shashank-elastic 44046642e7 [Rule tuning] Linux binary(s) shell evasion threat (#1957) ...

* Linux binary(s) shell evasion threat

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

(cherry picked from commit 51b2d9da4b)

2022-05-25 03:04:53 +00:00

..

command_and_control_ftp_file_transfer_protocol_activity_to_the_internet.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

command_and_control_irc_internet_relay_chat_protocol_activity_to_the_internet.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

command_and_control_port_8000_activity_to_the_internet.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

command_and_control_pptp_point_to_point_tunneling_protocol_activity.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

command_and_control_proxy_port_activity_to_the_internet.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

command_and_control_smtp_to_the_internet.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

command_and_control_sql_server_port_activity_to_the_internet.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

command_and_control_ssh_secure_shell_from_the_internet.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

command_and_control_ssh_secure_shell_to_the_internet.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

command_and_control_tor_activity_to_the_internet.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

credential_access_tcpdump_activity.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

defense_evasion_base64_encoding_or_decoding_activity.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

defense_evasion_execution_via_trusted_developer_utilities.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

defense_evasion_hex_encoding_or_decoding_activity.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

defense_evasion_mshta_making_network_connections.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

discovery_process_discovery_via_tasklist_command.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

discovery_query_registry_via_reg.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

discovery_whoami_commmand.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

execution_apt_binary.toml

[Rule tuning] Linux binary(s) shell evasion threat (#1957)

2022-05-25 03:04:53 +00:00

execution_awk_binary_shell.toml

[Rule tuning] Linux binary(s) shell evasion threat (#1957)

2022-05-25 03:04:53 +00:00

execution_busybox_binary.toml

[Rule tuning] Linux binary(s) shell evasion threat (#1957)

2022-05-25 03:04:53 +00:00

execution_c89_c99_binary.toml

[Rule tuning] Linux binary(s) shell evasion threat (#1957)

2022-05-25 03:04:53 +00:00

execution_command_shell_started_by_powershell.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

execution_cpulimit_binary.toml

[Rule tuning] Linux binary(s) shell evasion threat (#1957)

2022-05-25 03:04:53 +00:00

execution_crash_binary.toml

[Rule tuning] Linux binary(s) shell evasion threat (#1957)

2022-05-25 03:04:53 +00:00

execution_env_binary.toml

[Rule tuning] Linux binary(s) shell evasion threat (#1957)

2022-05-25 03:04:53 +00:00

execution_expect_binary.toml

[Rule tuning] Linux binary(s) shell evasion threat (#1957)

2022-05-25 03:04:53 +00:00

execution_find_binary.toml

[Rule tuning] Linux binary(s) shell evasion threat (#1957)

2022-05-25 03:04:53 +00:00

execution_flock_binary.toml

[Rule tuning] Linux binary(s) shell evasion threat (#1957)

2022-05-25 03:04:53 +00:00

execution_gcc_binary.toml

[Rule tuning] Linux binary(s) shell evasion threat (#1957)

2022-05-25 03:04:53 +00:00

execution_mysql_binary.toml

[Rule tuning] Linux binary(s) shell evasion threat (#1957)

2022-05-25 03:04:53 +00:00

execution_ssh_binary.toml

[Rule tuning] Linux binary(s) shell evasion threat (#1957)

2022-05-25 03:04:53 +00:00

execution_vi_binary.toml

[Rule tuning] Linux binary(s) shell evasion threat (#1957)

2022-05-25 03:04:53 +00:00

execution_via_net_com_assemblies.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

exfiltration_rds_snapshot_export.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

initial_access_rdp_remote_desktop_protocol_to_the_internet.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

linux_mknod_activity.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

linux_nmap_activity.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

linux_socat_activity.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

persistence_cron_jobs_creation_and_runtime.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

persistence_kernel_module_activity.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

privilege_escalation_printspooler_malicious_driver_file_changes.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

privilege_escalation_printspooler_malicious_registry_modification.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00

privilege_escalation_setgid_bit_set_via_chmod.toml

Linux Shell Evasion Rule Tuning (#1878)

2022-03-29 21:03:35 -04:00