246 detection rules reference this event. View event page.Sigma (144)
- Access of Sudoers File Content severity medium T1592, T1592.004
- Apache Spark Shell Command Injection - ProcessCreation severity high T1190
- Atlassian Confluence CVE-2022-26134 severity high T1059, T1190
- Audit Rules Deleted Via Auditctl severity high T1685, T1685.004
- Authencesn Crypto Module Load via Modprobe - Copy-Fail Indicator severity high T1068, T1547, T1547.006
- Axios NPM Compromise Indicators - Linux severity high T1059, T1059.004, T1059.006, T1105, T1195, T1195.002
- Bash Interactive Shell severity low
- BPFtrace Unsafe Option Usage severity medium T1059, T1059.004
- Capabilities Discovery - Linux severity low T1083
- Capsh Shell Invocation - Linux severity high T1059
- Chmod Targeting Sensitive Directories severity medium T1222, T1222.002
- Clipboard Collection with Xclip Tool severity low T1115
- Connection Proxy severity low T1090
- Container Residence Discovery Via Proc Virtual FS severity low T1082
- Copy Passwd Or Shadow From TMP Path severity high T1552, T1552.001
- Crontab Enumeration severity low T1007
- Curl Usage on Linux severity low T1105
- CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux) severity high T1059, T1190
- DD File Overwrite severity low T1485
- Decode Base64 Encoded Text severity low T1027
- Disable Or Stop Services severity medium T1489, T1685
- Disabling Security Tools severity medium T1686
- Docker Container Discovery Via Dockerenv Listing severity low T1082
- Download File To Potentially Suspicious Directory Via Wget severity medium T1105
- Enable BPF Kprobes Tracing severity medium
- ESXi Account Creation Via ESXCLI severity medium T1059, T1059.012, T1136
- ESXi Admin Permission Assigned To Account Via ESXCLI severity high T1059, T1059.012, T1098
- ESXi Network Configuration Discovery Via ESXCLI severity medium T1007, T1033, T1059, T1059.012
- ESXi Storage Information Discovery Via ESXCLI severity medium T1007, T1033, T1059, T1059.012
- ESXi Syslog Configuration Change Via ESXCLI severity medium T1059, T1059.012, T1685, T1690
- ESXi System Information Discovery Via ESXCLI severity medium T1007, T1033, T1059, T1059.012
- ESXi VM Kill Via ESXCLI severity medium T1059, T1059.012, T1529
- ESXi VM List Discovery Via ESXCLI severity medium T1007, T1033, T1059, T1059.012
- ESXi VSAN Information Discovery Via ESXCLI severity medium T1007, T1033, T1059, T1059.012
- Execution Of Script Located In Potentially Suspicious Directory severity medium
- File and Directory Discovery - Linux severity informational T1083
- File Deletion severity informational T1070, T1070.004
- Flush Iptables Ufw Chain severity medium T1686
- Group Has Been Deleted Via Groupdel severity medium T1531
- History File Deletion severity high T1565, T1565.001
- Inline Python Execution - Spawn Shell Via OS System Library severity high T1059
- Install Root Certificate severity low T1553, T1553.004
- Interactive Bash Suspicious Children severity medium T1036, T1059, T1059.004
- Kaspersky Endpoint Security Stopped Via CommandLine - Linux severity high T1685
- Linux Base64 Encoded Pipe to Shell severity medium T1140
- Linux Base64 Encoded Shebang In CLI severity medium T1140
- Linux Crypto Mining Indicators severity high T1496
- Linux Doas Tool Execution severity low T1548
- Linux HackTool Execution severity high T1587
- Linux Logs Clearing Attempts severity medium T1685, T1685.006
- Linux Network Service Scanning Tools Execution severity low T1046
- Linux Package Uninstall severity low T1070
- Linux Recon Indicators severity high T1552, T1552.001, T1592, T1592.004
- Linux Remote System Discovery severity low T1018
- Linux Setgid Capability Set on a Binary via Setcap Utility severity low T1548, T1554
- Linux Setuid Capability Set on a Binary via Setcap Utility severity low T1548, T1554
- Linux Shell Pipe to Shell severity medium T1140
- Linux Sudo Chroot Execution severity low T1068
- Linux Suspicious Child Process from Node.js - React2Shell severity high T1059, T1190
- Linux Webshell Indicators severity high T1505, T1505.003
