process_creation

Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.

ESXi System Information Discovery Via ESXCLI

Sep 6, 2023 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.

ESXi VM Kill Via ESXCLI

Sep 6, 2023 · attack.execution ·

Share on:

Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.

ESXi VM List Discovery Via ESXCLI

Sep 6, 2023 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.

ESXi VSAN Information Discovery Via ESXCLI

Sep 6, 2023 · attack.discovery attack.t1033 attack.t1007 ·

Share on:

Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.

Interactive Bash Suspicious Children

Aug 28, 2023 · attack.execution attack.defense_evasion attack.t1059.004 attack.t1036 ·

Share on:

Detects suspicious interactive bash as a parent to rather uncommon child processes

Linux Crypto Mining Indicators

Aug 28, 2023 · attack.impact attack.t1496 ·

Share on:

Detects command line parameters or strings often used by crypto miners

Nohup Execution

Aug 28, 2023 · attack.execution attack.t1059.004 ·

Share on:

Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments

Potentially Suspicious Execution From Tmp Folder

Aug 28, 2023 · attack.defense_evasion attack.t1036 ·

Share on:

Detects a potentially suspicious execution of a process located in the '/tmp/' folder

Container Residence Discovery Via Proc Virtual FS

Aug 24, 2023 · attack.discovery attack.t1082 ·

Share on:

Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem

Docker Container Discovery Via Dockerenv Listing

Aug 24, 2023 · attack.discovery attack.t1082 ·

Share on:

Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery

Potential Container Discovery Via Inodes Listing

Aug 24, 2023 · attack.discovery attack.t1082 ·

Share on:

Detects listing of the inodes of the "/" directory to determin if the we are running inside of a container.

Potential Linux Amazon SSM Agent Hijacking

Aug 3, 2023 · attack.command_and_control attack.persistence attack.t1219 ·

Share on:

Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research reoport.

Potentially Suspicious Named Pipe Created Via Mkfifo

Jun 19, 2023 · attack.execution ·

Share on:

Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location

Linux Base64 Encoded Pipe to Shell

Jun 18, 2023 · attack.defense_evasion attack.t1140 ·

Share on:

Detects suspicious process command line that uses base64 encoded input for execution with a shell

Named Pipe Created Via Mkfifo

Jun 18, 2023 · attack.execution ·

Share on:

Detects the creation of a new named pipe using the "mkfifo" utility

Python Spawning Pretty TTY

Jun 18, 2023 · attack.execution attack.t1059 ·

Share on:

Detects python spawning a pretty tty which could be indicative of potential reverse shell activity

Crontab Enumeration

Jun 2, 2023 · attack.discovery attack.t1007 ·

Share on:

Detects usage of crontab to list the tasks of the user

Download File To Potentially Suspicious Directory Via Wget

Jun 2, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects the use of wget to download content to a suspicious directory

Execution Of Script Located In Potentially Suspicious Directory

Jun 2, 2023 · attack.execution ·

Share on:

Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh", etc.

OS Architecture Discovery Via Grep

Jun 2, 2023 · attack.discovery attack.t1082 ·

Share on:

Detects the use of grep to identify information about the operating system architecture. Often combined beforehand with the execution of "uname" or "cat /proc/cpuinfo"

Potential GobRAT File Discovery Via Grep

Jun 2, 2023 · attack.discovery attack.t1082 ·

Share on:

Detects the use of grep to discover specific files created by the GobRAT malware

Shell Execution Of Process Located In Tmp Directory

Jun 2, 2023 · attack.execution ·

Share on:

Detects execution of shells from a parent process located in a temporary (/tmp) directory

Suspicious Nohup Execution

Jun 2, 2023 · attack.execution ·

Share on:

Detects execution of binaries located in potentially suspicious locations via "nohup"

Potential Suspicious Change To Sensitive/Critical Files

May 30, 2023 · attack.impact attack.t1565.001 ·

Share on:

Detects changes of sensitive and critical files. Monitors files that you don't expect to change without planning on Linux system.

