file_event | Detection.FYI

Linux Doas Conf File Creation

Aug 12, 2024 · attack.privilege-escalation attack.t1548 ·
Share on:

Detects the creation of doas.conf file in linux host platform.

Read More
Persistence Via Cron Files

Aug 12, 2024 · attack.persistence attack.t1053.003 ·
Share on:

Detects creation of cron file or files in Cron directories which could indicates potential persistence.

Read More
Persistence Via Sudoers Files

Aug 12, 2024 · attack.persistence attack.t1053.003 ·
Share on:

Detects creation of sudoers file or files in "sudoers.d" directory which can be used a potential method to persiste privileges for a specific user.

Read More
Potentially Suspicious Shell Script Creation in Profile Folder

Aug 12, 2024 · attack.persistence ·
Share on:

Detects the creation of shell scripts under the "profile.d" path.

Read More
Triple Cross eBPF Rootkit Default LockFile

Aug 12, 2024 · attack.defense-evasion ·
Share on:

Detects the creation of the file "rootlog" which is used by the TripleCross rootkit as a way to check if the backdoor is already running.

Read More
Triple Cross eBPF Rootkit Default Persistence

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1053.003 ·
Share on:

Detects the creation of "ebpfbackdoor" files in both "cron.d" and "sudoers.d" directories. Which both are related to the TripleCross persistence method

Read More
Wget Creating Files in Tmp Directory

Aug 12, 2024 · attack.command-and-control attack.t1105 ·
Share on:

Detects the use of wget to download content in a temporary directory such as "/tmp" or "/var/tmp"

Read More