Milad Cheraghi 0f4572c9ac Merge PR #5459 from @CheraghiMilad - add execveat and match on euid instead of key ...

update: Webshell Remote Command Execution - add execveat and match on euid instead of key

---------

Co-authored-by: nasbench <nasbench@users.noreply.github.com>
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>

2025-06-05 13:22:24 +02:00

..

lnx_auditd_audio_capture.yml

Merge PR #5385 from @CheraghiMilad - Added new tool for recording audio - ecasound

2025-05-21 09:10:51 +02:00

lnx_auditd_auditing_config_change.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_binary_padding.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_bpfdoor_file_accessed.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_bpfdoor_port_redirect.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_capabilities_discovery.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_change_file_time_attr.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_chattr_immutable_removal.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_clean_disable_dmesg_logs_via_syslog.yml

Merge PR #5438 from @CheraghiMilad - new: clean dmesg logs

2025-05-31 14:24:43 +02:00

lnx_auditd_clipboard_collection.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_clipboard_image_collection.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_coinminer.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_create_account.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_data_compressed.yml

Merge PR #5388 from @david-syk - Update MITRE ATT&CK tags

2025-05-20 23:09:23 +02:00

lnx_auditd_data_exfil_wget.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_dd_delete_file.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_disable_aslr_protection.yml

Merge PR #5441 from @CheraghiMilad - chore: update reference

2025-05-31 14:08:26 +02:00

lnx_auditd_disable_system_firewall.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_file_or_folder_permissions.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_find_cred_in_files.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_hidden_binary_execution.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_hidden_files_directories.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_hidden_zip_files_steganography.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_keylogging_with_pam_d.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_ld_so_preload_mod.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_load_module_insmod.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_logging_config_change.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_magic_system_request_key.yml

Merge PR #5432 from @CheraghiMilad - Potential Abuse of Linux Magic System Request Key

2025-05-31 13:12:25 +02:00

lnx_auditd_masquerading_crond.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_modify_system_firewall.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_network_service_scanning.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_network_sniffing.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_password_policy_discovery.yml

Merge PR #5102 from @CheraghiMilad - Update Password Policy Discovery - Linux

2024-12-01 14:09:27 +01:00

lnx_auditd_screencapture_import.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_screencaputre_xwd.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_split_file_into_pieces.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_steghide_embed_steganography.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_steghide_extract_steganography.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_susp_c2_commands.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_susp_cmds.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_susp_exe_folders.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_susp_histfile_operations.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_susp_service_reload_or_restart.yml

Merge PR #5098 from @CheraghiMilad - Update Service Reload or Start - Linux

2025-03-05 00:50:23 +01:00

lnx_auditd_system_info_discovery2.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_system_info_discovery.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_system_shutdown_reboot.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_systemd_service_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_unix_shell_configuration_modification.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_unzip_hidden_zip_files_steganography.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

lnx_auditd_user_discovery.yml

Merge PR #5461 from @CheraghiMilad - add uname

2025-06-05 13:20:16 +02:00

lnx_auditd_web_rce.yml

Merge PR #5459 from @CheraghiMilad - add execveat and match on euid instead of key

2025-06-05 13:22:24 +02:00