security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
1dfb05ec1cd5604db32e7ac602fd28435c19eb65
sigma-rules/hunting/linux/queries
T
History
Ruben Groenewoud b1a8341371 [Hunt Tuning] Logon Activity by Source IP (#4428)
2025-01-31 15:44:38 +01:00
..
command_and_control_via_network_connections_with_low_occurrence_frequency_for_unique_agents.toml
[New Hunt] Add Initial Linux Hunting Files (#3847)
2024-07-05 20:01:12 +02:00
command_and_control_via_unusual_file_downloads_from_source_addresses.toml
[New Hunt] Add Initial Linux Hunting Files (#3847)
2024-07-05 20:01:12 +02:00
defense_evasion_via_capitalized_process_execution.toml
[New Hunt] Add Initial Linux Hunting Files (#3847)
2024-07-05 20:01:12 +02:00
defense_evasion_via_hidden_process_execution.toml
[New Hunt] Add Initial Linux Hunting Files (#3847)
2024-07-05 20:01:12 +02:00
defense_evasion_via_multi_dot_process_execution.toml
[New Hunt] Add Initial Linux Hunting Files (#3847)
2024-07-05 20:01:12 +02:00
excessive_ssh_network_activity_unique_destinations.toml
[New Hunt] Add Initial Linux Hunting Files (#3847)
2024-07-05 20:01:12 +02:00
execution_uncommon_process_execution_from_suspicious_directory.toml
[New Hunt] Add Initial Linux Hunting Files (#3847)
2024-07-05 20:01:12 +02:00
login_activity_by_source_address.toml
[Hunt Tuning] Logon Activity by Source IP (#4428)
2025-01-31 15:44:38 +01:00
low_volume_external_network_connections_from_process.toml
[New Hunt] Add Initial Linux Hunting Files (#3847)
2024-07-05 20:01:12 +02:00
low_volume_gtfobins_external_network_connections.toml
[New Hunt] Add Initial Linux Hunting Files (#3847)
2024-07-05 20:01:12 +02:00
low_volume_modifications_to_critical_system_binaries.toml
[New Hunt] Add Initial Linux Hunting Files (#3847)
2024-07-05 20:01:12 +02:00
low_volume_process_injection_syscalls_by_executable.toml
[New Hunt] Add Initial Linux Hunting Files (#3847)
2024-07-05 20:01:12 +02:00
persistence_reverse_bind_shells.toml
[New Hunt] Add Initial Linux Hunting Files (#3847)
2024-07-05 20:01:12 +02:00
persistence_via_cron.toml
[New Hunt] Add Initial Linux Hunting Files (#3847)
2024-07-05 20:01:12 +02:00
persistence_via_driver_load_with_low_occurrence_frequency.toml
[New Hunts] Adding Several Hunting PRs into this Main PR (#4342)
2025-01-07 14:29:17 +01:00
persistence_via_dynamic_linker_hijacking.toml
[New Hunts] Adding Several Hunting PRs into this Main PR (#4342)
2025-01-07 14:29:17 +01:00
persistence_via_git_hook_pager.toml
[New & Tuning] Persistence via GRUB Bootloader (#4401)
2025-01-27 09:58:43 +01:00
persistence_via_grub_bootloader.toml
[New & Tuning] Persistence via GRUB Bootloader (#4401)
2025-01-27 09:58:43 +01:00
persistence_via_initramfs.toml
[New Hunt] Persistence via Initramfs (#4402)
2025-01-27 10:19:44 +01:00
persistence_via_loadable_kernel_modules.toml
[New Hunts] Adding Several Hunting PRs into this Main PR (#4342)
2025-01-07 14:29:17 +01:00
persistence_via_malicious_docker_container.toml
[New Hunts] Adding Several Hunting PRs into this Main PR (#4342)
2025-01-07 14:29:17 +01:00
persistence_via_message_of_the_day.toml
[New Hunt] Add Initial Linux Hunting Files (#3847)
2024-07-05 20:01:12 +02:00
persistence_via_package_manager.toml
[New & Tuning] Persistence via GRUB Bootloader (#4401)
2025-01-27 09:58:43 +01:00
persistence_via_pluggable_authentication_module.toml
[New & Tuning] Persistence via GRUB Bootloader (#4401)
2025-01-27 09:58:43 +01:00
persistence_via_rc_local.toml
[New Hunt] Add Initial Linux Hunting Files (#3847)
2024-07-05 20:01:12 +02:00
persistence_via_rpm_dpkg_installer_packages.toml
[New Hunts] Adding Several Hunting PRs into this Main PR (#4342)
2025-01-07 14:29:17 +01:00
persistence_via_shell_modification_persistence.toml
[Tuning & Changes] Misc rule/hunt tuning (#3875)
2024-07-11 14:55:33 +02:00
persistence_via_ssh_configurations_and_keys.toml
[Hunt Tuning] Persistence via SSH Configurations and/or Keys (#4351)
2025-01-13 16:53:09 +01:00
persistence_via_systemd_timers.toml
[New Hunt] Add Initial Linux Hunting Files (#3847)
2024-07-05 20:01:12 +02:00
persistence_via_sysv_init.toml
[New Hunt] Persistence through System V Init (#3871)
2024-07-08 16:35:54 +02:00
persistence_via_udev.toml
[New & Tuning] Persistence via GRUB Bootloader (#4401)
2025-01-27 09:58:43 +01:00
persistence_via_unusual_system_binary_parent.toml
[New Hunt] Add Initial Linux Hunting Files (#3847)
2024-07-05 20:01:12 +02:00
persistence_via_user_group_creation_modification.toml
[New Hunt] Add Initial Linux Hunting Files (#3847)
2024-07-05 20:01:12 +02:00
persistence_via_web_shell.toml
[New Hunts] Adding Several Hunting PRs into this Main PR (#4342)
2025-01-07 14:29:17 +01:00
persistence_via_xdg_autostart_modifications.toml
[New & Tuning] Persistence via GRUB Bootloader (#4401)
2025-01-27 09:58:43 +01:00
privilege_escalation_via_existing_sudoers.toml
[New Hunt] Add Initial Linux Hunting Files (#3847)
2024-07-05 20:01:12 +02:00
privilege_escalation_via_process_capabilities.toml
[New Hunt] Add Initial Linux Hunting Files (#3847)
2024-07-05 20:01:12 +02:00
privilege_escalation_via_segmentation_fault_and_buffer_overflow.toml
[New Hunt] Add Initial Linux Hunting Files (#3847)
2024-07-05 20:01:12 +02:00
privilege_escalation_via_suid_binaries.toml
[New Hunt] Add Initial Linux Hunting Files (#3847)
2024-07-05 20:01:12 +02:00