GitHub Repo

Linux Detections

Name Data Source Technique Type Analytic Story Date
Linux Auditd Private Keys and Certificate Enumeration Linux Auditd Execve T1552.004 Anomaly Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd Sysmon Service Stop Linux Auditd Service Stop T1489 Anomaly Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd File Permissions Modification Via Chattr Linux Auditd Execve T1222.002 Anomaly Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd Base64 Decode Files Linux Auditd Execve T1140 Anomaly Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd Nopasswd Entry In Sudoers File Linux Auditd Proctitle T1548.003 Anomaly China-Nexus Threat Activity, Compromised Linux Host, Salt Typhoon, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd Osquery Service Stop Linux Auditd Service Stop T1489 Anomaly Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd Setuid Using Setcap Utility Linux Auditd Execve T1548.001 TTP Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd Find Ssh Private Keys Linux Auditd Execve T1552.004 Anomaly Hellcat Ransomware, Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd Setuid Using Chmod Utility Linux Auditd Proctitle T1548.001 Anomaly Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd Virtual Disk File And Directory Discovery Linux Auditd Execve T1083 Anomaly Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd Doas Conf File Creation Linux Auditd Path, Linux Auditd Cwd T1548.003 TTP Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd System Network Configuration Discovery Linux Auditd Syscall T1016 Anomaly Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-10-02
Linux Magic SysRq Key Abuse Linux Auditd Path, Linux Auditd Cwd T1059.004 T1489 T1499 T1529 TTP Compromised Linux Host 2026-10-02
Linux Auditd Sudo Or Su Execution Linux Auditd Proctitle T1548.003 Anomaly Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd Service Crash and Restart Burst Linux Auditd Syscall T1499.004 Anomaly Node2Shell, Compromised Linux Host, PHP2Shell 2026-10-28
Linux Compiled C Source To Tmp Sysmon for Linux EventID 1 T1027.004 T1068 Anomaly Linux Living Off The Land, Compromised Linux Host, Linux Privilege Escalation 2026-10-19
Linux Auditd Edit Cron Table Parameter Linux Auditd Syscall T1053.003 Anomaly Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Scheduled Tasks, Linux Privilege Escalation 2026-05-13
Linux Auditd File Permission Modification Via Chmod Linux Auditd Proctitle T1222.002 Anomaly Axios Supply Chain Post Compromise, China-Nexus Threat Activity, Compromised Linux Host, Linux Living Off The Land, XorDDos, Linux Persistence Techniques, Salt Typhoon, Linux Privilege Escalation 2026-05-13
Linux Auditd Unload Module Via Modprobe Linux Auditd Execve T1547.006 TTP Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd Unix Shell Configuration Modification Linux Auditd Path, Linux Auditd Cwd T1546.004 TTP QuietVault, Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd Stop Services Linux Auditd Service Stop T1489 Hunting Data Destruction, Compromised Linux Host, Industroyer2, AwfulShred 2026-10-02
Linux Auditd Kernel Module Enumeration Linux Auditd Syscall T1014 T1082 Anomaly XorDDos, Compromised Linux Host, Linux Rootkit 2026-05-13
Linux Auditd Hidden Files And Directories Creation Linux Auditd Execve T1083 Anomaly Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd Preload Hijack Library Calls Linux Auditd Execve T1574.006 TTP China-Nexus Threat Activity, Compromised Linux Host, Salt Typhoon, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd Possible Access To Credential Files Linux Auditd Proctitle T1003.008 Anomaly Axios Supply Chain Post Compromise, China-Nexus Threat Activity, Compromised Linux Host, Salt Typhoon, Linux Persistence Techniques, Linux Privilege Escalation 2026-10-02
Linux Auditd Process Image Change Under Same PID Linux Auditd Syscall T1106 TTP Node2Shell, Compromised Linux Host, Linux Privilege Escalation 2026-10-28
