Zirbo 8315489a07 Merge PR #5828 from @Zirbo - Update Shell Invocation via Env Command - Linux ...

update: Shell Invocation via Env Command - Linux - Switch modifier to use contains instead of endswith for better accuracy

---------

Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com>

2026-04-28 00:31:41 +02:00

..

proc_creation_lnx_apt_shell_execution.yml

Merge PR #4975 from @Murphy0801 - Add new rules related to GTFOBins

2024-09-02 13:19:31 +02:00

proc_creation_lnx_at_command.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

proc_creation_lnx_auditctl_clear_rules.yml

Merge PR #5079 from @mlakri - Add 2 new linux rules

2025-10-28 22:45:53 +01:00

proc_creation_lnx_av_kaspersky_av_disabled.yml

Merge PR #5634 from @CheraghiMilad - Add Kaspersky Endpoint Security Stopped Via CommandLine - Linux

2025-10-28 22:34:26 +01:00

proc_creation_lnx_awk_shell_spawn.yml

Merge PR #5506 from @nasbench -promote older rules status from experimental to test

2025-07-01 10:34:38 +02:00

proc_creation_lnx_base64_decode.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_base64_execution.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_base64_shebang_cli.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_bash_interactive_shell.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_bpf_kprob_tracing_enabled.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_bpftrace_unsafe_option_usage.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_cap_setgid.yml

Merge PR #5771 from @EzLucky - Add and Update Setcap Related Rules

2026-01-24 11:51:42 +01:00

proc_creation_lnx_cap_setuid.yml

Merge PR #5771 from @EzLucky - Add and Update Setcap Related Rules

2026-01-24 11:51:42 +01:00

proc_creation_lnx_capa_discovery.yml

Merge PR #5771 from @EzLucky - Add and Update Setcap Related Rules

2026-01-24 11:51:42 +01:00

proc_creation_lnx_capsh_shell_invocation.yml

Merge PR #5506 from @nasbench -promote older rules status from experimental to test

2025-07-01 10:34:38 +02:00

proc_creation_lnx_chattr_immutable_removal.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_chroot_execution.yml

Merge PR #5671 from @swachchhanda000 - feat: add detection rules for CVE-2025-32463 sudo chroot vulnerability

2025-10-19 07:21:26 +05:45

proc_creation_lnx_clear_logs.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_clear_syslog.yml

Merge PR #5600 from @vl43den - Add Syslog Clearing or Removal Via System Utilities

2025-10-28 22:49:32 +01:00

proc_creation_lnx_clipboard_collection.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_cp_passwd_or_shadow_tmp.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_crontab_enumeration.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_crontab_removal.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_crypto_mining.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_curl_usage.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_curl_wget_exec_tmp.yml

Merge PR #5489 from @hashdr1ft - Suspicious Download and Execute Pattern via Curl/Wget

2025-06-25 12:48:57 +02:00

proc_creation_lnx_dd_file_overwrite.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_dd_process_injection.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

proc_creation_lnx_disable_ufw.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_doas_execution.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

proc_creation_lnx_env_shell_invocation.yml

Merge PR #5828 from @Zirbo - Update Shell Invocation via Env Command - Linux

2026-04-28 00:31:41 +02:00

proc_creation_lnx_esxcli_network_discovery.yml

Merge PR #5393 from @Koifman - Update VMware rules for MITREv17

2025-05-21 08:39:49 +02:00

proc_creation_lnx_esxcli_permission_change_admin.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

