Ruben Groenewoud 21485b16fa [Tuning & Changes] Misc rule/hunt tuning (#3875) ...

* [Tuning & Changes] Misc rule/hunt tuning

* Bump update_date

* ++

* Updated docs

2024-07-11 14:55:33 +02:00

..

command_and_control_via_network_connections_with_low_occurrence_frequency_for_unique_agents.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

command_and_control_via_unusual_file_downloads_from_source_addresses.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

defense_evasion_via_capitalized_process_execution.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

defense_evasion_via_hidden_process_execution.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

defense_evasion_via_multi_dot_process_execution.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

excessive_ssh_network_activity_unique_destinations.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

execution_uncommon_process_execution_from_suspicious_directory.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

login_activity_by_source_address.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

low_volume_external_network_connections_from_process.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

low_volume_gtfobins_external_network_connections.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

low_volume_modifications_to_critical_system_binaries.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

low_volume_process_injection_syscalls_by_executable.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

persistence_reverse_bind_shells.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

persistence_via_cron.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

persistence_via_driver_load_with_low_occurrence_frequency.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

persistence_via_git_hook_pager.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

persistence_via_message_of_the_day.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

persistence_via_package_manager.toml

[Tuning & Changes] Misc rule/hunt tuning (#3875)

2024-07-11 14:55:33 +02:00

persistence_via_rc_local.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

persistence_via_shell_modification_persistence.toml

[Tuning & Changes] Misc rule/hunt tuning (#3875)

2024-07-11 14:55:33 +02:00

persistence_via_ssh_configurations_and_keys.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

persistence_via_systemd_timers.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

persistence_via_sysv_init.toml

[New Hunt] Persistence through System V Init (#3871)

2024-07-08 16:35:54 +02:00

persistence_via_udev.toml

[Tuning & Changes] Misc rule/hunt tuning (#3875)

2024-07-11 14:55:33 +02:00

persistence_via_unusual_system_binary_parent.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

persistence_via_user_group_creation_modification.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

persistence_via_xdg_autostart_modifications.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

privilege_escalation_via_existing_sudoers.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

privilege_escalation_via_process_capabilities.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

privilege_escalation_via_segmentation_fault_and_buffer_overflow.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

privilege_escalation_via_suid_binaries.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00