Detection rules for General Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 22 detection rules.

Rule Example

Below is an example of a rule definition for System Linux: A user has been added to the administrators group (view in repository):

# Rule version v1.0.0

dataTypes:
  - linux
name: "System Linux: A user has been added to the administrators group"
impact:
  confidentiality: 3
  integrity: 3
  availability: 2
category: "Privilege Escalation"
technique: "T1484 - Domain Policy Modification"
adversary: origin
description: "Detects when a user has been added to the administrators group (sudo) on a Linux system."
references:
  - "https://attack.mitre.org/tactics/TA0004"
  - "https://attack.mitre.org/techniques/T1484/"
where: regexMatch("log.message", "(((adduser|useradd|usermod)(.+)([Aa]dded user|new user|add)(.+)to(.+)group)(.+)sudo)") && contains("log.message", "usermod -aG sudo")
groupBy:
  - origin.ip
  - origin.user

Rule Details

System Linux: A user has been added to the administrators group

Identifies the addition of a user to the sudo administrators group on a Linux system.

• Category: Privilege Escalation

• Technique: T1484 - Domain Policy Modification

• Impact: C:3 / I:3 / A:2

• Rule file: user_added_to_admin_group.yml

• Reference: https://attack.mitre.org/tactics/TA0004

• Reference: https://attack.mitre.org/techniques/T1484/

System Linux: Attempt to Disable Syslog Service

Adversaries may try to turn off the syslog service to interrupt event logging and avoid detection by security controls.

• Category: Defense Evasion

• Technique: T1562.001 - Impair Defenses

• Impact: C:1 / I:2 / A:3

• Rule file: attempt_to_disable_syslog_service.yml

• Reference: https://attack.mitre.org/tactics/TA0005/

• Reference: https://attack.mitre.org/techniques/T1562/001/

System Linux: BPF filter applied using TC

Detects use of the tc (transmission control) binary to set a BPF (Berkeley Packet Filter) on a network interface. Tc configures Traffic Control in the Linux kernel and can shape, schedule, police, and drop traffic. A threat actor can use tc to set a BPF filter on an interface to manipulate incoming traffic. This technique is highly uncommon and should signal abnormal, suspicious, or malicious activity.

• Category: Execution

• Technique: T1059.004 - Command and Scripting Interpreter

• Impact: C:2 / I:3 / A:3

• Rule file: tc_bpf_filter.yml

• Reference: https://attack.mitre.org/tactics/TA0002/

• Reference: https://attack.mitre.org/techniques/T1059/004/

System Linux: File Deletion via Shred

Files that malware or an adversary drops or creates on a system can leave evidence about what was done in a network and how. Adversaries may delete these files during an intrusion to minimize their footprint, or remove them afterward as part of post-intrusion cleanup.

• Category: Defense Evasion

• Technique: T1070.004 - Indicator Removal

• Impact: C:1 / I:2 / A:3

• Rule file: file_deletion_via_shred.yml

• Reference: https://attack.mitre.org/tactics/TA0005/

• Reference: https://attack.mitre.org/techniques/T1070/004/

System Linux: File Transfer or Listener Established via Netcat

A netcat process is conducting network activity on a Linux host. Netcat is frequently used for persistence by exporting a reverse shell or by serving a shell on a listening port. Netcat is also occasionally used to exfiltrate data.

• Category: Execution

• Technique: T1059.004 - Command and Scripting Interpreter

• Impact: C:1 / I:2 / A:3

• Rule file: file_transfer_or_listener_established_via_netcat.yml

• Reference: https://attack.mitre.org/tactics/TA0002/

• Reference: https://attack.mitre.org/techniques/T1059/004/

System Linux: File made Immutable by Chattr

Detects when the chattr binary is used to make a file immutable. An immutable file cannot be deleted or renamed, no link can be created to it, most of its metadata cannot be changed, and it cannot be opened in write mode. Threat actors commonly do this to prevent tampering with or modification of their malicious files or system files they have altered for persistence.

• Category: Defense Evasion

• Technique: T1222 - File and Directory Permissions Modification

• Impact: C:1 / I:2 / A:3

• Rule file: chattr_immutable_file.yml

• Reference: https://attack.mitre.org/tactics/TA0005/

• Reference: https://attack.mitre.org/techniques/T1222/

System Linux: Hping Process Activity

Hping executed on a Linux host. Hping is a FOSS command-line packet analyzer that can craft network packets for many network security testing uses, such as scanning and firewall auditing.