proc_creation_lnx_esxcli_storage_discovery.yml

Merge PR #5393 from @Koifman - Update VMware rules for MITREv17

2025-05-21 08:39:49 +02:00

proc_creation_lnx_esxcli_syslog_config_change.yml

Merge PR #5393 from @Koifman - Update VMware rules for MITREv17

2025-05-21 08:39:49 +02:00

proc_creation_lnx_esxcli_system_discovery.yml

Merge PR #5393 from @Koifman - Update VMware rules for MITREv17

2025-05-21 08:39:49 +02:00

proc_creation_lnx_esxcli_user_account_creation.yml

Merge PR #5393 from @Koifman - Update VMware rules for MITREv17

2025-05-21 08:39:49 +02:00

proc_creation_lnx_esxcli_vm_discovery.yml

Merge PR #5393 from @Koifman - Update VMware rules for MITREv17

2025-05-21 08:39:49 +02:00

proc_creation_lnx_esxcli_vm_kill.yml

Merge PR #5393 from @Koifman - Update VMware rules for MITREv17

2025-05-21 08:39:49 +02:00

proc_creation_lnx_esxcli_vsan_discovery.yml

Merge PR #5393 from @Koifman - Update VMware rules for MITREv17

2025-05-21 08:39:49 +02:00

proc_creation_lnx_file_and_directory_discovery.yml

Merge PR #5091 from @CheraghiMilad - Update File and Directory Discovery - Linux

2024-12-01 14:07:54 +01:00

proc_creation_lnx_file_deletion.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_find_shell_execution.yml

Merge PR #5506 from @nasbench -promote older rules status from experimental to test

2025-07-01 10:34:38 +02:00

proc_creation_lnx_flock_shell_execution.yml

Merge PR #5506 from @nasbench -promote older rules status from experimental to test

2025-07-01 10:34:38 +02:00

proc_creation_lnx_gcc_shell_execution.yml

Merge PR #5506 from @nasbench -promote older rules status from experimental to test

2025-07-01 10:34:38 +02:00

proc_creation_lnx_git_shell_execution.yml

Merge PR #5506 from @nasbench -promote older rules status from experimental to test

2025-07-01 10:34:38 +02:00

proc_creation_lnx_grep_os_arch_discovery.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_groupdel.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_install_root_certificate.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_install_suspicious_packages.yml

Merge PR #5822 from @EzLucky - fix: spelling errors in description and filename

2026-01-05 13:01:17 +05:45

proc_creation_lnx_iptables_flush_ufw.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_local_account.yml

Merge PR #5822 from @EzLucky - fix: spelling errors in description and filename

2026-01-05 13:01:17 +05:45

proc_creation_lnx_local_groups.yml

Merge PR #5462 from @CheraghiMilad - add text output tools

2025-06-05 13:19:27 +02:00

proc_creation_lnx_malware_gobrat_grep_payload_discovery.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_mkfifo_named_pipe_creation_susp_location.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_mkfifo_named_pipe_creation.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_mount_hidepid.yml

Merge PR #5389 from @david-syk - Update MITRE ATT&CK tags

2025-05-20 23:09:50 +02:00

proc_creation_lnx_netcat_reverse_shell.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_nice_shell_execution.yml

Merge PR #5506 from @nasbench -promote older rules status from experimental to test

2025-07-01 10:34:38 +02:00

proc_creation_lnx_nohup_susp_execution.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_nohup.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_omigod_scx_runasprovider_executescript.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_perl_reverse_shell.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_php_reverse_shell.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_pnscan_binary_cli_pattern.yml

Merge PR #5216 from @nasbench - Promote older rules status from experimental to test

2025-03-05 00:23:27 +01:00

proc_creation_lnx_proxy_connection.yml

Merge PR #5451 from @frack113 - chore: cleanup metadata

2025-06-04 13:33:36 +02:00

proc_creation_lnx_pua_trufflehog.yml

Merge PR #5714 from @RobertN87 - Add missing MITRE tactics for 2 rules

2025-10-21 20:17:56 +02:00

proc_creation_lnx_python_base64_encoded_execution.yml

Merge PR #5899 from @HueCodes - new: Python Base64 Encoded Inline Command Execution

2026-04-23 14:37:28 +02:00

proc_creation_lnx_python_http_server_execution.yml

Merge PR #5079 from @mlakri - Add 2 new linux rules

2025-10-28 22:45:53 +01:00

proc_creation_lnx_python_pty_spawn.yml

Merge PR #5042 from @wieso-itzi - Update Python PTY rules

2024-11-04 12:15:00 +01:00

proc_creation_lnx_python_reverse_shell.yml

Merge PR #5042 from @wieso-itzi - Update Python PTY rules

2024-11-04 12:15:00 +01:00

proc_creation_lnx_python_shell_os_system.yml

Merge PR #5506 from @nasbench -promote older rules status from experimental to test

