admin/elastic-protections-artifacts
1
0
Fork 0
mirror of https://github.com/elastic/protections-artifacts synced 2026-06-08 14:02:19 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
main
elastic-protections-artifacts/behavior/rules/linux
T
History
protectionsmachine 56b5284580 Updating artifacts
2026-06-04 03:15:49 +00:00
..
collection_multi_value_secret_searching_via_grep.toml
Updating artifacts
2026-05-08 03:16:12 +00:00
command_and_control_dns_request_by_recently_created_executable.toml
Updating artifacts
2026-05-08 03:16:12 +00:00
command_and_control_dns_request_by_suspicious_process_executable.toml
Updating artifacts
2026-06-04 03:15:49 +00:00
command_and_control_dns_request_to_crypto_miner_service.toml
Updating artifacts
2026-05-08 03:16:12 +00:00
command_and_control_dns_request_to_dynamic_dns_via_suspicious_executable.toml
Updating artifacts
2026-06-04 03:15:49 +00:00
command_and_control_dns_request_to_suspicious_file_upload_download_service.toml
Updating artifacts
2026-05-08 03:16:12 +00:00
command_and_control_egress_network_connection_followed_by_command_execution.toml
Updating artifacts
2026-03-13 03:16:47 +00:00
command_and_control_file_download_from_or_upload_to_hosting_service.toml
Updating artifacts
2026-03-26 03:16:15 +00:00
command_and_control_file_downloaded_via_curl_or_wget_to_hidden_directory.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
command_and_control_hidden_executable_initiated_egress_network_connection.toml
Updating artifacts
2026-06-04 03:15:49 +00:00
command_and_control_hidden_process_execution_followed_by_network_connection.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
command_and_control_network_activity_detected_via_cat.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
command_and_control_potential_linux_tunneling_and_or_port_forwarding.toml
Updating artifacts
2026-06-04 03:15:49 +00:00
command_and_control_potential_linux_tunneling_via_cloudflared.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
command_and_control_potential_multi_architecture_file_downloads.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
command_and_control_potential_network_traffic_tunneling_via_proxychains.toml
Updating artifacts
2026-05-08 03:16:12 +00:00
command_and_control_potential_vsingle_malware_infection.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
command_and_control_python_network_connection_followed_by_command_execution.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
command_and_control_torsocks_execution.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
credential_access_linux_init_(pid_1)_secret_dump_via_gdb.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
credential_access_manual_memory_password_searching_activity.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
credential_access_potential_linux_credential_dumping_via_mimipenguin.toml
Updating artifacts
2026-01-27 04:16:44 +00:00
credential_access_potential_linux_credential_dumping_via_proc_filesystem.toml
Updating artifacts
2026-01-27 04:16:44 +00:00
credential_access_potential_linux_credential_dumping_via_unshadow.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
credential_access_potential_memory_dumping_via_dd.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
defense_evasion_attempt_to_clear_kernel_ring_buffer_via_dmesg.toml
Updating artifacts
2026-05-08 03:16:12 +00:00
defense_evasion_attempt_to_clear_logs_via_journalctl.toml
Updating artifacts
2026-05-08 03:16:12 +00:00
defense_evasion_attempt_to_disable_auditd_service.toml
Updating artifacts
2026-05-08 03:16:12 +00:00
defense_evasion_attempt_to_disable_selinux.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
defense_evasion_auditctl_disabled_via_shell_process.toml
Updating artifacts
2026-01-27 04:16:44 +00:00
defense_evasion_base64_or_xxd_decode_argument_evasion.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
defense_evasion_base64_shebang_payload_decoded_via_built_in_utility.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
defense_evasion_binary_executed_from_shared_memory_directory.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
defense_evasion_chattr_execution_from_unusual_parent.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
defense_evasion_chattr_execution_with_unusual_target_file.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
defense_evasion_clearing_of_shell_history_via_environment_variables.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
defense_evasion_creation_of_hidden_shared_object_file.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
defense_evasion_decoded_payload_piped_to_interpreter.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
defense_evasion_defense_evasion_via_bind_mount.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
defense_evasion_defense_evasion_via_hidepid_mount.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
defense_evasion_deletion_of_shell_history_file.toml
Updating artifacts
2026-04-10 03:17:31 +00:00
defense_evasion_egress_network_connection_from_deleted_executable_by_root.toml
Updating artifacts
2026-06-04 03:15:49 +00:00
defense_evasion_execution_of_memory_file_descriptor_via_interactive_session.toml
Updating artifacts
2026-06-04 03:15:49 +00:00
defense_evasion_hexadecimal_ip_command_line_argument.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
defense_evasion_linux_compilation_in_suspicious_directory.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
defense_evasion_linux_hidden_file_mounted.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
