Detects the use of the "gcc" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Read More

Detects the use of the find command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or exploitation attempt.

Read More

Detects the use of the "flock" command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Read More

Detects the use of the "nice" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Read More

Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Read More

Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Read More

Detects usage of "getcap" binary. This is often used during recon activity to determine potential binaries that can be abused as GTFOBins or other.

Read More

Find information about network devices that is not stored in config files

Read More

Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. It was seen used by BlackCat ransomware to create a list of accessible directories and files.

Read More

Detects usage of system utilities to discover files and directories

Read More

Detects usage of system utilities to discover files and directories

Read More

Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff

Read More

Detects usage of "find" binary in a suspicious manner to perform discovery

Read More

Detects usage of "find" binary in a suspicious manner to perform discovery

Read More

Detects technique used by MAZE ransomware to enumerate directories using Powershell

Read More

Detect adversaries enumerate sensitive files

Read More

Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters

Read More

Detects source code enumeration that use GET requests by keyword searches in URL strings

Read More

Detects automated lateral movement by Turla group

Read More

Detects WannaCry ransomware activity

Read More

Detecting the use of dir command to inspect directories on the remote host.

Read More