Identifies OpenSSL generating a CN=LinuxTransport certificate or decrypting CMS/PKCS7 payloads with a key that is not the Azure Linux Agent certificate under /var/lib/waagent. Adversaries can scrape WireServer certificates, mint a LinuxTransport identity, and decrypt extension protectedSettings with openssl cms -decrypt or smime -decrypt.

Read More

This rule identifies potential fileless ELF execution where a process is launched from an anonymous temporary executable path that appears as "/#" in "process.executable". This pattern may be associated with "O_TMPFILE" and "execveat" with "AT_EMPTY_PATH", which can allow execution without a normal filesystem pathname.

Read More

This rule detects the creation of a binfmt configuration file. Binfmt is a utility that is used to configure the behavior of the Linux kernel when executing binary files. By creating a malicious binfmt configuration file, threat actors can execute a backdoor script or command on the target system.

Read More

This rule detects command lines that reference another process or thread's procfs syscall file. The "/proc//syscall" interface exposes the current syscall arguments, stack pointer, and instruction pointer, which can support process discovery and preparation for process injection. Self and thread-self aliases are excluded.

Read More