defense_evasion_linux_payload_decoded_and_decrypted_via_built_in_utility.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
defense_evasion_linux_shared_object_load_via_ssh_keygen.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
defense_evasion_memory_file_descriptor_child_process_execution.toml
Updating artifacts
2026-06-04 03:15:49 +00:00
defense_evasion_memory_file_descriptor_process_execution.toml
Updating artifacts
2026-06-04 03:15:49 +00:00
defense_evasion_multiple_system_log_files_deletion.toml
Updating artifacts
2026-05-08 03:16:12 +00:00
defense_evasion_network_activity_from_memory_file_descriptor.toml
Updating artifacts
2026-06-04 03:15:49 +00:00
defense_evasion_potential_disabling_of_apparmor.toml
Updating artifacts
2026-05-08 03:16:12 +00:00
defense_evasion_potential_masquerading_via__proc_self_exe.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
defense_evasion_potential_nologin_ssh_backdoor.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
defense_evasion_potential_process_injection_via_dd.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
defense_evasion_potential_process_masquerading_via_exec.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
defense_evasion_potential_proxy_execution_via_crash.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
defense_evasion_potential_proxy_execution_via_php.toml
Updating artifacts
2026-02-06 04:16:30 +00:00
defense_evasion_potential_proxy_execution_via_pidstat.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
defense_evasion_potential_proxy_execution_via_run_parts.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
defense_evasion_potential_proxy_execution_via_sed.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
defense_evasion_potential_proxy_execution_via_split.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
defense_evasion_potential_proxy_execution_via_sysctl.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
defense_evasion_potential_proxy_execution_via_tcpdump.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
defense_evasion_process_execution_from_boot_directory.toml
Updating artifacts
2026-04-30 03:17:05 +00:00
defense_evasion_process_masquerading_as_kernel_process.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
defense_evasion_process_path_symbolic_link_manipulation.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
defense_evasion_shared_memory_file_turned_executable_by_suspicious_parent.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
defense_evasion_shared_object_file_creation_and_immediate_preload.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
defense_evasion_shared_object_injection_via_process_environment_variable.toml
Updating artifacts
2026-05-08 03:16:12 +00:00
defense_evasion_shell_command_execution_via_kworker.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
defense_evasion_shell_execution_of_non_executable_file.toml
Updating artifacts
2026-04-10 03:17:31 +00:00
defense_evasion_ssh_authorized_keys_file_deletion.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
defense_evasion_suspicious_access_to_apparmor_policy_management_files.toml
Updating artifacts
2026-04-10 03:17:31 +00:00
defense_evasion_suspicious_base64_string_command_line.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
defense_evasion_suspicious_binary_execution_via_path_alias.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
defense_evasion_suspicious_pseudo_terminal_proxy_execution_via_su.toml
Updating artifacts
2026-04-10 03:17:31 +00:00
defense_evasion_system_binary_copied_or_moved.toml
Updating artifacts
2026-06-04 03:15:49 +00:00
defense_evasion_system_binary_proxy_execution_via_ld.so.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
defense_evasion_timestomping_detected_via_touch.toml
Updating artifacts
2026-04-30 03:17:05 +00:00
defense_evasion_world_writeable_directory_exec_remount.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
discovery_potential_suid_sgid_files_enumeration.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
discovery_suspicious_reading_of__proc_[pid]_maps.toml
Updating artifacts
2026-04-30 03:17:05 +00:00
execution_background_task_execution_via_a_hidden_process.toml
Updating artifacts
2026-04-30 03:17:05 +00:00
execution_bind_shell_via_netcat_traditional.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
execution_bind_shell_via_node.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
execution_bind_shell_via_socket.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
execution_bpf_filter_applied_using_traffic_control.toml
Updating artifacts
2026-05-08 03:16:12 +00:00
execution_command_interpreter_with_ip_address_argument.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
execution_interactive_shell_spawned_via_hidden_process.toml
Updating artifacts
2026-03-13 03:16:47 +00:00
execution_javascript_execution_via_deno_on_linux.toml
Updating artifacts
2026-03-26 03:16:15 +00:00
execution_javascript_reverse_shell_via_node.js.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
execution_linux_background_process_execution_via_shell.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
execution_linux_hidden_folder_or_file_execution_via_python.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
execution_linux_powershell_egress_network_connection.toml
Updating artifacts
2026-04-10 03:17:31 +00:00
execution_linux_powershell_encoded_command.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
