linux:other
Other Linux sources (procfs, FIM, package logs, shell history)
- Host type
- Linux
- Techniques
- 19
- Rules listed
- 16
- Events
- 0
Techniques
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1036.001 Invalid Code Signature
- T1036.003 Rename Legitimate Utilities
- T1036.004 Masquerade Task or Service
- T1049 System Network Connections Discovery
- T1055 Process Injection
- T1056.002 GUI Input Capture
- T1070 Indicator Removal
- T1114.003 Email Forwarding Rule
- T1176 Software Extensions
- T1195.003 Compromise Hardware Supply Chain
- T1204 User Execution
- T1480 Execution Guardrails
- T1496 Resource Hijacking
- T1498.002 Reflection Amplification
- T1505.006 vSphere Installation Bundles
- T1518 Software Discovery
- T1547.007 Re-opened Applications
Rules
Sigma 16
- Buffer Overflow Attempts by Florian Roth (Nextron Systems)
- Code Injection by ld.so Preload by Christian Burkard (Nextron Systems)
- Commands to Clear or Remove the Syslog - Builtin by Max Altgelt (Nextron Systems)
- Equation Group Indicators by Florian Roth (Nextron Systems)
- JexBoss Command Sequence by Florian Roth (Nextron Systems)
- Linux Command History Tampering by Patrick Bareiss
- Potential Nimbuspwn Exploit CVE-2022-29799 and CVE-2022-27800 by Bhabesh Raj
- Potential Suspicious BPF Activity - Linux by Red Canary (idea), Nasreddine Bencherchali
- Privileged User Has Been Created by Pawel Mazur
- Remote File Copy by Ömer Günal
- Shellshock Expression by Florian Roth (Nextron Systems)
- Suspicious Activity in Shell Commands by Florian Roth (Nextron Systems)
- Suspicious Log Entries by Florian Roth (Nextron Systems)
- Suspicious Reverse Shell Command Line by Florian Roth (Nextron Systems)
- Suspicious Use of /dev/tcp by frack113
- Symlink Etc Passwd by Florian Roth (Nextron Systems)
Events
No event-level rows: this source is tiered as a whole.