• Category: Discovery

• Technique: T1082 - System Information Discovery

• Impact: C:1 / I:1 / A:2

• Rule file: linux_hping_activity.yml

• Reference: https://attack.mitre.org/tactics/TA0007/

• Reference: https://attack.mitre.org/techniques/T1082/

System Linux: Interactive Terminal Spawned via Perl

Detects a terminal (tty) being spawned through Perl. After gaining initial access to a host, attackers may upgrade a simple reverse shell into a fully interactive tty.

• Category: Execution

• Technique: T1059 - Command and Scripting Interpreter

• Impact: C:2 / I:3 / A:2

• Rule file: perl_tty_shell.yml

• Reference: https://attack.mitre.org/tactics/TA0002/

• Reference: https://attack.mitre.org/techniques/T1059/

System Linux: Interactive Terminal Spawned via Python

Detects a terminal (tty) being spawned through Python. After gaining initial access to a host, attackers may upgrade a simple reverse shell into a fully interactive tty.

• Category: Execution

• Technique: T1059 - Command and Scripting Interpreter

• Impact: C:3 / I:2 / A:3

• Rule file: python_tty_shell.yml

• Reference: https://attack.mitre.org/tactics/TA0002/

• Reference: https://attack.mitre.org/techniques/T1059/

System Linux: Kernel Module Removal

Kernel modules are code segments that can be loaded into and unloaded from the kernel as needed. They expand kernel functionality without requiring a system reboot. This rule detects attempts to remove a kernel module.

• Category: Defense Evasion

• Technique: T1562.001 - Impair Defenses

• Impact: C:1 / I:3 / A:3

• Rule file: kernel_module_removal.yml

• Reference: https://attack.mitre.org/tactics/TA0005/

• Reference: https://attack.mitre.org/techniques/T1562/001/

System Linux: Kernel module load via insmod

Detects use of the insmod binary to load a Linux kernel object file. If threat actors have root privileges, they can use this binary to load a rootkit on a system, giving them full control and the ability to hide from security products. Manually loading a kernel module this way is highly uncommon and can indicate suspicious or malicious behavior.

• Category: Persistence

• Technique: T1547.006 - Boot or Logon Autostart Execution

• Impact: C:3 / I:3 / A:3

• Rule file: insmod_kernel_module_load.yml

• Reference: https://attack.mitre.org/tactics/TA0003/

• Reference: https://attack.mitre.org/techniques/T1547/006/

System Linux: Modification of OpenSSH Binaries

Adversaries may alter SSH-related binaries for persistence or credential access by patching sensitive functions to permit unauthorized access or by logging SSH credentials for exfiltration.

• Category: Persistence

• Technique: T1543 - Create or Modify System Process

• Impact: C:3 / I:3 / A:2

• Rule file: modify_ssh_binaries.yml

• Reference: https://attack.mitre.org/tactics/TA0003/

• Reference: https://attack.mitre.org/techniques/T1543/

System Linux: Namespace Manipulation Using Unshare

Detects suspicious use of unshare to manipulate system namespaces. Unshare can be used to escalate privileges or break out of container security boundaries. Threat actors have used this binary to escape to the host and access other resources or elevate privileges.

• Category: Privilege Escalation

• Technique: T1543 - Create or Modify System Process

• Impact: C:3 / I:3 / A:2

• Rule file: unshare_namesapce_manipulation.yml

• Reference: https://attack.mitre.org/tactics/TA0004/

• Reference: https://attack.mitre.org/techniques/T1543/

System Linux: Nping Process Activity

This command may see some normal use from security engineers and network or server administrators, but such use is typically neither routine nor unannounced. Nping use by non-engineers or ordinary users is uncommon.

• Category: Discovery

• Technique: T1046 - Network Service Discovery

• Impact: C:1 / I:1 / A:2

• Rule file: linux_nping_activity.yml

• Reference: https://attack.mitre.org/tactics/TA0007/

• Reference: https://attack.mitre.org/techniques/T1046/

System Linux: Persistence via KDE AutoStart Script or Desktop File Modification

Identifies the creation or alteration of a K Desktop Environment (KDE) AutoStart script or desktop file that launches at every user logon. This mechanism can be abused by adversaries for persistence.

