Detection rules › By catalog entry

Sysmon-for-Linux

Catalog entry	Rules
Event ID 1	248
Event ID 3	6
Event ID 11	47

Event ID 1

248 detection rules reference this catalog entry. View catalog entry.

Sigma (144)

Access of Sudoers File Content severity medium T1592,T1592.004
Apache Spark Shell Command Injection - ProcessCreation severity high T1190
Atlassian Confluence CVE-2022-26134 severity high T1059,T1190
Audit Rules Deleted Via Auditctl severity high T1685,T1685.004
Authencesn Crypto Module Load via Modprobe - Copy-Fail Indicator severity high T1068,T1547,T1547.006
Axios NPM Compromise Indicators - Linux severity high T1059,T1059.004,T1059.006,T1105,T1195,T1195.002
Bash Interactive Shell severity low
BPFtrace Unsafe Option Usage severity medium T1059,T1059.004
Capabilities Discovery - Linux severity low T1083
Capsh Shell Invocation - Linux severity high T1059
Chmod Targeting Sensitive Directories severity medium T1222,T1222.002
Clipboard Collection with Xclip Tool severity low T1115
Connection Proxy severity low T1090
Container Residence Discovery Via Proc Virtual FS severity low T1082
Copy Passwd Or Shadow From TMP Path severity high T1552,T1552.001
Crontab Enumeration severity low T1007
Curl Usage on Linux severity low T1105
CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux) severity high T1059,T1190
DD File Overwrite severity low T1485
Decode Base64 Encoded Text severity low T1027
Disable Or Stop Services severity medium T1489,T1685
Disabling Security Tools severity medium T1686
Docker Container Discovery Via Dockerenv Listing severity low T1082
Download File To Potentially Suspicious Directory Via Wget severity medium T1105
Enable BPF Kprobes Tracing severity medium
ESXi Account Creation Via ESXCLI severity medium T1059,T1059.012,T1136
ESXi Admin Permission Assigned To Account Via ESXCLI severity high T1059,T1059.012,T1098
ESXi Network Configuration Discovery Via ESXCLI severity medium T1007,T1033,T1059,T1059.012
ESXi Storage Information Discovery Via ESXCLI severity medium T1007,T1033,T1059,T1059.012
ESXi Syslog Configuration Change Via ESXCLI severity medium T1059,T1059.012,T1685,T1690
ESXi System Information Discovery Via ESXCLI severity medium T1007,T1033,T1059,T1059.012
ESXi VM Kill Via ESXCLI severity medium T1059,T1059.012,T1529
ESXi VM List Discovery Via ESXCLI severity medium T1007,T1033,T1059,T1059.012
ESXi VSAN Information Discovery Via ESXCLI severity medium T1007,T1033,T1059,T1059.012
Execution Of Script Located In Potentially Suspicious Directory severity medium
File and Directory Discovery - Linux severity informational T1083
File Deletion severity informational T1070,T1070.004
Flush Iptables Ufw Chain severity medium T1686
Group Has Been Deleted Via Groupdel severity medium T1531
History File Deletion severity high T1565,T1565.001
Inline Python Execution - Spawn Shell Via OS System Library severity high T1059
Install Root Certificate severity low T1553,T1553.004
Interactive Bash Suspicious Children severity medium T1036,T1059,T1059.004
Kaspersky Endpoint Security Stopped Via CommandLine - Linux severity high T1685
Linux Base64 Encoded Pipe to Shell severity medium T1140
Linux Base64 Encoded Shebang In CLI severity medium T1140
Linux Crypto Mining Indicators severity high T1496
Linux Doas Tool Execution severity low T1548
Linux HackTool Execution severity high T1587
Linux Logs Clearing Attempts severity medium T1685,T1685.006
Linux Network Service Scanning Tools Execution severity low T1046
Linux Package Uninstall severity low T1070
Linux Recon Indicators severity high T1552,T1552.001,T1592,T1592.004
Linux Remote System Discovery severity low T1018
Linux Setgid Capability Set on a Binary via Setcap Utility severity low T1548,T1554
Linux Setuid Capability Set on a Binary via Setcap Utility severity low T1548,T1554
Linux Shell Pipe to Shell severity medium T1140
Linux Sudo Chroot Execution severity low T1068
Linux Suspicious Child Process from Node.js - React2Shell severity high T1059,T1190
Linux Webshell Indicators severity high T1505,T1505.003
LiteLLM / TeamPCP Supply Chain Attack Indicators severity high T1195,T1195.002,T1543,T1543.002,T1560,T1560.001
Local Groups Discovery - Linux severity low T1069,T1069.001
Local System Accounts Discovery - Linux severity low T1087,T1087.001
Mask System Power Settings Via Systemctl severity high T1653
Mount Execution With Hidepid Parameter severity medium T1564
Named Pipe Created Via Mkfifo severity low
Nohup Execution severity medium T1059,T1059.004
OMIGOD SCX RunAsProvider ExecuteScript severity high T1068,T1190,T1203
OMIGOD SCX RunAsProvider ExecuteShellCommand severity high T1068,T1190,T1203
OS Architecture Discovery Via Grep severity low T1082
Pnscan Binary Data Transmission Activity severity medium T1046