Suspicious Curl File Upload - Linux

May 3, 2023 · attack.exfiltration attack.t1567 attack.t1105 ·

Share on:

Detects a suspicious curl process start the adds a file to a web request

Bash Interactive Shell

Apr 25, 2023 · attack.execution ·

Share on:

Detects execution of the bash shell with the interactive flag "-i".

Potential Netcat Reverse Shell Execution

Apr 25, 2023 · attack.execution attack.t1059 ·

Share on:

Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse shell setup.

Potential Perl Reverse Shell Execution

Apr 25, 2023 · attack.execution ·

Share on:

Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity

Potential PHP Reverse Shell

Apr 25, 2023 · attack.execution ·

Share on:

Detects usage of the PHP CLI with the "-r" flag which allows it to run inline PHP code. The rule looks for calls to the "fsockopen" function which allows the creation of sockets. Attackers often leverage this in combination with functions such as "exec" or "fopen" to initiate a reverse shell connection.

Potential Python Reverse Shell

Apr 25, 2023 · attack.execution ·

Share on:

Detects executing python with keywords related to network activity that could indicate a potential reverse shell

Potential Ruby Reverse Shell

Apr 25, 2023 · attack.execution ·

Share on:

Detects execution of ruby with the "-e" flag and calls to "socket" related functions. This could be an indication of a potential attempt to setup a reverse shell

Potential Xterm Reverse Shell

Apr 25, 2023 · attack.execution attack.t1059 ·

Share on:

Detects usage of "xterm" as a potential reverse shell tunnel

System Network Discovery - Linux

Apr 5, 2023 · attack.discovery attack.t1016 ·

Share on:

Detects enumeration of local network configuration

Terminate Linux Process Via Kill

Mar 20, 2023 · attack.defense_evasion attack.t1562 ·

Share on:

Detects usage of command line tools such as "kill", "pkill" or "killall" to terminate or signal a running process.

Linux Package Uninstall

Mar 12, 2023 · attack.defense_evasion attack.t1070 ·

Share on:

Detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg".

Linux Network Service Scanning

Mar 5, 2023 · attack.discovery attack.t1046 ·

Share on:

Detects enumeration of local or remote network services.

Vim GTFOBin Abuse - Linux

Feb 6, 2023 · attack.discovery attack.t1083 ·

Share on:

Detects usage of "vim" and it's siblings as a GTFOBin to execute and proxy command and binary execution

Apache Spark Shell Command Injection - ProcessCreation

Feb 1, 2023 · attack.initial_access attack.t1190 cve.2022.33891 ·

Share on:

Detects attempts to exploit an apache spark server via CVE-2014-6287 from a commandline perspective

Apt GTFOBin Abuse - Linux

Feb 1, 2023 · attack.discovery attack.t1083 ·

Share on:

Detects usage of "apt" and "apt-get" as a GTFOBin to execute and proxy command and binary execution

Atlassian Confluence CVE-2022-26134

Feb 1, 2023 · attack.initial_access attack.execution attack.t1190 attack.t1059 cve.2022.26134 ·

Share on:

Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2022-26134

Capabilities Discovery - Linux

Feb 1, 2023 · attack.discovery attack.t1083 ·

Share on:

Detects usage of "getcap" binary. This is often used during recon activity to determine potential binaries that can be abused as GTFOBins or other.

Cat Sudoers

Feb 1, 2023 · attack.reconnaissance attack.t1592.004 ·

Share on:

Detects the execution of a cat /etc/sudoers to list all users that have sudo rights

Commands to Clear or Remove the Syslog

Feb 1, 2023 · attack.defense_evasion attack.t1070.002 ·

Share on:

Detects specific commands commonly used to remove or empty the syslog. Which is often used by attacker as a method to hide their tracks

Curl Usage on Linux

Feb 1, 2023 · attack.command_and_control attack.t1105 ·

Share on:

Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to a remote server

Disable Or Stop Services

Feb 1, 2023 · attack.defense_evasion ·

Share on:

Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services

Enable BPF Kprobes Tracing

Feb 1, 2023 · attack.execution attack.defense_evasion ·

Share on:

Detects common command used to enable bpf kprobes tracing

History File Deletion

Feb 1, 2023 · attack.impact attack.t1565.001 ·

Share on:

Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity

Linux Base64 Encoded Shebang In CLI

Feb 1, 2023 · attack.defense_evasion attack.t1140 ·

Share on:

Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload about to be decoded

Linux HackTool Execution

Feb 1, 2023 · attack.execution ·

Share on:

Detects known hacktool execution based on image name

Linux Recon Indicators

Feb 1, 2023 · attack.reconnaissance attack.t1592.004 attack.credential_access attack.t1552.001 ·

Share on:

Detects events with patterns found in commands used for reconnaissance on linux systems

Linux Shell Pipe to Shell

Feb 1, 2023 · attack.defense_evasion attack.t1140 ·

Share on:

Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell

Linux Webshell Indicators

Feb 1, 2023 · attack.persistence attack.t1505.003 ·

Share on:

Detects suspicious sub processes of web server processes

Potential Discovery Activity Using Find - Linux

Feb 1, 2023 · attack.discovery attack.t1083 ·

Share on:

Detects usage of "find" binary in a suspicious manner to perform discovery

Print History File Contents

Feb 1, 2023 · attack.reconnaissance attack.t1592.004 ·

Share on:

Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance

Remove Immutable File Attribute

Feb 1, 2023 · attack.defense_evasion attack.t1222.002 ·

Share on:

Detects usage of the 'chattr' utility to remove immutable file attribute.

Remove Scheduled Cron Task/Job

Feb 1, 2023 · attack.defense_evasion ·

Share on:

Detects usage of the 'crontab' utility to remove the current crontab. This is a common occurrence where cryptocurrency miners compete against each other by removing traces of other miners to hijack the maximum amount of resources possible

Sudo Privilege Escalation CVE-2019-14287

Feb 1, 2023 · attack.privilege_escalation attack.t1068 attack.t1548.003 cve.2019.14287 ·

Share on:

Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287

Suspicious Curl Change User Agents - Linux

Feb 1, 2023 · attack.command_and_control attack.t1071.001 ·

Share on:

Detects a suspicious curl process start on linux with set useragent options

Suspicious Git Clone - Linux

Feb 1, 2023 · attack.reconnaissance attack.t1593.003 ·

Share on:

Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious

Suspicious Java Children Processes

Feb 1, 2023 · attack.execution attack.t1059 ·

Share on:

Detects java process spawning suspicious children

Suspicious Package Installed - Linux

Feb 1, 2023 · attack.defense_evasion attack.t1553.004 ·

Share on:

Detects installation of suspicious packages using system installation utilities

Triple Cross eBPF Rootkit Execve Hijack

Feb 1, 2023 · attack.defense_evasion attack.privilege_escalation ·

Share on:

Detects execution of a the file "execve_hijack" which is used by the Triple Cross rootkit as a way to elevate privileges

Triple Cross eBPF Rootkit Install Commands

Feb 1, 2023 · attack.defense_evasion attack.t1014 ·

Share on:

Detects default install commands of the Triple Cross eBPF rootkit based on the "deployer.sh" script

Copy Passwd Or Shadow From TMP Path

Jan 31, 2023 · attack.credential_access attack.t1552.001 ·

Share on:

Detects when the file "passwd" or "shadow" is copied from tmp path

Mount Execution With Hidepid Parameter

Jan 31, 2023 · attack.credential_access attack.t1564 ·

Share on:

Detects execution of the "mount" command with "hidepid" parameter to make invisible processes to other users from the system

Touch Suspicious Service File

Jan 31, 2023 · attack.defense_evasion attack.t1070.006 ·

Share on:

Detects usage of the "touch" process in service file.