• Category: Persistence

• Technique: T1547 - Boot or Logon Autostart Execution

• Impact: C:2 / I:2 / A:3

• Rule file: kde_autostart_modification.yml

• Reference: https://attack.mitre.org/tactics/TA0003/

• Reference: https://attack.mitre.org/techniques/T1547/

System Linux: Possible Brute Force Attack

Detects several failed SSH logins followed by a successful login from the same source address. Adversaries may try to log in to multiple users with a common or known password to gain account access.

• Category: Credential Access

• Technique: T1110 - Brute Force

• Impact: C:2 / I:2 / A:3

• Rule file: bruteforce_attack.yml

• Reference: https://attack.mitre.org/tactics/TA0006/

• Reference: https://attack.mitre.org/techniques/T1110/

System Linux: Potential DNS Tunneling via Iodine

Iodine is a tool that tunnels Internet protocol version 4 (IPV4) traffic over the DNS protocol to bypass firewalls, network security groups, and network access lists while evading detection.

• Category: Command and Control

• Technique: T1572 - Protocol Tunneling

• Impact: C:3 / I:2 / A:2

• Rule file: linux_iodine_activity.yml

• Reference: https://attack.mitre.org/tactics/TA0011/

• Reference: https://attack.mitre.org/techniques/T1572/

System Linux: Potential Disabling of SELinux

Detects possible attempts to disable Security-Enhanced Linux (SELinux), a Linux kernel security feature that supports access control policies. Adversaries may disable security tools to avoid potential detection of their tools and activities.

• Category: Defense Evasion

• Technique: T1562.001 - Impair Defenses

• Impact: C:1 / I:2 / A:3

• Rule file: disable_selinux_attempt.yml

• Reference: https://attack.mitre.org/tactics/TA0005/

• Reference: https://attack.mitre.org/techniques/T1562/001/

System Linux: Potential Privilege Escalation via PKEXEC

Detects an attempt to exploit a local privilege escalation in polkit pkexec (CVE-2021-4034) through insecure environment variable injection. Successful exploitation lets an unprivileged user escalate to the root user.

• Category: Privilege Escalation

• Technique: T1068 - Exploitation for Privilege Escalation

• Impact: C:2 / I:3 / A:3

• Rule file: pkexec_envar_hijack.yml

• Reference: https://attack.mitre.org/tactics/TA0004/

• Reference: https://attack.mitre.org/techniques/T1068/

System Linux: Potential Protocol Tunneling via EarthWorm

Detects execution of the EarthWorm tunneler. Adversaries may tunnel network communications to and from a victim system within a separate protocol to evade detection and network filtering, or to gain access to otherwise unreachable systems.

• Category: Command and Control

• Technique: T1572 - Protocol Tunneling

• Impact: C:3 / I:3 / A:2

• Rule file: tunneling_via_earthworm.yml

• Reference: https://attack.mitre.org/tactics/TA0011/

• Reference: https://attack.mitre.org/techniques/T1572/

System Linux: Reverse Shell Created via Named Pipe

Identifies a reverse shell through named pipe abuse on Linux using OpenSSL or Netcat. First in, first out (FIFO) files are special files that Linux processes read from and write to. To make this work, a named pipe is created and supplied to a Linux shell in which a network connection tool such as Netcat or OpenSSL has been established. The network connection's stdout and stderr are captured by the named pipe and returned to the shell for execution.

• Category: Execution

• Technique: T1059.004 - Command and Scripting Interpreter

• Impact: C:3 / I:2 / A:3

• Rule file: reverse_shell_via_named_pipe.yml

• Reference: https://attack.mitre.org/tactics/TA0002/

• Reference: https://attack.mitre.org/techniques/T1059/004/

System Linux: System Log File Deletion

Identifies the removal of sensitive Linux system logs. This can signal an effort to evade detection or eliminate forensic evidence on a system.

• Category: Defense Evasion

• Technique: T1070.002 - Indicator Removal

• Impact: C:3 / I:3 / A:3

• Rule file: log_files_deleted.yml

• Reference: https://attack.mitre.org/tactics/TA0005/

• Reference: https://attack.mitre.org/techniques/T1070/002/