admin/elastic-protections-artifacts
1
0
Fork 0
mirror of https://github.com/elastic/protections-artifacts synced 2026-06-08 14:02:19 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
80d6ccc4b083186d00a4b104bee0d9c3c98ec0bf
elastic-protections-artifacts/behavior/rules/linux
T
History
protectionsmachine 80d6ccc4b0 Updating artifacts
2024-10-29 15:09:06 +00:00
..
command_and_control_egress_network_connection_followed_by_command_execution.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
command_and_control_file_downloaded_via_curl_or_wget_to_hidden_directory.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
command_and_control_hidden_executable_initiated_egress_network_connection.toml
Updating artifacts
2024-09-18 12:23:23 +00:00
command_and_control_hidden_process_execution_followed_by_network_connection.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
command_and_control_linux_telegram_api_request.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
command_and_control_network_connection_by_foomatic_rip_child.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
command_and_control_network_connection_followed_by_file_creation.toml
Updating artifacts
2024-09-18 12:23:23 +00:00
command_and_control_potential_multi_architecture_file_downloads.toml
Updating artifacts
2024-07-10 10:18:40 +00:00
command_and_control_potential_vsingle_malware_infection.toml
Updating artifacts
2024-07-10 10:18:40 +00:00
command_and_control_python_network_connection_followed_by_command_execution.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
command_and_control_python_network_connection_followed_by_file_creation.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
credential_access_linux_init_(pid_1)_secret_dump_via_gdb.toml
Updating artifacts
2024-07-29 15:28:45 +00:00
credential_access_manual_memory_password_searching_activity.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
credential_access_potential_linux_credential_dumping_via_proc_filesystem.toml
Updating artifacts
2024-07-10 10:18:40 +00:00
credential_access_potential_linux_credential_dumping_via_unshadow.toml
Updating artifacts
2024-07-10 10:18:40 +00:00
defense_evasion_base64_or_xxd_decode_argument_evasion.toml
Updating artifacts
2024-10-03 11:02:18 +00:00
defense_evasion_base64_shebang_payload_decoded_via_built_in_utility.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
defense_evasion_binary_executed_from_shared_memory_directory.toml
Updating artifacts
2024-07-10 13:53:33 +00:00
defense_evasion_chattr_execution_from_unusual_parent.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
defense_evasion_chattr_execution_with_unusual_target_file.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
defense_evasion_cron(d)_service_started_by_unusual_parent.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
defense_evasion_curl_or_wget_egress_network_connection_via_lolbin.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
defense_evasion_defense_evasion_via_bind_mount.toml
Updating artifacts
2024-07-29 15:28:45 +00:00
defense_evasion_defense_evasion_via_hidepid_mount.toml
Updating artifacts
2024-10-03 11:02:18 +00:00
defense_evasion_execution_of_in_memory_file_via_interactive_session.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
defense_evasion_global_dynamic_linker_file_copied.toml
Updating artifacts
2024-07-10 10:18:40 +00:00
defense_evasion_hexadecimal_payload_execution.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
defense_evasion_linux_base64_descendant_egress_network_connection.toml
Updating artifacts
2024-10-03 11:02:18 +00:00
defense_evasion_linux_compilation_in_suspicious_directory.toml
Updating artifacts
2024-09-18 12:23:23 +00:00
defense_evasion_linux_decoded_or_decrypted_payload_written_to_suspicious_directory.toml
Updating artifacts
2024-07-29 15:28:45 +00:00
defense_evasion_linux_execution_of_a_file_dropped_by_openssl.toml
Updating artifacts
2024-07-29 15:28:45 +00:00
defense_evasion_linux_file_made_executable_by_suspicious_parent.toml
Updating artifacts
2024-10-03 11:02:18 +00:00
defense_evasion_linux_hidden_file_mounted.toml
Updating artifacts
2024-07-29 15:28:45 +00:00
defense_evasion_linux_payload_decoded_and_decrypted_from_mount.toml
Updating artifacts
2024-07-29 15:28:45 +00:00
defense_evasion_linux_shared_object_load_via_ssh_keygen.toml
Updating artifacts
2024-07-29 15:28:45 +00:00
defense_evasion_network_activity_from_in_memory_file.toml
Updating artifacts
2024-07-10 13:53:33 +00:00
defense_evasion_potential_process_injection_via_dd.toml
Updating artifacts
2024-10-03 11:02:18 +00:00
defense_evasion_potential_process_masquerading_via_exec.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