Linux Auditd Whoami User Discovery Linux Auditd Syscall T1033 Anomaly QuietVault, Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-10-02
Linux Auditd Service Started Linux Auditd Proctitle T1569.002 Anomaly Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd Install Kernel Module Using Modprobe Utility Linux Auditd Syscall T1547.006 Anomaly China-Nexus Threat Activity, Compromised Linux Host, Linux Persistence Techniques, Linux Rootkit, Linux Privilege Escalation 2026-05-13
Linux Auditd Disable Or Modify System Firewall Linux Auditd Service Stop T1686 Anomaly Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd Find Credentials From Password Managers Linux Auditd Execve T1555.005 TTP Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation, Scattered Lapsus$ Hunters 2026-05-13
Linux Malformed Auth Entry Linux Secure T1068 Anomaly Linux Privilege Escalation 2026-05-06
Linux Auditd Insert Kernel Module Using Insmod Utility Linux Auditd Syscall T1547.006 Anomaly Compromised Linux Host, XorDDos, Linux Persistence Techniques, Linux Rootkit, Linux Privilege Escalation 2026-10-02
Linux Auditd Kernel Module Using Rmmod Utility Linux Auditd Syscall T1547.006 TTP Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File Linux Auditd Path, Linux Auditd Cwd T1053.003 Hunting Linux Living Off The Land, Compromised Linux Host, XorDDos, Linux Persistence Techniques, Scheduled Tasks, Linux Privilege Escalation 2026-05-13
Linux Auditd Auditd Daemon Start Linux Auditd Daemon Start T1685.004 Anomaly Compromised Linux Host 2026-05-13
Linux Auditd Possible Access Or Modification Of Sshd Config File Linux Auditd Path, Linux Auditd Cwd T1098.004 Anomaly Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd Auditd Daemon Shutdown Linux Auditd Daemon End T1685.004 Anomaly Compromised Linux Host 2026-05-13
Linux Auditd Data Transfer Size Limits Via Split Syscall Linux Auditd Syscall T1030 Anomaly Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Pedit Offset Out Of Bounds Linux Messages Syslog T1068 TTP Linux Privilege Escalation 2026-07-06
Linux Auditd At Application Execution Linux Auditd Syscall T1053.002 Anomaly Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Scheduled Tasks, Linux Privilege Escalation 2026-05-13
Linux Auditd File And Directory Discovery Linux Auditd Execve T1083 Anomaly Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-10-02
Linux Auditd Service Restarted Linux Auditd Proctitle T1053.006 Anomaly AwfulShred, Gomir, Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Data Destruction, Scheduled Tasks, Linux Privilege Escalation 2026-05-13
Linux Auditd Preload Hijack Via Preload File Linux Auditd Path, Linux Auditd Cwd T1574.006 TTP Linux Living Off The Land, Compromised Linux Host, VoidLink Cloud-Native Linux Malware, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd SOCK RAW EAFNOSUPPORT From User Writable Path Linux Auditd Syscall T1068 TTP Compromised Linux Host, Linux Privilege Escalation 2026-10-19
Linux Auditd Auditd Service Stop Linux Auditd Service Stop T1489 Anomaly Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Dirty Frag Kernel Privilege Escalation Linux Auditd Syscall T1068 T1548.001 TTP Linux Privilege Escalation 2026-07-06
Linux Auditd AI CLI Permission Override Activated Linux Auditd Proctitle T1480 Anomaly QuietVault 2026-05-13
Linux Auditd Copy Fail Privilege Escalation Linux Auditd Syscall T1068 TTP Linux Privilege Escalation 2026-05-13
Linux Auditd Add User Account Type Linux Auditd Add User T1136.001 Anomaly Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd Shred Overwrite Command Linux Auditd Proctitle T1485 TTP Industroyer2, AwfulShred, Compromised Linux Host, Linux Persistence Techniques, Data Destruction, Linux Privilege Escalation 2026-05-13
Linux Auditd Dd File Overwrite Linux Auditd Proctitle T1485 TTP Data Destruction, Compromised Linux Host, Industroyer2 2026-10-02
Linux Binary Launched Process with Null Argv Linux Messages Syslog T1068 TTP Linux Privilege Escalation 2026-07-17
Linux Auditd Hardware Addition Swapoff Linux Auditd Execve T1200 Anomaly Data Destruction, Compromised Linux Host, Scattered Lapsus$ Hunters, AwfulShred 2026-05-13
