EXPLORE DETECTIONS
Lateral Movement via Startup Folder
Identifies suspicious file creations in the startup folder of a remote system. An adversary could abuse this to move laterally by dropping a malicious script or executable that will be executed after a reboot or user logon.
Launch Service Creation and Immediate Loading
An adversary can establish persistence by installing a new launch agent that executes at login by using launchd or launchctl to load a plist into the appropriate directories.
Linux Audio Recording Activity Detected
This rule monitors for the usage of the most common audio recording utilities on unix systems by an uncommon process parent. Adversaries may collect audio data from users or systems for a variety of reasons including espionage, credential theft, or reconnaissance.
Linux Clipboard Activity Detected
This rule monitors for the usage of the most common clipboard utilities on unix systems by an uncommon process parent. Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Linux External IP Address Discovery via Curl
Detects applications making a curl request to a known public IP address lookup web service. Malware tends to perform this action to assess potential targets.
Linux Group Creation
Identifies attempts to create a new group. Attackers may create new groups to establish persistence on a system.
Linux init (PID 1) Secret Dump via GDB
This rule monitors for the potential memory dump of the init process (PID 1) through gdb. Attackers may leverage memory dumping techniques to attempt secret extraction from privileged processes. Tools that display this behavior include "truffleproc" and "bash-memory-dump". This behavior should not happen by default, and should be investigated thoroughly.
Linux Process Hooking via GDB
This rule monitors for potential memory dumping through gdb. Attackers may leverage memory dumping techniques to attempt secret extraction from privileged processes. Tools that display this behavior include "truffleproc" and "bash-memory-dump". This behavior should not happen by default, and should be investigated thoroughly.
Linux SSH X11 Forwarding
This rule monitors for X11 forwarding via SSH. X11 forwarding is a feature that allows users to run graphical applications on a remote server and display the application's graphical user interface on their local machine. Attackers can abuse X11 forwarding for tunneling their GUI-based tools, pivot through compromised systems, and create covert communication channels, enabling lateral movement and facilitating remote control of systems within a network.
Linux Telegram API Request
This rule detects when a process executes the curl or wget command with an argument that includes the api.telegram.org domain. This may indicate command and control behavior.
Linux User Account Creation
Identifies attempts to create new users. Attackers may add new users to establish persistence on a system.
Linux User Account Credential Modification
This rule detects Linux user account credential modification events where the echo command is used to directly echo a password into the passwd or shadow utilities. This technique is used by malware to automate the process of user account credential modification on Linux systems post-infection.
Linux User Added to Privileged Group
Identifies attempts to add a user to a privileged group. Attackers may add users to a privileged group in order to establish persistence on a system.
Linux User or Group Deletion
This rule detects the deletion of user or group accounts on Linux systems. Adversaries may use these commands to remove accounts to cover their tracks or disrupt operations.
Linux Video Recording or Screenshot Activity Detected
This rule monitors for the usage of the most common video recording or screenshot utilities on unix systems by an uncommon process parent. Adversaries may collect video or screenshot data from users or systems for a variety of reasons including espionage, credential theft, or reconnaissance.
LLM-Based Attack Chain Triage by Host
This rule correlates multiple endpoint security alerts from the same host and uses an LLM to analyze command lines, parent processes, file operations, DNS queries, registry modifications, module loads and MITRE ATT&CK tactics progression to determine if they form a coherent attack chain. The LLM provides a verdict (TP/FP/SUSPICIOUS) with confidence score and summary explanation, helping analysts to prioritize hosts exhibiting corroborated malicious behavior while filtering out benign activity.
LLM-Based Compromised User Triage by User
This rule correlates multiple security alerts involving the same user across hosts and data sources, then uses an LLM to analyze whether they indicate account compromise. The LLM evaluates alert patterns, MITRE tactics progression, geographic anomalies, and multi-host activity to provide a verdict and confidence score, helping analysts prioritize users exhibiting indicators of credential theft or unauthorized access.
LLM-Based Curl Activity Triage
Detects non-allowlisted curl activity on Linux, macOS, and Windows hosts and uses an LLM to assess whether the activity is malicious, benign, or requires investigation. The rule parses and normalizes the destination, redacts sensitive command-line values, and aggregates activity by host and destination before invoking the ES|QL COMPLETION command. Only true positive or suspicious verdicts with confidence above 0.7 generate alerts.
LLM-Based Curl Activity Triage via Auditd
Detects non-allowlisted curl activity on Linux hosts via Auditd Manager or Auditbeat and uses an LLM to assess whether the activity is malicious, benign, or requires investigation. The rule parses and normalizes the destination, redacts sensitive command-line values, and aggregates activity by host and destination before invoking the ES|QL COMPLETION command. Only true positive or suspicious verdicts with confidence above 0.7 generate alerts.
LLM-Based Wget Activity Triage
Detects non-allowlisted wget activity on Linux, macOS, and Windows hosts and uses an LLM to assess whether the activity is malicious, benign, or requires investigation. The rule parses and normalizes the destination, redacts sensitive command-line values, and aggregates activity by host and destination before invoking the ES|QL COMPLETION command. Only true positive or suspicious verdicts with confidence above 0.7 generate alerts.
LLM-Based Wget Activity Triage via Auditd
Detects non-allowlisted wget activity on Linux hosts via Auditd Manager or Auditbeat and uses an LLM to assess whether the activity is malicious, benign, or requires investigation. The rule parses and normalizes the destination, redacts sensitive command-line values, and aggregates activity by host and destination before invoking the ES|QL COMPLETION command. Only true positive or suspicious verdicts with confidence above 0.7 generate alerts.
Loadable Kernel Module Configuration File Creation
This rule detects the creation of Loadable Kernel Module (LKM) configuration files. Attackers may create or modify these files to allow their LKMs to be loaded upon reboot, ensuring persistence on a compromised system.
Local Account TokenFilter Policy Disabled
Identifies registry modification to the LocalAccountTokenFilterPolicy policy. If this value exists (which doesn't by default) and is set to 1, then remote connections from all local members of Administrators are granted full high-integrity tokens during negotiation.
Local Scheduled Task Creation
Indicates the creation of a scheduled task. Adversaries can use these to establish persistence, move laterally, and/or escalate privileges.