Read More

Detects buffer overflow attempts in Unix system log files

Read More

Read More

Detects the ld.so preload persistence file. See man ld.so for more information.

Read More

Detects specific commands commonly used to remove or empty the syslog

Read More

Read More

Detects suspicious shell commands used in various Equation Group scripts and tools

Read More

Read More

Detects suspicious command sequence that JexBoss

Read More

Detects commands that try to clear or tamper with the Linux command history. This technique is used by threat actors in order to evade defenses and execute commands without them being recorded in files such as "bash_history" or "zsh_history".

Read More

Detects exploitation of Nimbuspwn privilege escalation vulnerability (CVE-2022-29799 and CVE-2022-29800)

Read More

Detects the presence of "bpf_probe_write_user" BPF helper-generated warning messages. Which could be a sign of suspicious eBPF activity on the system.

Read More

Detects the addition of a new user to a privileged group such as "root" or "sudo"

Read More

Detects the use of tools that copy files from or to remote systems

Read More

Detects shellshock expressions in log files

Read More

Detects space after filename

Read More

Read More

Read More

Detects suspicious shell commands used in various exploit codes (see references)

Read More

Detects suspicious log entries in Linux log files

Read More

Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse shell

Read More

Detects suspicious command with /dev/tcp

Read More

Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd

Read More

Read More

Read More