Linux Auditd Web or Application Server Spawning a Shell Linux Auditd Syscall T1190 TTP PHP2Shell 2026-10-29
Linux Auditd Find Credentials From Password Stores Linux Auditd Execve T1555.005 TTP Hellcat Ransomware, Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation, Scattered Lapsus$ Hunters 2026-05-13
Linux Auditd Add User Account Linux Auditd Proctitle T1136.001 Anomaly Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-10-02
Linux Auditd Possible Setuid Execve Privesc Linux Auditd Execve T1068 Anomaly Linux Privilege Escalation 2026-07-06
Linux PF_ALG Registration Outside of Boot Window Linux Messages Syslog T1068 TTP Linux Privilege Escalation 2026-07-17
Linux Auditd Change File Owner To Root Linux Auditd Proctitle T1222.002 Anomaly Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd Inline PHP Code Execution Linux Auditd Execve T1059 Anomaly PHP2Shell 2026-10-29
Linux Auditd Possible Access To Sudoers File Linux Auditd Path, Linux Auditd Cwd T1548.003 Anomaly China-Nexus Threat Activity, Compromised Linux Host, Salt Typhoon, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Suspicious Namespace Creation Sysmon for Linux EventID 1, Linux Auditd Syscall T1068 TTP Linux Privilege Escalation 2026-05-12
Linux Auditd Clipboard Data Copy Linux Auditd Execve T1115 Anomaly Linux Living Off The Land, Compromised Linux Host 2026-10-02
Linux Auditd Doas Tool Execution Linux Auditd Syscall T1548.003 Anomaly Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd Database File And Directory Discovery Linux Auditd Execve T1083 Anomaly Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd Data Destruction Command Linux Auditd Proctitle T1485 TTP Data Destruction, Compromised Linux Host, AwfulShred 2026-05-13
Linux Auditd Data Transfer Size Limits Via Split Linux Auditd Execve T1030 Anomaly Hellcat Ransomware, Linux Living Off The Land, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Auditd Auditd Daemon Abort Linux Auditd Daemon Abort T1685.004 Anomaly Compromised Linux Host 2026-05-13
Linux Stdout Redirection To Dev Null File Sysmon for Linux EventID 1 T1686 Anomaly Cyclops Blink, Data Destruction, Industroyer2 2026-05-13
Linux Iptables Firewall Modification Sysmon for Linux EventID 1 T1686 Anomaly Cyclops Blink, China-Nexus Threat Activity, Sandworm Tools, Backdoor Pingpong 2026-05-13
Linux Insert Kernel Module Using Insmod Utility Sysmon for Linux EventID 1 T1547.006 Anomaly XorDDos, Linux Privilege Escalation, Linux Persistence Techniques, Linux Rootkit 2026-10-02
Linux c89 Privilege Escalation Sysmon for Linux EventID 1 T1548.003 Anomaly Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
Linux Usermod Root UID Set Sysmon for Linux EventID 1 T1078 T1098 T1548.001 TTP Linux Post-Exploitation, Linux Persistence Techniques, Linux Privilege Escalation 2026-07-08
Linux Account Manipulation Of SSH Config and Keys Sysmon for Linux EventID 11 T1070.004 T1485 Anomaly AcidRain, Hellcat Ransomware 2026-05-13
Linux Suspicious Docker Build Command Execution Sysmon for Linux EventID 1 T1610 Anomaly Linux Post-Exploitation 2026-07-08
Linux Doas Tool Execution Sysmon for Linux EventID 1 T1548.003 Anomaly Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux File Creation In Profile Directory Sysmon for Linux EventID 11 T1546.004 Anomaly Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Possible System Binary Backdoor Sysmon for Linux EventID 11 T1036 T1059.004 Anomaly Linux Post-Exploitation, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-07-08
Linux Possible Access Or Modification Of sshd Config File Sysmon for Linux EventID 1 T1098.004 Anomaly Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Possible Nimbuspwn Privilege Escalation Sysmon for Linux EventID 1 T1068 TTP Linux Post-Exploitation, Linux Persistence Techniques, Linux Privilege Escalation 2026-07-08
Linux GDB Privilege Escalation Sysmon for Linux EventID 1 T1548.003 Anomaly Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