2025-07-01 10:34:38 +02:00

proc_creation_lnx_remote_access_tools_teamviewer_incoming_connection.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

proc_creation_lnx_remote_system_discovery.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_remove_package.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_rsync_shell_execution.yml

Merge PR #5163 from @Neo23x0 - Add/Update Rsync Linux Rules

2025-01-19 21:55:40 +01:00

proc_creation_lnx_rsync_shell_spawn.yml

Merge PR #5163 from @Neo23x0 - Add/Update Rsync Linux Rules

2025-01-19 21:55:40 +01:00

proc_creation_lnx_ruby_reverse_shell.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_schedule_task_job_cron.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_security_software_discovery.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_security_tools_disabling.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_services_stop_and_disable.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_setgid_setuid.yml

chore: ci: bump validator version (#5722)

2025-10-23 15:43:47 +02:00

proc_creation_lnx_ssh_shell_execution.yml

Merge PR #5506 from @nasbench -promote older rules status from experimental to test

2025-07-01 10:34:38 +02:00

proc_creation_lnx_ssm_agent_abuse.yml

Merge PR #5477 from @phantinuss - chore: update MITRE tag t1219 to t1219.002

2025-06-13 10:00:52 +02:00

proc_creation_lnx_susp_chmod_directories.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_susp_container_residence_discovery.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_susp_curl_fileupload.yml

Merge PR #5390 from @david-syk - Update MITRE ATT&CK tags

2025-05-20 23:08:57 +02:00

proc_creation_lnx_susp_curl_useragent.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_susp_dockerenv_recon.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_susp_execution_tmp_folder.yml

Change alert level from high to medium

2025-08-29 10:34:46 +02:00

proc_creation_lnx_susp_find_execution.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_susp_git_clone.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_susp_history_delete.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_susp_history_recon.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_susp_hktl_execution.yml

Merge PR #5013 from @ruppde - Update linux scanning rules

2024-09-22 19:29:20 +02:00

proc_creation_lnx_susp_inod_listing.yml

Merge PR #5766 from @SethHanford - Update Potential Container Discovery Via Inodes Listing

2025-11-25 16:29:32 +01:00

proc_creation_lnx_susp_interactive_bash.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_susp_java_children.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_susp_network_utilities_execution.yml

Merge PR #5013 from @ruppde - Update linux scanning rules

2024-09-22 19:29:20 +02:00

proc_creation_lnx_susp_pipe_shell.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_susp_process_reading_sudoers.yml

Merge PR #5463 from @CheraghiMilad - add more text output tools (#5463)

2025-06-05 13:19:04 +02:00

proc_creation_lnx_susp_recon_indicators.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_susp_script_interpretor_spawn_credential_scanner.yml

Merge PR #5772 from @swachchhanda000 - Add Shai-Hulud: The Second Coming Rules

2026-03-29 14:58:59 +02:00

proc_creation_lnx_susp_sensitive_file_access.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_susp_shell_child_process_from_parent_tmp_folder.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_susp_shell_script_exec_from_susp_location.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_system_info_discovery.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_system_network_connections_discovery.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_system_network_discovery.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_systemctl_mask_power_settings.yml

Merge PR #5090 from @CheraghiMilad - add rule for impair system power settings

2025-10-20 08:24:44 +05:45

proc_creation_lnx_touch_susp.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_triple_cross_rootkit_execve_hijack.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_triple_cross_rootkit_install.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_userdel.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_usermod_susp_group.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_vim_shell_execution.yml

Merge PR #4975 from @Murphy0801 - Add new rules related to GTFOBins

2024-09-02 13:19:31 +02:00

proc_creation_lnx_webshell_detection.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_wget_download_suspicious_directory.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_lnx_xterm_reverse_shell.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00