execution_linux_powershell_suspicious_child_process.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
execution_linux_reverse_shell_via_child.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
execution_linux_reverse_shell_via_netcat.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
execution_linux_reverse_shell_via_setsid_and_nohup.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
execution_linux_reverse_shell_via_suspicious_utility.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
execution_linux_reverse_shell_via_xterm.toml
Updating artifacts
2026-01-27 04:16:44 +00:00
execution_linux_reverse_shell.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
execution_linux_suspicious_child_process_execution_via_interactive_shell.toml
Updating artifacts
2026-06-04 03:15:49 +00:00
execution_netcat_reverse_shell_via_busybox.toml
Updating artifacts
2026-03-13 03:16:47 +00:00
execution_non_interactive_shell_upgrade.toml
Updating artifacts
2026-05-08 03:16:12 +00:00
execution_openssl_reverse_shell_activity_via_named_pipe.toml
Updating artifacts
2025-11-18 04:15:57 +00:00
execution_outbound_network_connection_followed_by_process_file_deletion.toml
Updating artifacts
2026-04-30 03:17:05 +00:00
execution_potential_gsocket_activity.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
execution_potential_linux_hack_tool_launched.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
execution_potential_linux_reverse_shell_via_java_jar_execution.toml
Updating artifacts
2025-12-11 04:14:24 +00:00
execution_potential_linux_reverse_shell_via_java_shell_execution.toml
Updating artifacts
2026-01-27 04:16:44 +00:00
execution_potential_remote_code_execution_via_langflow.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
execution_potential_reverse_shell_activity_via_tcp_udp_socket.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
execution_potential_reverse_shell_via_named_pipe.toml
Updating artifacts
2026-03-26 03:16:15 +00:00
execution_pseudoterminal_(pty)_creation_from_suspicious_executable.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
execution_recently_downloaded_file_made_executable_and_run.toml
Updating artifacts
2026-03-13 03:16:47 +00:00
execution_renice_or_ulimit_execution_from_unusual_parent.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
execution_reverse_or_bind_shell_via_suspicious_utility.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
execution_reverse_shell_via_networkmanager_dispatcher_script.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
execution_script_executed_through_unusual_parent_process.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
execution_shell_execution_via_java_parent_process.toml
Updating artifacts
2026-01-27 04:16:44 +00:00
execution_shell_via_networkmanager_dispatcher_script.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
execution_sleep_execution_from_suspicious_process_path.toml
Updating artifacts
2026-04-30 03:17:05 +00:00
execution_socat_reverse_shell_or_listener_activity.toml
Updating artifacts
2026-04-30 03:17:05 +00:00
execution_suspicious_execution_via_a_hidden_process.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
execution_suspicious_execution_via_setsid_and_nohup.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
execution_suspicious_interactive_terminal_spawn.toml
Updating artifacts
2026-05-08 03:16:12 +00:00
execution_suspicious_lua_command_execution.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
execution_suspicious_mining_process_events.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
execution_suspicious_perl_command_execution.toml
Updating artifacts
2026-03-26 03:16:15 +00:00
execution_suspicious_php_command_execution.toml
Updating artifacts
2026-04-10 03:17:31 +00:00
execution_suspicious_python_command_execution.toml
Updating artifacts
2026-04-03 03:15:55 +00:00
execution_suspicious_python_encoded_payload_execution.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
execution_suspicious_ruby_command_execution.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
execution_suspicious_shell_command_execution_via_node.js_parent.toml
Updating artifacts
2026-04-30 03:17:05 +00:00
execution_suspicious_shell_execution_via_java_application.toml
Updating artifacts
2026-03-13 03:16:47 +00:00
execution_unusual_execution_from__dev_parent.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
execution_world_writeable_directory_file_creation_and_outbound_connection.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
exfiltration_potential_data_exfiltration_through_wget.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
impact_msr_write_access_enabled.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
impact_potential_coin_miner_execution_via_shell.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
impact_potential_coin_miner_execution.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
impact_potential_mining_pool_command_detection.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
initial_access_potential_remote_code_execution_via_database_server.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
initial_access_potential_remote_code_execution_via_mail_server.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
initial_access_potential_telnet_authentication_bypass_(cve_2026_24061).toml
Updating artifacts
2026-03-13 03:16:47 +00:00
lateral_movement_potential_hackerschoice_tool_downloaded.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