Linux OpenVPN Privilege Escalation Sysmon for Linux EventID 1 T1548.003 Anomaly Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
Linux Suspicious GCC Invocation Building Init Shared Object Sysmon for Linux EventID 1 T1027.004 T1068 T1129 T1608 TTP Linux Post-Exploitation, Linux Persistence Techniques, Linux Privilege Escalation 2026-07-08
Linux Gem Privilege Escalation Sysmon for Linux EventID 1 T1548.003 Anomaly Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
Linux Indicator Removal Clear Cache Sysmon for Linux EventID 1 T1070 TTP Data Destruction, AwfulShred 2026-05-13
Linux Deletion Of Cron Jobs Sysmon for Linux EventID 11 T1070.004 T1485 Anomaly AcidRain, Data Destruction, AcidPour 2026-05-13
Linux Clipboard Data Copy Sysmon for Linux EventID 1 T1115 Anomaly Linux Living Off The Land 2026-10-02
Inline PHP Code Execution Sysmon EventID 1, Sysmon for Linux EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1059 Anomaly PHP2Shell 2026-10-28
Linux Apparmor Bypass Via Aaexec Sysmon for Linux EventID 1 T1068 TTP Linux Privilege Escalation 2026-06-30
Linux Add User Account Sysmon for Linux EventID 1, Cisco Isovalent Process Exec T1136.001 Hunting Cisco Isovalent Suspicious Activity, Linux Persistence Techniques, Linux Privilege Escalation 2026-10-02
Linux pkexec Privilege Escalation Sysmon for Linux EventID 1 T1068 TTP Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
Suspicious Linux Discovery Commands Sysmon for Linux EventID 1 T1059.004 TTP Linux Post-Exploitation, VoidLink Cloud-Native Linux Malware 2026-05-13
Linux Service Started Or Enabled Sysmon for Linux EventID 1 T1053.006 Anomaly Gomir, Linux Living Off The Land, Linux Persistence Techniques, Scheduled Tasks, Linux Privilege Escalation 2026-05-13
Linux Curl Upload File Sysmon for Linux EventID 1, Cisco Isovalent Process Exec T1105 TTP Data Exfiltration, Linux Living Off The Land, NPM Supply Chain Compromise, Ingress Tool Transfer 2026-10-02
Linux Data Destruction Command Sysmon for Linux EventID 1 T1485 Anomaly Data Destruction, AwfulShred 2026-09-01
Linux Service Restarted Sysmon for Linux EventID 1 T1053.006 Anomaly AwfulShred, Gomir, Linux Living Off The Land, Linux Persistence Techniques, Data Destruction, Scheduled Tasks, Linux Privilege Escalation 2026-05-13
Linux System Reboot Via System Request Key Sysmon for Linux EventID 1 T1529 TTP Data Destruction, AwfulShred 2026-10-02
Linux UDEV Rule Created Sysmon for Linux EventID 11 T1037 T1547 Anomaly Linux Post-Exploitation, Linux Persistence Techniques, Linux Privilege Escalation 2026-07-08
Linux Ingress Tool Transfer Hunting Sysmon for Linux EventID 1 T1105 Hunting Axios Supply Chain Post Compromise, NPM Supply Chain Compromise, Linux Living Off The Land, XorDDos, Ingress Tool Transfer 2026-10-09
Linux Add Files In Known Crontab Directories Sysmon for Linux EventID 11 T1053.003 Anomaly Linux Living Off The Land, XorDDos, Linux Persistence Techniques, Scheduled Tasks, Linux Privilege Escalation 2026-05-13
Linux Possible Cronjob Modification With Editor Sysmon for Linux EventID 1 T1053.003 Hunting Linux Living Off The Land, XorDDos, Linux Persistence Techniques, Scheduled Tasks, Linux Privilege Escalation 2026-05-13
Linux Suspicious Child Process of PostgreSQL Sysmon for Linux EventID 1 T1190 TTP Compromised Linux Host, SQL Injection, Linux Persistence Techniques, Linux Post-Exploitation, Linux Privilege Escalation 2026-07-17
Linux At Allow Config File Creation Sysmon for Linux EventID 11 T1053.003 Anomaly Linux Living Off The Land, Scheduled Tasks, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Impair Defenses Process Kill Sysmon for Linux EventID 1 T1685 Hunting Data Destruction, Scattered Lapsus$ Hunters, AwfulShred 2026-05-13
Linux Disable Services Sysmon for Linux EventID 1 T1489 TTP Data Destruction, Industroyer2, AwfulShred 2026-05-13
Linux Suspicious Privileged Container Execution Sysmon for Linux EventID 1 T1059.004 T1610 Anomaly Linux Post-Exploitation, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-07-08