- LiteLLM / TeamPCP Supply Chain Attack Indicators severity high T1195, T1195.002, T1543, T1543.002, T1560, T1560.001
- Local Groups Discovery - Linux severity low T1069, T1069.001
- Local System Accounts Discovery - Linux severity low T1087, T1087.001
- Mask System Power Settings Via Systemctl severity high T1653
- Mount Execution With Hidepid Parameter severity medium T1564
- Named Pipe Created Via Mkfifo severity low
- Nohup Execution severity medium T1059, T1059.004
- OMIGOD SCX RunAsProvider ExecuteScript severity high T1068, T1190, T1203
- OMIGOD SCX RunAsProvider ExecuteShellCommand severity high T1068, T1190, T1203
- OS Architecture Discovery Via Grep severity low T1082
- Pnscan Binary Data Transmission Activity severity medium T1046
- Potential Container Discovery Via Inodes Listing severity low T1082
- Potential Discovery Activity Using Find - Linux severity medium T1083
- Potential Exploitation of CVE-2024-3094 - Suspicious SSH Child Process severity high
- Potential Exploitation of CVE-2025-5054 or CVE-2025-4598 severity medium T1003, T1548
- Potential GobRAT File Discovery Via Grep severity high T1082
- Potential Linux Amazon SSM Agent Hijacking severity medium T1219, T1219.002
- Potential Linux Process Code Injection Via DD Utility severity medium T1055, T1055.009
- Potential Netcat Reverse Shell Execution severity high T1059
- Potential Perl Reverse Shell Execution severity high
- Potential PHP Reverse Shell severity high
- Potential Ruby Reverse Shell severity medium
- Potential Suspicious Change To Sensitive/Critical Files severity medium T1565, T1565.001
- Potential Xterm Reverse Shell severity medium T1059
- Potentially Suspicious Execution From Tmp Folder severity medium T1036
- Potentially Suspicious Named Pipe Created Via Mkfifo severity medium
- Print History File Contents severity medium T1592, T1592.004
- Process Discovery severity low T1057
- Process Execution From Shared Memory Directory severity high T1027, T1027.011
- PUA - TruffleHog Execution - Linux severity medium T1083, T1552, T1552.001
- Python One-Liners with Base64 Decoding - Linux severity high T1027, T1027.010, T1059, T1059.006
- Python Reverse Shell Execution Via PTY And Socket Modules severity high
- Python Spawning Pretty TTY Via PTY Module severity medium T1059
- Python WebServer Execution - Linux severity medium T1048, T1048.003
- Remote Access Tool - Team Viewer Session Started On Linux Host severity low T1133
- Remove Immutable File Attribute severity medium T1222, T1222.002
- Remove Scheduled Cron Task/Job severity medium
- Scheduled Cron Task/Job - Linux severity medium T1053, T1053.003
- Scheduled Task/Job At severity low T1053, T1053.002
- Script Interpreter Spawning Credential Scanner - Linux severity high T1005, T1059, T1059.004, T1552
- Security Software Discovery - Linux severity low T1518, T1518.001
- Setuid and Setgid severity low T1548, T1548.001
- Shai-Hulud 2.0 Malicious NPM Package Installation - Linux severity high T1195, T1195.002
- Shai-Hulud Malicious Bun Execution - Linux severity high T1195, T1195.002, T1203
- Shai-Hulud Malware Indicators - Linux severity high T1059
- Shai-Hulud NPM Package Malicious Exfiltration via Curl severity high T1005, T1041
- Shell Execution GCC - Linux severity high T1083
- Shell Execution Of Process Located In Tmp Directory severity high
- Shell Execution via Find - Linux severity high T1083
- Shell Execution via Flock - Linux severity high T1083
- Shell Execution via Git - Linux severity high T1059
- Shell Execution via Nice - Linux severity high T1083
- Shell Execution via Rsync - Linux severity high T1059
- Shell Invocation via Apt - Linux severity medium T1083
- Shell Invocation via Env Command - Linux severity high T1059, T1059.004
- Shell Invocation Via Ssh - Linux severity high T1059
- Sudo Privilege Escalation CVE-2019-14287 severity high T1068, T1548, T1548.003
- Suspicious Child Process of SAP NetWeaver - Linux severity medium T1059, T1059.003, T1190
- Suspicious Curl Change User Agents - Linux severity medium T1071, T1071.001
- Suspicious Curl File Upload - Linux severity medium T1105, T1567