defense_evasion_potential_proxy_execution_via_crash.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
defense_evasion_potential_proxy_execution_via_php.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
defense_evasion_potential_proxy_execution_via_pidstat.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
defense_evasion_potential_proxy_execution_via_run_parts.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
defense_evasion_potential_proxy_execution_via_sed.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
defense_evasion_potential_proxy_execution_via_split.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
defense_evasion_potential_proxy_execution_via_sysctl.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
defense_evasion_potential_proxy_execution_via_systemd_run.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
defense_evasion_potential_proxy_execution_via_tcpdump.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
defense_evasion_process_masquerading_as_kernel_process.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
defense_evasion_proxy_shell_execution_via_busybox.toml
Updating artifacts
2024-09-18 12:23:23 +00:00
defense_evasion_shared_object_injection_via_process_environment_variable.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
defense_evasion_shared_object_load_via_lolbin.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
defense_evasion_shell_command_execution_via_kworker.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
defense_evasion_shell_execution_of_non_executable_file.toml
Updating artifacts
2024-09-18 12:23:23 +00:00
defense_evasion_suspicious_kernel_feature_activity.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
defense_evasion_system_binary_proxy_execution_via_ld.so.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
discovery_linux_external_ip_address_discovery_via_curl.toml
Updating artifacts
2024-09-18 12:23:23 +00:00
execution_bind_shell_via_netcat_traditional.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
execution_bind_shell_via_node.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
execution_bind_shell_via_socket.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
execution_file_creation_by_foomatic_rip_child.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
execution_foomatic_rip_shell_execution.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
execution_linux_background_process_execution_via_shell.toml
Updating artifacts
2024-07-29 15:28:45 +00:00
execution_linux_hidden_folder_or_file_execution_via_python.toml
Updating artifacts
2024-07-29 15:28:45 +00:00
execution_linux_powershell_egress_network_connection.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
execution_linux_powershell_encoded_command.toml
Updating artifacts
2024-08-28 15:11:29 +00:00
execution_linux_powershell_suspicious_child_process.toml
Updating artifacts
2024-08-22 13:49:05 +00:00
execution_linux_reverse_shell_via_child.toml
Updating artifacts
2024-10-03 11:02:18 +00:00
execution_linux_reverse_shell_via_netcat.toml
Updating artifacts
2024-10-03 11:02:18 +00:00
execution_linux_reverse_shell_via_setsid_and_nohup.toml
Updating artifacts
2024-10-03 11:02:18 +00:00
execution_linux_reverse_shell_via_suspicious_utility.toml
Updating artifacts
2024-10-03 11:02:18 +00:00
execution_linux_reverse_shell.toml
Updating artifacts
2024-10-03 11:02:18 +00:00
execution_linux_suspicious_child_process_execution_via_interactive_shell.toml
Updating artifacts
2024-08-28 15:11:29 +00:00
execution_netcat_reverse_shell_via_busybox.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
execution_potential_gsocket_activity.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
execution_potential_linux_hack_tool_launched.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
execution_printer_user_(lp)_shell_execution.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
execution_renice_or_ulimit_execution_from_unusual_parent.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
execution_reverse_or_bind_shell_via_suspicious_utility.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
execution_socat_reverse_shell_or_listener_activity.toml
Updating artifacts
2024-09-18 12:23:23 +00:00
execution_suspicious_execution_from_foomatic_rip_or_cupsd_parent.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
execution_suspicious_execution_via_a_hidden_process.toml
Updating artifacts
2024-10-03 11:02:18 +00:00
execution_suspicious_execution_via_setsid_and_nohup.toml
Updating artifacts
2024-10-03 11:02:18 +00:00
execution_suspicious_mining_process_events.toml
Updating artifacts