Potential Container Discovery Via Inodes Listing severity low T1082
Potential Discovery Activity Using Find - Linux severity medium T1083
Potential Exploitation of CVE-2024-3094 - Suspicious SSH Child Process severity high
Potential Exploitation of CVE-2025-5054 or CVE-2025-4598 severity medium T1003,T1548
Potential GobRAT File Discovery Via Grep severity high T1082
Potential Linux Amazon SSM Agent Hijacking severity medium T1219,T1219.002
Potential Linux Process Code Injection Via DD Utility severity medium T1055,T1055.009
Potential Netcat Reverse Shell Execution severity high T1059
Potential Perl Reverse Shell Execution severity high
Potential PHP Reverse Shell severity high
Potential Ruby Reverse Shell severity medium
Potential Suspicious Change To Sensitive/Critical Files severity medium T1565,T1565.001
Potential Xterm Reverse Shell severity medium T1059
Potentially Suspicious Execution From Tmp Folder severity medium T1036
Potentially Suspicious Named Pipe Created Via Mkfifo severity medium
Print History File Contents severity medium T1592,T1592.004
Process Discovery severity low T1057
Process Execution From Shared Memory Directory severity high T1027,T1027.011
PUA - TruffleHog Execution - Linux severity medium T1083,T1552,T1552.001
Python One-Liners with Base64 Decoding - Linux severity high T1027,T1027.010,T1059,T1059.006
Python Reverse Shell Execution Via PTY And Socket Modules severity high
Python Spawning Pretty TTY Via PTY Module severity medium T1059
Python WebServer Execution - Linux severity medium T1048,T1048.003
Remote Access Tool - Team Viewer Session Started On Linux Host severity low T1133
Remove Immutable File Attribute severity medium T1222,T1222.002
Remove Scheduled Cron Task/Job severity medium
Scheduled Cron Task/Job - Linux severity medium T1053,T1053.003
Scheduled Task/Job At severity low T1053,T1053.002
Script Interpreter Spawning Credential Scanner - Linux severity high T1005,T1059,T1059.004,T1552
Security Software Discovery - Linux severity low T1518,T1518.001
Setuid and Setgid severity low T1548,T1548.001
Shai-Hulud 2.0 Malicious NPM Package Installation - Linux severity high T1195,T1195.002
Shai-Hulud Malicious Bun Execution - Linux severity high T1195,T1195.002,T1203
Shai-Hulud Malware Indicators - Linux severity high T1059
Shai-Hulud NPM Package Malicious Exfiltration via Curl severity high T1005,T1041
Shell Execution GCC - Linux severity high T1083
Shell Execution Of Process Located In Tmp Directory severity high
Shell Execution via Find - Linux severity high T1083
Shell Execution via Flock - Linux severity high T1083
Shell Execution via Git - Linux severity high T1059
Shell Execution via Nice - Linux severity high T1083
Shell Execution via Rsync - Linux severity high T1059
Shell Invocation via Apt - Linux severity medium T1083
Shell Invocation via Env Command - Linux severity high T1059,T1059.004
Shell Invocation Via Ssh - Linux severity high T1059
Sudo Privilege Escalation CVE-2019-14287 severity high T1068,T1548,T1548.003
Suspicious Child Process of SAP NetWeaver - Linux severity medium T1059,T1059.003,T1190
Suspicious Curl Change User Agents - Linux severity medium T1071,T1071.001
Suspicious Curl File Upload - Linux severity medium T1105,T1567
Suspicious Download and Execute Pattern via Curl/Wget severity high T1059,T1059.004,T1203
Suspicious Git Clone - Linux severity medium T1593,T1593.003
Suspicious Invocation of Shell via AWK - Linux severity high T1059
Suspicious Invocation of Shell via Rsync severity high T1059,T1203
Suspicious Java Children Processes severity high T1059
Suspicious Nohup Execution severity high
Suspicious Package Installed - Linux severity medium T1553,T1553.004
Syslog Clearing or Removal Via System Utilities severity high T1685,T1685.006
System Information Discovery severity informational T1082
System Network Connections Discovery - Linux severity low T1049
System Network Discovery - Linux severity informational T1016
TanStack Supply-Chain Attack Execution Indicators - Linux severity high T1059,T1059.006,T1059.007,T1204,T1204.002
Terminate Linux Process Via Kill severity medium T1685
Touch Suspicious Service File severity medium T1070,T1070.006
Triple Cross eBPF Rootkit Execve Hijack severity high
Triple Cross eBPF Rootkit Install Commands severity high T1014
UFW Disable Attempt severity medium T1686
UNC4841 - Download Compressed Files From Temp.sh Using Wget severity high T1140
UNC4841 - Download Tar File From Untrusted Direct IP Via Wget severity high T1140
UNC4841 - Potential SEASPY Execution severity critical
UNC4841 - SSL Certificate Exfiltration Via Openssl severity high T1140
User Added To Root/Sudoers Group Using Usermod severity medium
User Has Been Deleted Via Userdel severity medium T1531
Vim GTFOBin Abuse - Linux severity high T1059,T1083