Linux Emacs Privilege Escalation Sysmon for Linux EventID 1 T1548.003 Anomaly Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
Linux Telnet Authentication Bypass Sysmon for Linux EventID 1 T1548 TTP Telnetd CVE-2026-24061 2026-05-13
Curl Execution with Percent Encoded URL Sysmon EventID 1, Sysmon for Linux EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1027 T1105 Anomaly Ingress Tool Transfer, Compromised Windows Host, Living Off The Land 2026-05-13
Linux Change File Owner To Root Sysmon for Linux EventID 1 T1222.002 Anomaly Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Suspicious XDG Autostart Sysmon for Linux EventID 11 T1037 T1059.004 T1547 Anomaly Linux Post-Exploitation, Linux Persistence Techniques 2026-07-08
Linux Docker Root Directory Mount Sysmon for Linux EventID 1 T1611 TTP Linux Living Off The Land, Linux Privilege Escalation 2026-10-02
Linux Visudo Utility Execution Sysmon for Linux EventID 1 T1548.003 Anomaly Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Find Privilege Escalation Sysmon for Linux EventID 1 T1548.003 Anomaly Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
Linux Root Execution of id Sysmon for Linux EventID 1 T1033 Anomaly Linux Post-Exploitation, Linux Persistence Techniques, Linux Privilege Escalation 2026-07-08
Linux Csvtool Privilege Escalation Sysmon for Linux EventID 1 T1548.003 Anomaly Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
Linux Medusa Rootkit Sysmon for Linux EventID 11 T1014 T1589.001 TTP Medusa Rootkit, Hellcat Ransomware, China-Nexus Threat Activity, VoidLink Cloud-Native Linux Malware 2026-05-13
File Download or Read to Pipe Execution Sysmon EventID 1, Sysmon for Linux EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1105 TTP Log4Shell CVE-2021-44228, NPM Supply Chain Compromise, Linux Living Off The Land, Compromised Windows Host, Ingress Tool Transfer 2026-09-01
Linux File Creation In System Generator Directory Sysmon for Linux EventID 11 T1037.005 T1547 Anomaly Linux Persistence Techniques 2026-07-08
Linux File Created In Kernel Driver Directory Sysmon for Linux EventID 11 T1547.006 Anomaly Linux Rootkit, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Deleting Critical Directory Using RM Command Sysmon for Linux EventID 1 T1485 TTP Data Destruction, Industroyer2, AwfulShred 2026-05-13
Linux APT Privilege Escalation Sysmon for Linux EventID 1, Cisco Isovalent Process Exec T1548.003 Anomaly Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
Linux Shell Pseudo Device Reverse Shell Sysmon for Linux EventID 1 T1048.003 T1059 Anomaly Command And Control, Compromised Linux Host, Linux Persistence Techniques, Linux Post-Exploitation, Linux Privilege Escalation 2026-07-08
Linux MySQL Privilege Escalation Sysmon for Linux EventID 1 T1548.003 Anomaly Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
Linux Possible Append Cronjob Entry on Existing Cronjob File Sysmon for Linux EventID 1 T1053.003 Hunting Linux Living Off The Land, XorDDos, Linux Persistence Techniques, Scheduled Tasks, Linux Privilege Escalation 2026-05-13
Linux Netcat Outbound Connection Sysmon for Linux EventID 3 T1059.004 Anomaly Linux Post-Exploitation, Command And Control, Compromised Linux Host, Data Exfiltration 2026-07-08
Linux System Network Discovery Sysmon for Linux EventID 1, Osquery Results T1016 Anomaly Data Destruction, Network Discovery, Industroyer2, VoidLink Cloud-Native Linux Malware 2026-10-02
Linux Hardware Addition SwapOff Sysmon for Linux EventID 1 T1200 Anomaly Data Destruction, Scattered Lapsus$ Hunters, AwfulShred 2026-05-13
Linux High Frequency Of File Deletion In Etc Folder Sysmon for Linux EventID 11 T1070.004 T1485 Anomaly AcidRain, Data Destruction 2026-05-13
Potential password in username Linux Secure T1078.003 T1552.001 Hunting Credential Dumping, Insider Threat 2026-09-22
Linux Persistence and Privilege Escalation Risk Behavior T1548 Correlation Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Crontab Enumeration Sysmon for Linux EventID 1, Cisco Isovalent Process Exec T1053.003 Hunting Industroyer2, Cisco Isovalent Suspicious Activity, Gomir, Linux Living Off The Land, VoidLink Cloud-Native Linux Malware, Linux Persistence Techniques, Data Destruction, Scheduled Tasks, Linux Privilege Escalation 2026-09-03
