Data Source: System | Detection.FYI

Process Started with Executable Stack

Apr 10, 2026 · Domain: Endpoint OS: Linux Use Case: Threat Detection Tactic: Execution Data Source: System Resources: Investigation Guide ·
Share on:

This rule monitors the syslog log file for messages related to instances of processes that are started with an executable stack. This can be an indicator of a process that is attempting to execute code from the stack, which can be a security risk.

Read More
Unusual Login via System User

Apr 1, 2026 · Domain: Endpoint OS: Linux Use Case: Threat Detection Tactic: Persistence Tactic: Defense Evasion Data Source: System Resources: Investigation Guide ·
Share on:

This rule identifies successful logins by system users that are uncommon to authenticate. These users have "nologin" set by default, and must be modified to allow SSH access. Adversaries may backdoor these users to gain unauthorized access to the system.

Read More