Splunk (104)

Curl Execution with Percent Encoded URL severity low T1027,T1105
File Download or Read to Pipe Execution severity medium T1105
Java Writing JSP File severity medium T1133,T1190
Linux Add User Account T1136,T1136.001
Linux Apparmor Bypass Via Aaexec severity medium T1068
Linux APT Privilege Escalation severity low T1548,T1548.003
Linux At Application Execution severity low T1053,T1053.002
Linux AWK Privilege Escalation severity low T1548,T1548.003
Linux Binary Executed from Shared Memory Directory severity low T1059
Linux Busybox Privilege Escalation severity low T1548,T1548.003
Linux c89 Privilege Escalation severity low T1548,T1548.003
Linux c99 Privilege Escalation severity low T1548,T1548.003
Linux Change File Owner To Root severity low T1222,T1222.002
Linux Clipboard Data Copy severity low T1115
Linux Common Process For Elevation Control T1548,T1548.001
Linux Composer Privilege Escalation severity low T1548,T1548.003
Linux Cpulimit Privilege Escalation severity low T1548,T1548.003
Linux Crontab Enumeration T1053,T1053.003
Linux Csvtool Privilege Escalation severity low T1548,T1548.003
Linux Curl Upload File severity medium T1105
Linux Data Destruction Command severity medium T1485
Linux DD File Overwrite severity medium T1485
Linux Decode Base64 to Shell severity medium T1027,T1059,T1059.004
Linux Deleting Critical Directory Using RM Command severity medium T1485
Linux Disable Services severity medium T1489
Linux Doas Tool Execution severity low T1548,T1548.003
Linux Docker Root Directory Mount severity medium T1611
Linux Docker Shell Execution severity low T1059,T1059.013
Linux Edit Cron Table Parameter T1053,T1053.003
Linux Emacs Privilege Escalation severity low T1548,T1548.003
Linux Find Privilege Escalation severity low T1548,T1548.003
Linux GDB Privilege Escalation severity low T1548,T1548.003
Linux Gdrive Binary Activity severity medium T1567
Linux Gem Privilege Escalation severity low T1548,T1548.003
Linux Ghostscript Exploitation severity medium T1059,T1068,T1204,T1204.002,T1566
Linux GNU Awk Privilege Escalation severity low T1548,T1548.003
Linux Hardware Addition SwapOff severity low T1200
Linux Impair Defenses Process Kill T1685
Linux Indicator Removal Clear Cache severity medium T1070
Linux Indicator Removal Service File Deletion severity low T1070,T1070.004
Linux Ingress Tool Transfer Hunting T1105
Linux Ingress Tool Transfer with Curl severity low T1105
Linux Insert Kernel Module Using Insmod Utility severity low T1547,T1547.006
Linux Install Kernel Module Using Modprobe Utility severity low T1547,T1547.006
Linux Iptables Firewall Modification severity low T1686
Linux Kernel Module Enumeration severity low T1014,T1082
Linux Kworker Process In Writable Process Path T1036,T1036.004
Linux Make Privilege Escalation severity low T1548,T1548.003
Linux MySQL Privilege Escalation severity low T1548,T1548.003
Linux Ngrok Reverse Proxy Usage severity low T1090,T1102,T1572
Linux Node Privilege Escalation severity low T1548,T1548.003
Linux NOPASSWD Entry In Sudoers File severity low T1548,T1548.003
Linux Obfuscated Files or Information Base64 Decode severity low T1027
Linux Octave Privilege Escalation severity low T1548,T1548.003
Linux OpenVPN Privilege Escalation severity low T1548,T1548.003