Linux Busybox Privilege Escalation Sysmon for Linux EventID 1 T1548.003 Anomaly Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
Linux Service File Created In Systemd Directory Sysmon for Linux EventID 11 T1053.006 Anomaly Gomir, China-Nexus Threat Activity, Linux Living Off The Land, VoidLink Cloud-Native Linux Malware, Linux Persistence Techniques, Scheduled Tasks, Linux Privilege Escalation 2026-05-13
Linux Cpulimit Privilege Escalation Sysmon for Linux EventID 1 T1548.003 Anomaly Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
Linux At Application Execution Sysmon for Linux EventID 1 T1053.002 Anomaly Cisco Isovalent Suspicious Activity, Linux Living Off The Land, Linux Persistence Techniques, Scheduled Tasks, Linux Privilege Escalation 2026-10-09
Linux Octave Privilege Escalation Sysmon for Linux EventID 1 T1548.003 Anomaly Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
Linux Node Privilege Escalation Sysmon for Linux EventID 1 T1548.003 Anomaly Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
Linux EFI Bootloader File Deletion Sysmon for Linux EventID 11 T1542.001 T1542.003 TTP Ransomware, Data Destruction, Linux Persistence Techniques 2026-07-08
Linux Possible Access To Sudoers File Sysmon for Linux EventID 1 T1548.003 Anomaly China-Nexus Threat Activity, Salt Typhoon, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Deletion of SSL Certificate Sysmon for Linux EventID 11 T1070.004 T1485 Anomaly AcidRain, AcidPour 2026-05-13
Linux MOTD Script Added Sysmon for Linux EventID 11 T1037 T1059.004 T1547 Anomaly Linux Post-Exploitation, Linux Persistence Techniques 2026-07-08
Linux GNU Awk Privilege Escalation Sysmon for Linux EventID 1 T1548.003 Anomaly Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
Linux Setuid Using Setcap Utility Sysmon for Linux EventID 1 T1548.001 Anomaly Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux File Creation In Init Boot Directory Sysmon for Linux EventID 11 T1037.004 Anomaly China-Nexus Threat Activity, Backdoor Pingpong, XorDDos, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Sqlite3 Privilege Escalation Sysmon for Linux EventID 1 T1548.003 Anomaly Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
Linux Proxy Socks Curl Sysmon for Linux EventID 1 T1090 T1095 TTP Linux Living Off The Land, Ingress Tool Transfer 2026-06-04
Linux Binary Executed from Shared Memory Directory Sysmon for Linux EventID 1 T1059 Anomaly Linux Post-Exploitation, Compromised Linux Host, Linux Persistence Techniques, Linux Privilege Escalation 2026-07-08
Linux Possible Bootloader Modification Sysmon for Linux EventID 1 T1542.001 TTP Data Destruction, Linux Persistence Techniques, Linux Rootkit 2026-07-08
Linux Edit Cron Table Parameter Sysmon for Linux EventID 1 T1053.003 Hunting Linux Living Off The Land, Scheduled Tasks, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Shell History Access Via Command Line Utility Sysmon for Linux EventID 1 T1552.003 Anomaly Compromised Linux Host, Linux Persistence Techniques, Linux Post-Exploitation, Credential Dumping, Linux Privilege Escalation 2026-07-08
Linux Sudo OR Su Execution Sysmon for Linux EventID 1 T1548.003 Hunting VoidLink Cloud-Native Linux Malware, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Kworker Process In Writable Process Path Sysmon for Linux EventID 1 T1036.004 Hunting Cyclops Blink, Sandworm Tools 2026-05-13
Linux Possible GSM Privilege Escalation Sysmon for Linux EventID 1 T1068 Anomaly Linux Privilege Escalation 2026-07-08
Linux High Frequency Of File Deletion In Boot Folder Sysmon for Linux EventID 11 T1070.004 T1485 TTP AcidPour, Data Destruction, Industroyer2 2026-05-13
Linux Obfuscated Files or Information Base64 Decode Sysmon for Linux EventID 1 T1027 Anomaly Linux Living Off The Land 2026-10-02