- Suspicious Download and Execute Pattern via Curl/Wget severity high T1059, T1059.004, T1203
- Suspicious Git Clone - Linux severity medium T1593, T1593.003
- Suspicious Invocation of Shell via AWK - Linux severity high T1059
- Suspicious Invocation of Shell via Rsync severity high T1059, T1203
- Suspicious Java Children Processes severity high T1059
- Suspicious Nohup Execution severity high
- Suspicious Package Installed - Linux severity medium T1553, T1553.004
- Syslog Clearing or Removal Via System Utilities severity high T1685, T1685.006
- System Information Discovery severity informational T1082
- System Network Connections Discovery - Linux severity low T1049
- System Network Discovery - Linux severity informational T1016
- TanStack Supply-Chain Attack Execution Indicators - Linux severity high T1059, T1059.006, T1059.007, T1204, T1204.002
- Terminate Linux Process Via Kill severity medium T1685
- Touch Suspicious Service File severity medium T1070, T1070.006
- Triple Cross eBPF Rootkit Execve Hijack severity high
- Triple Cross eBPF Rootkit Install Commands severity high T1014
- UFW Disable Attempt severity medium T1686
- UNC4841 - Download Compressed Files From Temp.sh Using Wget severity high T1140
- UNC4841 - Download Tar File From Untrusted Direct IP Via Wget severity high T1140
- UNC4841 - Potential SEASPY Execution severity critical
- UNC4841 - SSL Certificate Exfiltration Via Openssl severity high T1140
- User Added To Root/Sudoers Group Using Usermod severity medium
- User Has Been Deleted Via Userdel severity medium T1531
- Vim GTFOBin Abuse - Linux severity high T1059, T1083
Splunk (102)
- Curl Execution with Percent Encoded URL severity low T1027, T1105
- File Download or Read to Pipe Execution severity medium T1105
- Java Writing JSP File severity medium T1133, T1190
- Linux Add User Account T1136, T1136.001
- Linux Adding Crontab Using List Parameter T1053, T1053.003
- Linux Apparmor Bypass Via Aaexec severity medium T1068
- Linux APT Privilege Escalation severity low T1548, T1548.003
- Linux At Application Execution severity low T1053, T1053.002
- Linux AWK Privilege Escalation severity low T1548, T1548.003
- Linux Binary Executed from Shared Memory Directory severity low T1059
- Linux Busybox Privilege Escalation severity low T1548, T1548.003
- Linux c89 Privilege Escalation severity low T1548, T1548.003
- Linux c99 Privilege Escalation severity low T1548, T1548.003
- Linux Change File Owner To Root severity low T1222, T1222.002
- Linux Clipboard Data Copy severity low T1115
- Linux Common Process For Elevation Control T1548, T1548.001
- Linux Composer Privilege Escalation severity low T1548, T1548.003
- Linux Cpulimit Privilege Escalation severity low T1548, T1548.003
- Linux Csvtool Privilege Escalation severity low T1548, T1548.003
- Linux Curl Upload File severity medium T1105
- Linux Data Destruction Command severity medium T1485
- Linux DD File Overwrite severity medium T1485
- Linux Decode Base64 to Shell severity medium T1027, T1059, T1059.004
- Linux Deleting Critical Directory Using RM Command severity medium T1485
- Linux Disable Services severity medium T1489
- Linux Doas Tool Execution severity low T1548, T1548.003
- Linux Docker Root Directory Mount severity medium T1611
- Linux Docker Shell Execution severity low T1059, T1059.013
- Linux Edit Cron Table Parameter T1053, T1053.003
- Linux Emacs Privilege Escalation severity low T1548, T1548.003
- Linux Find Privilege Escalation severity low T1548, T1548.003
- Linux GDB Privilege Escalation severity low T1548, T1548.003
- Linux Gdrive Binary Activity severity medium T1567
- Linux Gem Privilege Escalation severity low T1548, T1548.003
- Linux Ghostscript Exploitation severity medium T1059, T1068, T1204, T1204.002, T1566
- Linux GNU Awk Privilege Escalation severity low T1548, T1548.003
- Linux Hardware Addition SwapOff severity low T1200
- Linux Impair Defenses Process Kill T1685
- Linux Indicator Removal Clear Cache severity medium T1070
- Linux Indicator Removal Service File Deletion severity low T1070, T1070.004
- Linux Ingress Tool Transfer Hunting T1105
- Linux Ingress Tool Transfer with Curl severity low T1105