2024-07-10 10:18:40 +00:00
execution_suspicious_named_pipe_creation.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
execution_user_discovery_command_execution_from_shared_memory.toml
Updating artifacts
2024-07-29 15:28:45 +00:00
impact_msr_write_access_enabled.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
impact_potential_mining_pool_command_detection.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
initial_access_remote_code_execution_via_confluence_ognl_injection.toml
Updating artifacts
2024-07-10 10:18:40 +00:00
initial_access_suspicious_kibana_child_process.toml
Updating artifacts
2024-07-10 13:53:33 +00:00
lateral_movement_potential_ssh_it_ssh_worm_downloaded.toml
Updating artifacts
2024-07-10 10:18:40 +00:00
persistence_apt_package_manager_command_execution.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
persistence_apt_package_manager_egress_network_connection.toml
Updating artifacts
2024-10-03 11:02:18 +00:00
persistence_at_utility_launched_through_udevadm.toml
Updating artifacts
2024-10-03 11:02:18 +00:00
persistence_binary_execution_from_unusual_location_through_shell_profile.toml
Updating artifacts
2024-10-03 11:02:18 +00:00
persistence_egress_connection_by_a_dnf_package_manager_descendant.toml
Updating artifacts
2024-10-03 11:02:18 +00:00
persistence_egress_connection_by_a_yum_package_manager_descendant.toml
Updating artifacts
2024-10-03 11:02:18 +00:00
persistence_egress_network_connection_by_motd_child.toml
Updating artifacts
2024-10-03 11:02:18 +00:00
persistence_egress_network_connection_from_default_dpkg_directory.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
persistence_egress_network_connection_from_rpm_package.toml
Updating artifacts
2024-08-28 15:11:29 +00:00
persistence_file_downloaded_and_piped_to_interpreter_by_web_server.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
persistence_file_downloaded_from_suspicious_source_by_web_server.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
persistence_hidden_payload_executed_via_scheduled_job.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
persistence_linux_backdoor_network_access_via_unusual_process.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
persistence_motd_execution_followed_by_egress_network_connection.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
persistence_network_connection_through_shell_profile.toml
Updating artifacts
2024-10-17 16:35:42 +00:00
persistence_reverse_shell_executed_via_web_server.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
persistence_scheduled_job_executing_binary_in_unusual_location.toml
Updating artifacts
2024-10-03 11:02:18 +00:00
persistence_scheduled_task_unusual_command_execution.toml
Updating artifacts
2024-10-03 11:02:18 +00:00
persistence_suspicious_download_and_redirect_by_web_server.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
persistence_suspicious_echo_execution.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
persistence_suspicious_message_of_the_day_execution.toml
Updating artifacts
2024-10-03 11:02:18 +00:00
persistence_suspicious_process_spawned_from_motd_detected.toml
Updating artifacts
2024-10-03 11:02:18 +00:00
persistence_system_v_init_(init.d)_egress_network_connection.toml
Updating artifacts
2024-10-03 11:02:18 +00:00
persistence_system_v_init_(init.d)_executed_binary_from_unusual_location.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
persistence_systemd_execution_followed_by_network_connection.toml
Updating artifacts
2024-10-17 16:35:42 +00:00
persistence_udev_execution_followed_by_egress_network_connection.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
persistence_unusual_exim4_child_process.toml
Updating artifacts
2024-10-29 15:09:06 +00:00
persistence_unusual_sshd_parent_child_execution.toml
Updating artifacts
2024-09-18 12:23:23 +00:00
privilege_escalation_cve_2023_0386_exploitation_attempt.toml
Updating artifacts
2024-07-10 10:18:40 +00:00
privilege_escalation_potential_privilege_escalation_via_cve_2023_4911.toml
Updating artifacts
2024-09-18 12:23:23 +00:00
privilege_escalation_potential_privilege_escalation_via_fuse_binary.toml
Updating artifacts
2024-07-10 13:53:33 +00:00
privilege_escalation_potential_privilege_escalation_via_overlayfs.toml
Updating artifacts
2024-07-10 13:53:33 +00:00
privilege_escalation_potential_sudo_privilege_escalation_via_cve_2019_14287.toml
Updating artifacts
2024-07-29 15:28:45 +00:00
privilege_escalation_privilege_escalation_via_pkexec_exploitation.toml
Updating artifacts
2024-07-10 10:18:40 +00:00
privilege_escalation_privilege_escalation_via_polkit_system_service.toml
Updating artifacts
2024-07-10 10:18:40 +00:00