lateral_movement_potential_netcat_file_listener_established.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
persistence_at_utility_launched_through_udevadm.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
persistence_binary_execution_from_unusual_location_through_shell_profile.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
persistence_decode_activity_via_web_server.toml
Updating artifacts
2026-01-27 04:16:44 +00:00
persistence_egress_connection_by_a_dnf_package_manager_descendant.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
persistence_egress_connection_by_a_yum_package_manager_descendant.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
persistence_egress_network_connection_by_motd_child.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
persistence_egress_network_connection_from_default_dpkg_directory.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
persistence_egress_network_connection_from_rpm_package.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
persistence_file_downloaded_and_piped_to_interpreter_by_web_server.toml
Updating artifacts
2026-01-27 04:16:44 +00:00
persistence_file_downloaded_from_suspicious_source_by_web_server.toml
Updating artifacts
2026-01-27 04:16:44 +00:00
persistence_file_downloaded_to_suspicious_location_by_web_server.toml
Updating artifacts
2026-01-27 04:16:44 +00:00
persistence_hidden_payload_executed_via_scheduled_job.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
persistence_payload_downloaded_via_curl_or_wget_by_web_server.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
persistence_payload_execution_by_node.js_web_server.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
persistence_potential_remote_code_execution_via_url_encoded_payload.toml
Updating artifacts
2026-04-10 03:17:31 +00:00
persistence_potential_web_server_directory_traversal.toml
Updating artifacts
2026-01-27 04:16:44 +00:00
persistence_reverse_shell_executed_via_web_server.toml
Updating artifacts
2026-02-06 04:16:30 +00:00
persistence_scheduled_job_executing_binary_in_unusual_location.toml
Updating artifacts
2026-03-13 03:16:47 +00:00
persistence_scheduled_task_unusual_command_execution.toml
Updating artifacts
2026-06-04 03:15:49 +00:00
persistence_setcap_setuid_setgid_capability_set.toml
Updating artifacts
2026-06-04 03:15:49 +00:00
persistence_suspicious_download_and_redirect_by_web_server.toml
Updating artifacts
2026-02-06 04:16:30 +00:00
persistence_suspicious_echo_execution.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
persistence_suspicious_file_creation_via_web_server.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
persistence_suspicious_process_spawned_from_motd_detected.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
persistence_suspicious_python_path_configuration_file_(.pth)_creation.toml
Updating artifacts
2026-05-08 03:16:12 +00:00
persistence_system_v_init_(init.d)_executed_binary_from_unusual_location.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
persistence_udev_execution_followed_by_egress_network_connection.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
persistence_unusual_command_executed_by_web_server.toml
Updating artifacts
2026-01-27 04:16:44 +00:00
persistence_unusual_command_execution_via_systemd_scheduled_task.toml
Updating artifacts
2026-06-04 03:15:49 +00:00
persistence_unusual_ssh_parent_child_execution.toml
Updating artifacts
2026-03-13 03:16:47 +00:00
privilege_escalation_cve_2023_0386_exploitation_attempt.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
privilege_escalation_general_privilege_escalation_sequence_detected.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
privilege_escalation_potential_cgroup_privilege_escalation_container_escape_via_mount.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
privilege_escalation_potential_cve_2025_32463_nsswitch_file_creation.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
privilege_escalation_potential_cve_2025_32463_sudo_chroot_execution_attempt.toml
Updating artifacts
2025-11-18 04:15:57 +00:00
privilege_escalation_potential_local_privilege_escalation_via_unshare.toml
Updating artifacts
2026-06-04 03:15:49 +00:00
privilege_escalation_potential_packagekit_toctou_privilege_escalation_via_cve_2026_41651.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
privilege_escalation_potential_privilege_escalation_via_fuse_binary.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
privilege_escalation_potential_privilege_escalation_via_overlayfs.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
privilege_escalation_potential_privilege_escalation_via_suid_binary.toml
Updating artifacts
2026-03-13 03:16:47 +00:00
privilege_escalation_potential_privilege_escalation_via_suid_sgid_proxy_execution.toml
Updating artifacts
2026-05-08 03:16:12 +00:00
privilege_escalation_potential_sudo_privilege_escalation_via_cve_2019_14287.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
privilege_escalation_privilege_escalation_via_pkexec_exploitation.toml
Updating artifacts
2026-02-26 04:15:39 +00:00
privilege_escalation_privilege_escalation_via_polkit_system_service.toml
Updating artifacts
2025-10-31 03:13:42 +00:00
privilege_escalation_shell_privileged_mode_from_non_standard_path_with_root_effective_user.toml
Updating artifacts
2026-06-04 03:15:49 +00:00
privilege_escalation_suspicious_suid_sgid_utility_execution.toml
Updating artifacts
2026-05-20 03:15:56 +00:00
privilege_escalation_uid_change_to_0_from_unusual_process_executable.toml
Updating artifacts
2026-02-26 04:15:39 +00:00