Linux Deletion Of Services Sysmon for Linux EventID 11 T1070.004 T1485 TTP AcidRain, Data Destruction, AcidPour, AwfulShred 2026-05-13
Linux Stop Services Sysmon for Linux EventID 1 T1489 TTP Data Destruction, Industroyer2, AwfulShred 2026-05-13
Linux Kernel Module Enumeration Sysmon for Linux EventID 1 T1014 T1082 Anomaly XorDDos, Linux Rootkit 2026-10-09
Linux Make Privilege Escalation Sysmon for Linux EventID 1 T1548.003 Anomaly Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
Linux Docker Shell Execution Sysmon for Linux EventID 1 T1059.013 Anomaly Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
Linux Ngrok Reverse Proxy Usage Sysmon for Linux EventID 1 T1090 T1102 T1572 Anomaly Reverse Network Proxy 2026-10-30
Socat Remote TCP Connection with Local Echo Disabled Sysmon for Linux EventID 1, Osquery Results T1059 T1572 Anomaly MacOS Post-Exploitation 2026-08-27
Linux SSH Authorized Keys Modification Sysmon for Linux EventID 1 T1098.004 Anomaly Hellcat Ransomware, Linux Living Off The Land, VoidLink Cloud-Native Linux Malware 2026-10-02
Linux Possible Append Command To At Allow Config File Sysmon for Linux EventID 1 T1053.002 Anomaly Scheduled Tasks, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Socat Network Listener Binding an Executable Sysmon for Linux EventID 1, Osquery Results T1059 T1572 TTP MacOS Post-Exploitation 2026-08-27
Linux Gdrive Binary Activity Sysmon for Linux EventID 1 T1567 TTP China-Nexus Threat Activity 2026-05-13
Linux PHP Privilege Escalation Sysmon for Linux EventID 1 T1548.003 Anomaly Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
Linux Composer Privilege Escalation Sysmon for Linux EventID 1 T1548.003 Anomaly Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
Shai-Hulud 2 Exfiltration Artifact Files Sysmon EventID 11, Sysmon for Linux EventID 11 T1074.001 T1195.002 T1552.001 TTP NPM Supply Chain Compromise 2026-05-13
Linux Possible Privilege Escalation via PYTHONPATH Sysmon for Linux EventID 11 T1068 T1574.007 TTP Linux Post-Exploitation, Linux Persistence Techniques, Linux Privilege Escalation 2026-07-08
Linux Common Process For Elevation Control Sysmon for Linux EventID 1 T1548.001 Hunting Axios Supply Chain Post Compromise, China-Nexus Threat Activity, Linux Living Off The Land, Salt Typhoon, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Ingress Tool Transfer with Curl Sysmon for Linux EventID 1 T1105 Anomaly XorDDos, Ingress Tool Transfer, Linux Living Off The Land, NPM Supply Chain Compromise 2026-10-09
Linux Setuid Using Chmod Utility Sysmon for Linux EventID 1 T1548.001 Anomaly Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Ghostscript Exploitation Sysmon for Linux EventID 1 T1059 T1068 T1204.002 T1566 TTP Linux Post-Exploitation, Suspicious Command-Line Executions, Linux Living Off The Land, Unusual Processes 2026-09-01
Linux Ruby Privilege Escalation Sysmon for Linux EventID 1 T1548.003 Anomaly Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
GitHub Workflow File Creation or Modification Sysmon EventID 11, Sysmon for Linux EventID 11 T1195 T1554 T1574.006 Hunting NPM Supply Chain Compromise 2026-05-13
Web or Application Server Spawning a Shell Sysmon EventID 1, Sysmon for Linux EventID 1 T1133 T1190 TTP Hermetic Wiper, WS FTP Server Critical Vulnerabilities, Data Destruction, Microsoft WSUS CVE-2025-59287, Flax Typhoon, PHP2Shell, SysAid On-Prem Software CVE-2023-47246 Vulnerability, Microsoft SharePoint Vulnerabilities, GhostRedirector IIS Module and Rungan Backdoor, ProxyShell, Log4Shell CVE-2021-44228, HAFNIUM Group, PHP-CGI RCE Attack on Japanese Organizations, ProxyNotShell, Cleo File Transfer Software, CISA AA22-257A, Spring4Shell CVE-2022-22965, BlackByte Ransomware, SAP NetWeaver Exploitation, CISA AA22-264A 2026-10-28
Linux Install Kernel Module Using Modprobe Utility Sysmon for Linux EventID 1 T1547.006 Anomaly China-Nexus Threat Activity, VoidLink Cloud-Native Linux Malware, Linux Persistence Techniques, Linux Rootkit, Linux Privilege Escalation 2026-05-13
Linux DD File Overwrite Sysmon for Linux EventID 1 T1485 TTP Data Destruction, Industroyer2 2026-10-02