Linux PHP Privilege Escalation severity low T1548,T1548.003
Linux pkexec Privilege Escalation severity medium T1068
Linux Possible Access Or Modification Of sshd Config File severity low T1098,T1098.004
Linux Possible Access To Credential Files severity low T1003,T1003.008
Linux Possible Access To Sudoers File severity low T1548,T1548.003
Linux Possible Append Command To At Allow Config File severity low T1053,T1053.002
Linux Possible Append Command To Profile Config File severity low T1546,T1546.004
Linux Possible Append Cronjob Entry on Existing Cronjob File T1053,T1053.003
Linux Possible Bootloader Modification severity medium T1542,T1542.001
Linux Possible Cronjob Modification With Editor T1053,T1053.003
Linux Possible GSM Privilege Escalation severity low T1068
Linux Possible Nimbuspwn Privilege Escalation severity medium T1068
Linux Preload Hijack Library Calls severity medium T1574,T1574.006
Linux Proxy Socks Curl severity medium T1090,T1095
Linux Puppet Privilege Escalation severity low T1548,T1548.003
Linux Root Execution of id severity low T1033
Linux RPM Privilege Escalation severity low T1548,T1548.003
Linux Ruby Privilege Escalation severity low T1548,T1548.003
Linux Service Restarted severity low T1053,T1053.006
Linux Service Started Or Enabled severity low T1053,T1053.006
Linux Setuid Using Chmod Utility severity low T1548,T1548.001
Linux Setuid Using Setcap Utility severity low T1548,T1548.001
Linux Shell History Access Via Command Line Utility severity low T1552,T1552.003
Linux Shell Pseudo Device Reverse Shell severity low T1048,T1048.003,T1059
Linux Shred Overwrite Command severity medium T1485
Linux Sqlite3 Privilege Escalation severity low T1548,T1548.003
Linux SSH Authorized Keys Modification severity low T1098,T1098.004
Linux SSH Remote Services Script Execute severity medium T1021,T1021.004
Linux Stdout Redirection To Dev Null File severity low T1686
Linux Stop Services severity medium T1489
Linux Sudo OR Su Execution T1548,T1548.003
Linux Suspicious Child Process of PostgreSQL severity medium T1190
Linux Suspicious Docker Build Command Execution severity low T1610
Linux Suspicious GCC Invocation Building Init Shared Object severity medium T1027,T1027.004,T1068,T1129,T1608
Linux Suspicious Namespace Creation severity medium T1068
Linux Suspicious Privileged Container Execution severity low T1059,T1059.004,T1610
Linux Suspicious React or Next.js Child Process severity medium T1059,T1059.004,T1190
Linux Suspicious Redis Activity severity medium T1210,T1505
Linux System Network Discovery severity low T1016
Linux System Reboot Via System Request Key severity medium T1529
Linux Telnet Authentication Bypass severity medium T1548
Linux Unix Shell Enable All SysRq Functions severity low T1059,T1059.004
Linux Usermod Root UID Set severity medium T1078,T1098,T1548,T1548.001
Linux Visudo Utility Execution severity low T1548,T1548.003
Socat Network Listener Binding an Executable severity medium T1059,T1572
Socat Remote TCP Connection with Local Echo Disabled severity low T1059,T1572
Suspicious Curl Network Connection severity medium T1105
Suspicious Linux Discovery Commands severity medium T1059,T1059.004
Web or Application Server Spawning a Shell severity medium T1133,T1190

Event ID 3

6 detection rules reference this catalog entry. View catalog entry.

