elastic-detection-rules

command_and_control_via_network_connections_with_low_occurrence_frequency_for_unique_agents.toml

[New Hunt] Add Initial Linux Hunting Files (#3847 )

2024-07-05 20:01:12 +02:00

command_and_control_via_unusual_file_downloads_from_source_addresses.toml

[New Hunt] Add Initial Linux Hunting Files (#3847 )

2024-07-05 20:01:12 +02:00

defense_evasion_via_capitalized_process_execution.toml

[New Hunt] Add Initial Linux Hunting Files (#3847 )

2024-07-05 20:01:12 +02:00

defense_evasion_via_hidden_process_execution.toml

[New Hunt] Add Initial Linux Hunting Files (#3847 )

2024-07-05 20:01:12 +02:00

defense_evasion_via_multi_dot_process_execution.toml

[New Hunt] Add Initial Linux Hunting Files (#3847 )

2024-07-05 20:01:12 +02:00

excessive_ssh_network_activity_unique_destinations.toml

[New Hunt] Add Initial Linux Hunting Files (#3847 )

2024-07-05 20:01:12 +02:00

execution_uncommon_process_execution_from_suspicious_directory.toml

[New Hunt] Add Initial Linux Hunting Files (#3847 )

2024-07-05 20:01:12 +02:00

login_activity_by_source_address.toml

[Hunt Tuning] Logon Activity by Source IP (#4428 )

2025-01-31 15:44:38 +01:00

low_volume_external_network_connections_from_process.toml

[New Hunt] Add Initial Linux Hunting Files (#3847 )

2024-07-05 20:01:12 +02:00

low_volume_gtfobins_external_network_connections.toml

[New Hunt] Add Initial Linux Hunting Files (#3847 )

2024-07-05 20:01:12 +02:00

low_volume_modifications_to_critical_system_binaries.toml

[New Hunt] Add Initial Linux Hunting Files (#3847 )

2024-07-05 20:01:12 +02:00

low_volume_process_injection_syscalls_by_executable.toml

[New Hunt] Add Initial Linux Hunting Files (#3847 )

2024-07-05 20:01:12 +02:00

persistence_general_kernel_manipulation.toml

[New Hunt] General Kernel Manipulation (#4403 )

2025-02-05 16:18:51 +01:00

persistence_reverse_bind_shells.toml

[New Hunt] Add Initial Linux Hunting Files (#3847 )

2024-07-05 20:01:12 +02:00

persistence_via_cron.toml

[New Hunt] Add Initial Linux Hunting Files (#3847 )

2024-07-05 20:01:12 +02:00

persistence_via_desktop_bus.toml

[New Hunt] Persistence via Desktop Bus (D-Bus) (#4407 )

2025-02-05 16:45:17 +01:00

persistence_via_driver_load_with_low_occurrence_frequency.toml

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342 )

2025-01-07 14:29:17 +01:00

persistence_via_dynamic_linker_hijacking.toml

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342 )

2025-01-07 14:29:17 +01:00

persistence_via_git_hook_pager.toml

[New & Tuning] Persistence via GRUB Bootloader (#4401 )

2025-01-27 09:58:43 +01:00

persistence_via_grub_bootloader.toml

[New & Tuning] Persistence via GRUB Bootloader (#4401 )

2025-01-27 09:58:43 +01:00

persistence_via_initramfs.toml

[New Hunt] Persistence via Initramfs (#4402 )

2025-01-27 10:19:44 +01:00

persistence_via_loadable_kernel_modules.toml

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342 )

2025-01-07 14:29:17 +01:00

persistence_via_malicious_docker_container.toml

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342 )

2025-01-07 14:29:17 +01:00

persistence_via_message_of_the_day.toml

[New Hunt] Add Initial Linux Hunting Files (#3847 )

2024-07-05 20:01:12 +02:00

persistence_via_network_manager_dispatcher_script.toml

[New Hunt] Persistence via NetworkManager Dispatcher Script (#4408 )

2025-02-06 09:33:42 +01:00

persistence_via_package_manager.toml

[New & Tuning] Persistence via GRUB Bootloader (#4401 )

2025-01-27 09:58:43 +01:00

persistence_via_pluggable_authentication_module.toml

[New & Tuning] Persistence via GRUB Bootloader (#4401 )

2025-01-27 09:58:43 +01:00

persistence_via_policykit.toml

[New Hunt] Persistence via PolicyKit (#4406 )

2025-02-05 16:29:47 +01:00

persistence_via_rc_local.toml

[New Hunt] Add Initial Linux Hunting Files (#3847 )

2024-07-05 20:01:12 +02:00

persistence_via_rpm_dpkg_installer_packages.toml

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342 )

2025-01-07 14:29:17 +01:00

persistence_via_shell_modification_persistence.toml

[Tuning & Changes] Misc rule/hunt tuning (#3875 )

2024-07-11 14:55:33 +02:00

persistence_via_ssh_configurations_and_keys.toml

[Hunt Tuning] Persistence via SSH Configurations and/or Keys (#4351 )

2025-01-13 16:53:09 +01:00

persistence_via_systemd_timers.toml

[New Hunt] Add Initial Linux Hunting Files (#3847 )

2024-07-05 20:01:12 +02:00

persistence_via_sysv_init.toml

[New Hunt] Persistence through System V Init (#3871 )

2024-07-08 16:35:54 +02:00

persistence_via_udev.toml

[New & Tuning] Persistence via GRUB Bootloader (#4401 )

2025-01-27 09:58:43 +01:00

persistence_via_unusual_system_binary_parent.toml

[New Hunt] Add Initial Linux Hunting Files (#3847 )

2024-07-05 20:01:12 +02:00

persistence_via_user_group_creation_modification.toml

[New Hunt] Add Initial Linux Hunting Files (#3847 )

2024-07-05 20:01:12 +02:00

persistence_via_web_shell.toml

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342 )

2025-01-07 14:29:17 +01:00

persistence_via_xdg_autostart_modifications.toml

[New & Tuning] Persistence via GRUB Bootloader (#4401 )

2025-01-27 09:58:43 +01:00

privilege_escalation_via_existing_sudoers.toml

[New Hunt] Add Initial Linux Hunting Files (#3847 )

2024-07-05 20:01:12 +02:00

privilege_escalation_via_process_capabilities.toml

[New Hunt] Add Initial Linux Hunting Files (#3847 )

2024-07-05 20:01:12 +02:00

privilege_escalation_via_segmentation_fault_and_buffer_overflow.toml

[New Hunt] Add Initial Linux Hunting Files (#3847 )

2024-07-05 20:01:12 +02:00

privilege_escalation_via_suid_binaries.toml

[New Hunt] Add Initial Linux Hunting Files (#3847 )

2024-07-05 20:01:12 +02:00