Data Source: System | Detection.FYI

Process Started with Executable Stack

Sep 19, 2026 · Domain: Endpoint OS: Linux Use Case: Threat Detection Tactic: Execution Data Source: System Resources: Investigation Guide Noise: Medium Performance: Normal Rule Type: Custom Query (KQL) Platform: Linux ·
Share on:

This rule monitors the syslog log file for messages related to instances of processes that are started with an executable stack. This can be an indicator of a process that is attempting to execute code from the stack, which can be a security risk.

Read More
Unusual Login via System User

Sep 19, 2026 · Domain: Endpoint OS: Linux Use Case: Threat Detection Tactic: Persistence Tactic: Defense Evasion Data Source: System Resources: Investigation Guide Noise: Low Performance: Normal Rule Type: New Terms Platform: Linux ·
Share on:

This rule identifies successful logins by system users that are uncommon to authenticate. These users have "nologin" set by default, and must be modified to allow SSH access. Adversaries may backdoor these users to gain unauthorized access to the system.

Read More