- Linux Insert Kernel Module Using Insmod Utility severity low T1547, T1547.006
- Linux Install Kernel Module Using Modprobe Utility severity low T1547, T1547.006
- Linux Iptables Firewall Modification severity low T1686
- Linux Kernel Module Enumeration severity low T1014, T1082
- Linux Kworker Process In Writable Process Path T1036, T1036.004
- Linux Make Privilege Escalation severity low T1548, T1548.003
- Linux MySQL Privilege Escalation severity low T1548, T1548.003
- Linux Ngrok Reverse Proxy Usage severity low T1090, T1102, T1572
- Linux Node Privilege Escalation severity low T1548, T1548.003
- Linux NOPASSWD Entry In Sudoers File severity low T1548, T1548.003
- Linux Obfuscated Files or Information Base64 Decode severity low T1027
- Linux Octave Privilege Escalation severity low T1548, T1548.003
- Linux OpenVPN Privilege Escalation severity low T1548, T1548.003
- Linux PHP Privilege Escalation severity low T1548, T1548.003
- Linux pkexec Privilege Escalation severity medium T1068
- Linux Possible Access Or Modification Of sshd Config File severity low T1098, T1098.004
- Linux Possible Access To Credential Files severity low T1003, T1003.008
- Linux Possible Access To Sudoers File severity low T1548, T1548.003
- Linux Possible Append Command To At Allow Config File severity low T1053, T1053.002
- Linux Possible Append Command To Profile Config File severity low T1546, T1546.004
- Linux Possible Append Cronjob Entry on Existing Cronjob File T1053, T1053.003
- Linux Possible Bootloader Modification severity medium T1542, T1542.001
- Linux Possible Cronjob Modification With Editor T1053, T1053.003
- Linux Possible GSM Privilege Escalation severity low T1068
- Linux Possible Nimbuspwn Privilege Escalation severity medium T1068
- Linux Preload Hijack Library Calls severity medium T1574, T1574.006
- Linux Proxy Socks Curl severity medium T1090, T1095
- Linux Puppet Privilege Escalation severity low T1548, T1548.003
- Linux Root Execution of id severity low T1033
- Linux RPM Privilege Escalation severity low T1548, T1548.003
- Linux Ruby Privilege Escalation severity low T1548, T1548.003
- Linux Service Restarted severity low T1053, T1053.006
- Linux Service Started Or Enabled severity low T1053, T1053.006
- Linux Setuid Using Chmod Utility severity low T1548, T1548.001
- Linux Setuid Using Setcap Utility severity low T1548, T1548.001
- Linux Shell History Access Via Command Line Utility severity low T1552, T1552.003
- Linux Shell Pseudo Device Reverse Shell severity low T1048, T1048.003, T1059
- Linux Shred Overwrite Command severity medium T1485
- Linux Sqlite3 Privilege Escalation severity low T1548, T1548.003
- Linux SSH Authorized Keys Modification severity low T1098, T1098.004
- Linux SSH Remote Services Script Execute severity medium T1021, T1021.004
- Linux Stdout Redirection To Dev Null File severity low T1686
- Linux Stop Services severity medium T1489
- Linux Sudo OR Su Execution T1548, T1548.003
- Linux Suspicious Child Process of PostgreSQL severity medium T1190
- Linux Suspicious Docker Build Command Execution severity low T1610
- Linux Suspicious GCC Invocation Building Init Shared Object severity medium T1027, T1027.004, T1068, T1129, T1608
- Linux Suspicious Namespace Creation severity medium T1068
- Linux Suspicious Privileged Container Execution severity low T1059, T1059.004, T1610
- Linux Suspicious React or Next.js Child Process severity medium T1059, T1059.004, T1190
- Linux Suspicious Redis Activity severity medium T1210, T1505
- Linux System Network Discovery severity low T1016
- Linux System Reboot Via System Request Key severity medium T1529
- Linux Telnet Authentication Bypass severity medium T1548
- Linux Unix Shell Enable All SysRq Functions severity low T1059, T1059.004
- Linux Usermod Root UID Set severity medium T1078, T1098, T1548, T1548.001
- Linux Visudo Utility Execution severity low T1548, T1548.003
- Suspicious Curl Network Connection severity medium T1105
- Suspicious Linux Discovery Commands severity medium T1059, T1059.004
- Web or Application Server Spawning a Shell severity medium T1133, T1190