be indicative of an attacker attempting to establish persistence, elevate privileges, or hide malicious activity by loading custom kernel modules.
Detects php/perl/ruby one-liner execution patterns combined with network or shell invocation primitives, consistent with trusted interpreter abuse and execution guardrail bypass.
Page 22 of 38