execve

Binary Padding - Linux

Dec 8, 2025 · attack.defense-evasion attack.t1027.001 ·

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.

Bpfdoor TCP Ports Redirect

Dec 8, 2025 · attack.defense-evasion attack.t1562.004 ·

Share on:

All TCP traffic on particular port from attacker is routed to different port. ex. '/sbin/iptables -t nat -D PREROUTING -p tcp -s 192.168.1.1 --dport 22 -j REDIRECT --to-ports 42392' The traffic looks like encrypted SSH communications going to TCP port 22, but in reality is being directed to the shell port once it hits the iptables rule for the attacker host only.

Clipboard Collection of Image Data with Xclip Tool

Dec 8, 2025 · attack.collection attack.t1115 ·

Share on:

Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.

Clipboard Collection with Xclip Tool - Auditd

Dec 8, 2025 · attack.collection attack.t1115 ·

Share on:

Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.

Credentials In Files - Linux

Dec 8, 2025 · attack.credential-access attack.t1552.001 ·

Share on:

Detecting attempts to extract passwords with grep

Data Compressed

Dec 8, 2025 · attack.exfiltration attack.collection attack.t1560.001 ·

Share on:

An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Data Exfiltration with Wget

Dec 8, 2025 · attack.exfiltration attack.t1048.003 ·

Share on:

Detects attempts to post the file with the usage of wget utility. The adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could allow them to read files like /etc/shadow.

File or Folder Permissions Change

Dec 8, 2025 · attack.defense-evasion attack.t1222.002 ·

Share on:

Detects file and folder permission changes.

File Time Attribute Change - Linux

Dec 8, 2025 · attack.defense-evasion attack.t1070.006 ·

Share on:

Detect file time attribute change to hide new or changes to existing files.

Hidden Files and Directories

Dec 8, 2025 · attack.defense-evasion attack.t1564.001 ·

Share on:

Detects adversary creating hidden file or directory, by detecting directories or files with . as the first character

Linux Capabilities Discovery

Dec 8, 2025 · attack.discovery attack.defense-evasion attack.privilege-escalation attack.t1083 attack.t1548 ·

Share on:

Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.

Masquerading as Linux Crond Process

Dec 8, 2025 · attack.defense-evasion attack.t1036.003 ·

Share on:

Masquerading occurs when the name or location of an executable, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. Several different variations of this technique have been observed.

Modify System Firewall

Dec 8, 2025 · attack.t1562.004 attack.defense-evasion ·

Share on:

Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access. Detection rules that match only on the disabling of firewalls will miss this.

Network Sniffing - Linux

Dec 8, 2025 · attack.credential-access attack.discovery attack.t1040 ·

Share on:

Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

Overwriting the File with Dev Zero or Null

Dec 8, 2025 · attack.impact attack.t1485 ·

Share on:

Detects overwriting (effectively wiping/deleting) of a file.

Possible Coin Miner CPU Priority Param

Dec 8, 2025 · attack.privilege-escalation attack.t1068 ·

Share on:

Detects command line parameter very often used with coin miners

Remove Immutable File Attribute - Auditd

Dec 8, 2025 · attack.defense-evasion attack.t1222.002 ·

Share on:

Detects removing immutable file attribute.

Screen Capture with Import Tool

Dec 8, 2025 · attack.collection attack.t1113 ·

Share on:

Detects adversary creating screen capture of a desktop with Import Tool. Highly recommended using rule on servers, due to high usage of screenshot utilities on user workstations. ImageMagick must be installed.

Screen Capture with Xwd

Dec 8, 2025 · attack.collection attack.t1113 ·

Share on:

Detects adversary creating screen capture of a full with xwd. Highly recommended using rule on servers, due high usage of screenshot utilities on user workstations

Service Reload or Start - Linux

Dec 8, 2025 · attack.privilege-escalation attack.persistence attack.t1543.002 ·

Share on:

Detects the start, reload or restart of a service.

Steganography Extract Files with Steghide

Dec 8, 2025 · attack.defense-evasion attack.t1027.003 ·

Share on:

Detects extraction of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.

Steganography Hide Files with Steghide

Dec 8, 2025 · attack.defense-evasion attack.t1027.003 ·

Share on:

Detects embedding of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.

Steganography Hide Zip Information in Picture File

Dec 8, 2025 · attack.defense-evasion attack.t1027.003 ·

Share on:

Detects appending of zip file to image

Steganography Unzip Hidden Information From Picture File

Dec 8, 2025 · attack.defense-evasion attack.t1027.003 ·

Share on:

Detects extracting of zip file from image file

Suspicious Commands Linux

Dec 8, 2025 · attack.execution attack.t1059.004 ·

Share on:

Detects relevant commands often related to malware or hacking activity

Suspicious History File Operations - Linux

Dec 8, 2025 · attack.credential-access attack.t1552.003 ·

Share on:

Detects commandline operations on shell history files

System Owner or User Discovery - Linux

Dec 8, 2025 · attack.discovery attack.t1033 ·

Share on:

Detects the execution of host or user discovery utilities such as "whoami", "hostname", "id", etc. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

System Shutdown/Reboot - Linux

Dec 8, 2025 · attack.impact attack.t1529 ·

Share on:

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.