Sigma (5)

Communication To LocaltoNet Tunneling Service Initiated - Linux severity high T1090,T1102,T1572
Communication To Ngrok Tunneling Service - Linux severity high T1090,T1102,T1567,T1568,T1568.002,T1572
Linux Crypto Mining Pool Connections severity high T1496
Linux Reverse Shell Indicator severity critical T1059,T1059.004
Potentially Suspicious Malware Callback Communication - Linux severity high T1571

Splunk (1)

Linux Netcat Outbound Connection severity low T1059,T1059.004

Event ID 11

47 detection rules reference this catalog entry. View catalog entry.

Sigma (18)

Axios NPM Compromise File Creation Indicators - Linux severity high T1105,T1195,T1195.002
Linux Doas Conf File Creation severity medium T1548
New Cron File Created severity low T1053,T1053.003
Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation severity high T1068
Persistence Via Sudoers.d Files severity medium T1548,T1548.003
Potential SAP NetWeaver Webshell Creation - Linux severity medium T1059,T1059.003,T1190
Potentially Suspicious Long Filename Pattern - Linux severity low T1027,T1059,T1059.004
Potentially Suspicious Shell Script Creation in Profile Folder severity low
Python Path Configuration File Creation - Linux severity medium T1059,T1059.006
Shai-Hulud Malicious GitHub Workflow Creation severity high T1119,T1552,T1552.001
Suspicious Filename with Embedded Base64 Commands severity high T1027,T1059,T1059.004
TanStack Supply-Chain Attack File Creation Indicators - Linux severity medium T1059,T1059.007,T1195,T1195.002,T1547,T1547.004
TeamPCP LiteLLM Supply Chain Attack Persistence Indicators severity high T1195,T1195.002,T1543,T1543.002
Triple Cross eBPF Rootkit Default LockFile severity high
Triple Cross eBPF Rootkit Default Persistence severity high T1053,T1053.003
UNC4841 - Barracuda ESG Exploitation Indicators severity high
UNC4841 - Email Exfiltration File Pattern severity high
Wget Creating Files in Tmp Directory severity medium T1105

Splunk (29)

GitHub Workflow File Creation or Modification T1195,T1554,T1574,T1574.006
Java Writing JSP File severity medium T1133,T1190
Linux Account Manipulation Of SSH Config and Keys severity low T1070,T1070.004,T1485
Linux Add Files In Known Crontab Directories severity low T1053,T1053.003
Linux At Allow Config File Creation severity low T1053,T1053.003
Linux Deletion Of Cron Jobs severity low T1070,T1070.004,T1485
Linux Deletion Of Init Daemon Script severity medium T1070,T1070.004,T1485
Linux Deletion Of Services severity medium T1070,T1070.004,T1485
Linux Deletion of SSL Certificate severity low T1070,T1070.004,T1485
Linux Doas Conf File Creation severity low T1548,T1548.003
Linux EFI Bootloader File Deletion severity medium T1542,T1542.001,T1542.003
Linux File Created In Kernel Driver Directory severity low T1547,T1547.006
Linux File Creation In Init Boot Directory severity low T1037,T1037.004
Linux File Creation In Profile Directory severity low T1546,T1546.004
Linux File Creation In System Generator Directory severity low T1037,T1037.005,T1547
Linux High Frequency Of File Deletion In Boot Folder severity medium T1070,T1070.004,T1485
Linux High Frequency Of File Deletion In Etc Folder severity low T1070,T1070.004,T1485
Linux Medusa Rootkit severity medium T1014,T1589,T1589.001
Linux MOTD Script Added severity low T1037,T1059,T1059.004,T1547
Linux Possible Privilege Escalation via PYTHONPATH severity medium T1068,T1574,T1574.007
Linux Possible Ssh Key File Creation severity low T1098,T1098.004
Linux Possible System Binary Backdoor severity low T1036,T1059,T1059.004
Linux Service File Created In Systemd Directory severity low T1053,T1053.006
Linux Sudoers Tmp File Creation severity low T1548,T1548.003
Linux Suspicious Staging of Alternate System Files severity low T1036
Linux Suspicious XDG Autostart severity low T1037,T1059,T1059.004,T1547
Linux UDEV Rule Created severity low T1037,T1547
Shai-Hulud 2 Exfiltration Artifact Files severity medium T1074,T1074.001,T1195,T1195.002,T1552,T1552.001
Shai-Hulud Workflow File Creation or Modification severity medium T1195,T1554,T1574,T1574.006

Back to all Sysmon-for-Linux catalog entries