Flush Iptables Ufw Chain

Jan 30, 2023 · attack.defense_evasion attack.t1562.004 ·

Share on:

Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic

Ufw Force Stop Using Ufw-Init

Jan 30, 2023 · attack.defense_evasion attack.t1562.004 ·

Share on:

Detects attempts to force stop the ufw using ufw-init

BPFtrace Unsafe Option Usage

Jan 27, 2023 · attack.execution attack.t1059.004 ·

Share on:

Detects the usage of the unsafe bpftrace option

System Network Connections Discovery - Linux

Jan 17, 2023 · attack.discovery attack.t1049 ·

Share on:

Detects usage of system utilities to discover system network connections

Setuid and Setgid

Jan 10, 2023 · attack.persistence attack.t1548.001 ·

Share on:

Detects suspicious change of file privileges with chown and chmod commands

Decode Base64 Encoded Text

Dec 29, 2022 · attack.defense_evasion attack.t1027 ·

Share on:

Detects usage of base64 utility to decode arbitrary base64-encoded text

Group Has Been Deleted Via Groupdel

Dec 27, 2022 · attack.impact attack.t1531 ·

Share on:

Detects execution of the "groupdel" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks

User Has Been Deleted Via Userdel

Dec 27, 2022 · attack.impact attack.t1531 ·

Share on:

Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks

User Added To Root/Sudoers Group Using Usermod

Dec 21, 2022 · attack.privilege_escalation attack.persistence ·

Share on:

Detects usage of the "usermod" binary to add users add users to the root or suoders groups

Local Groups Discovery - Linux

Nov 28, 2022 · attack.discovery attack.t1069.001 ·

Share on:

Detects enumeration of local system groups. Adversaries may attempt to find local system groups and permission settings

Local System Accounts Discovery - Linux

Nov 28, 2022 · attack.discovery attack.t1087.001 ·

Share on:

Detects enumeration of local systeam accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.

Scheduled Cron Task/Job - Linux

Nov 28, 2022 · attack.execution attack.persistence attack.privilege_escalation attack.t1053.003 ·

Share on:

Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.

Security Software Discovery - Linux

Nov 28, 2022 · attack.discovery attack.t1518.001 ·

Share on:

Detects usage of system utilities (only grep and egrep for now) to discover security software discovery

File and Directory Discovery - Linux

Nov 25, 2022 · attack.discovery attack.t1083 ·

Share on:

Detects usage of system utilities to discover files and directories

Chmod Suspicious Directory

Oct 25, 2022 · attack.defense_evasion attack.t1222.002 ·

Share on:

Detects chmod targeting files in abnormal directory paths.

Clear Linux Logs

Oct 25, 2022 · attack.defense_evasion attack.t1070.002 ·

Share on:

Detects attempts to clear logs on the system. Adversaries may clear system logs to hide evidence of an intrusion

Clipboard Collection with Xclip Tool

Oct 25, 2022 · attack.collection attack.t1115 ·

Share on:

Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.

Connection Proxy

Oct 25, 2022 · attack.defense_evasion attack.t1090 ·

Share on:

Detects setting proxy configuration

DD File Overwrite

Oct 25, 2022 · attack.impact attack.t1485 ·

Share on:

Detects potential overwriting and deletion of a file using DD.

File Deletion

Oct 25, 2022 · attack.defense_evasion attack.t1070.004 ·

Share on:

Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity

Install Root Certificate

Oct 25, 2022 · attack.defense_evasion attack.t1553.004 ·

Share on:

Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to controlled web servers or C2s

Linux Remote System Discovery

Oct 25, 2022 · attack.discovery attack.t1018 ·

Share on:

Detects the enumeration of other remote systems.

OMIGOD SCX RunAsProvider ExecuteScript

Oct 25, 2022 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·

Share on:

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

OMIGOD SCX RunAsProvider ExecuteShellCommand

Oct 25, 2022 · attack.privilege_escalation attack.initial_access attack.execution attack.t1068 attack.t1190 attack.t1203 ·

Share on:

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

Process Discovery

Oct 25, 2022 · attack.discovery attack.t1057 ·

Share on:

Detects process discovery commands. Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network

Scheduled Task/Job At

Oct 25, 2022 · attack.persistence attack.t1053.002 ·

Share on:

Detects the use of at/atd which are utilities that are used to schedule tasks. They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code

System Information Discovery

Oct 25, 2022 · attack.discovery attack.t1082 ·

Share on:

Detects system information discovery commands

Disabling Security Tools

Oct 9, 2022 · attack.defense_evasion attack.t1562.004 ·

Share on:

Detects disabling security tools

Linux Doas Tool Execution

Sep 16, 2022 · attack.privilege_escalation attack.t1548 ·

Share on:

Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does.