syscall

Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall

Dec 8, 2025 · attack.defense-evasion attack.t1070.002 ·

Detects the use of the syslog syscall with action code 5 (SYSLOG_ACTION_CLEAR), (4 is SYSLOG_ACTION_READ_CLEAR and 6 is SYSLOG_ACTION_CONSOLE_OFF) which clears the kernel ring buffer (dmesg logs). This can be used by attackers to hide traces after exploitation or privilege escalation. A common technique is running dmesg -c, which triggers this syscall internally.

Creation Of An User Account

Dec 8, 2025 · attack.t1136.001 attack.persistence ·

Share on:

Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

Linux Network Service Scanning - Auditd

Dec 8, 2025 · attack.discovery attack.t1046 ·

Share on:

Detects enumeration of local or remote network services.

Loading of Kernel Module via Insmod

Dec 8, 2025 · attack.persistence attack.privilege-escalation attack.t1547.006 ·

Share on:

Detects loading of kernel modules with insmod command. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Adversaries may use LKMs to obtain persistence within the system or elevate the privileges.

Program Executions in Suspicious Folders

Dec 8, 2025 · attack.t1587 attack.t1584 attack.resource-development ·

Share on:

Detects program executions in suspicious non-program folders related to malware or hacking activity

Special File Creation via Mknod Syscall

Dec 8, 2025 · attack.privilege-escalation attack.persistence attack.t1543.003 ·

Share on:

Detects usage of the mknod syscall to create special files (e.g., character or block devices). Attackers or malware might use mknod to create fake devices, interact with kernel interfaces, or establish covert channels in Linux systems. Monitoring the use of mknod is important because this syscall is rarely used by legitimate applications, and it can be abused to bypass file system restrictions or create backdoors.

Split A File Into Pieces - Linux

Dec 8, 2025 · attack.exfiltration attack.t1030 ·

Share on:

Detection use of the command "split" to split files into parts and possible transfer.

System Info Discovery via Sysinfo Syscall

Dec 8, 2025 · attack.discovery attack.t1057 attack.t1082 ·

Share on:

Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes. Malware or reconnaissance tools might leverage sysinfo to fingerprint the system - gathering data to determine if it's a viable target.