Linux NOPASSWD Entry In Sudoers File Sysmon for Linux EventID 1 T1548.003 Anomaly China-Nexus Threat Activity, Salt Typhoon, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux AWK Privilege Escalation Sysmon for Linux EventID 1 T1548.003 Anomaly Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
Linux Decode Base64 to Shell Sysmon for Linux EventID 1, Cisco Isovalent Process Exec T1027 T1059.004 TTP Linux Living Off The Land, Cisco Isovalent Suspicious Activity 2026-10-02
Linux c99 Privilege Escalation Sysmon for Linux EventID 1 T1548.003 Anomaly Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
Linux Puppet Privilege Escalation Sysmon for Linux EventID 1 T1548.003 Anomaly Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
Linux Suspicious Staging of Alternate System Files Sysmon for Linux EventID 11 T1036 Anomaly Linux Post-Exploitation, Linux Persistence Techniques, Linux Privilege Escalation 2026-07-08
Linux Possible Ssh Key File Creation Sysmon for Linux EventID 11 T1098.004 Anomaly Hellcat Ransomware, Linux Living Off The Land, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Deletion Of Init Daemon Script Sysmon for Linux EventID 11 T1070.004 T1485 TTP AcidRain, Data Destruction, AcidPour 2026-05-13
Linux Suspicious Redis Activity Sysmon for Linux EventID 1 T1210 T1505 TTP Command And Control, Compromised Linux Host, Linux Living Off The Land, Linux Persistence Techniques, Linux Post-Exploitation, Linux Privilege Escalation 2026-07-08
Linux Doas Conf File Creation Sysmon for Linux EventID 11 T1548.003 Anomaly Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Unix Shell Enable All SysRq Functions Sysmon for Linux EventID 1 T1059.004 Anomaly Data Destruction, AwfulShred 2026-05-13
Linux Indicator Removal Service File Deletion Sysmon for Linux EventID 1 T1070.004 Anomaly Data Destruction, AwfulShred 2026-05-13
Linux Preload Hijack Library Calls Sysmon for Linux EventID 1 T1574.006 TTP China-Nexus Threat Activity, VoidLink Cloud-Native Linux Malware, Salt Typhoon, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Linux Sudoers Tmp File Creation Sysmon for Linux EventID 11 T1548.003 Anomaly China-Nexus Threat Activity, Salt Typhoon, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Suspicious Curl Network Connection Sysmon EventID 1, Sysmon for Linux EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 T1105 TTP Hellcat Ransomware, Linux Living Off The Land, APT37 Rustonotto and FadeStealer, Silver Sparrow, GhostRedirector IIS Module and Rungan Backdoor, Ingress Tool Transfer 2026-05-13
Linux Possible Access To Credential Files Sysmon for Linux EventID 1 T1003.008 Anomaly China-Nexus Threat Activity, XorDDos, Salt Typhoon, Linux Persistence Techniques, Linux Privilege Escalation 2026-05-13
Java Writing JSP File Sysmon for Linux EventID 1, Sysmon for Linux EventID 11 T1133 T1190 TTP SysAid On-Prem Software CVE-2023-47246 Vulnerability, SAP NetWeaver Exploitation, Atlassian Confluence Server and Data Center CVE-2022-26134, Spring4Shell CVE-2022-22965 2026-05-13
Linux Suspicious React or Next.js Child Process Sysmon for Linux EventID 1 T1059.004 T1190 TTP Node2Shell, React2Shell 2026-05-13
Linux RPM Privilege Escalation Sysmon for Linux EventID 1 T1548.003 Anomaly Linux Living Off The Land, Linux Privilege Escalation 2026-05-13
Linux Possible Append Command To Profile Config File Sysmon for Linux EventID 1 T1546.004 Anomaly Linux Persistence Techniques, Linux Privilege Escalation 2026-08-12
Linux Shred Overwrite Command Sysmon for Linux EventID 1 T1485 TTP Industroyer2, AwfulShred, Linux Persistence Techniques, Data Destruction, Linux Privilege Escalation 2026-05-13
Shai-Hulud Workflow File Creation or Modification Sysmon EventID 11, Sysmon for Linux EventID 11 T1195 T1554 T1574.006 TTP NPM Supply Chain Compromise 2026-05-13
Linux SSH Remote Services Script Execute Sysmon for Linux EventID 1 T1021.004 TTP Hellcat Ransomware, Linux Living Off The Land, VoidLink Cloud-Native Linux Malware 2026-05-13